Category: DevOps Toolbox

  • Observe Inc. Brings Generative AI to Observability

    Observe Inc. Brings Generative AI to Observability

    Observe, Inc. today revamped the Hubble user interface to its observability platform that has been infused with generative artificial intelligence (AI).

    Fresh from raising an additional $50 million in funding, Observe CEO Jeremy Burton said as the company’s software-as-a-service (SaaS) platform continues to be infused with AI using multiple large language models (LLMs), it’s becoming apparent that observability is rapidly becoming democratized.

    Most IT organizations still rely primarily on legacy monitoring tools to track a set of predefined metrics. Observability platforms have arisen to aggregate metrics, logs and traces to enable DevOps teams to launch queries and surface the root cause of performance issues or IT incidents. The challenge is that most observability platforms have required IT teams to master a proprietary query language such as Observe’s RegEx.

    However, with the rise of generative AI tools, it is now possible for IT professionals of all skill levels to employ a natural language chatbot to generate a RedEx query, noted Burton. A RegEx generation tool also parses data to add structure to logs on-the-fly, and there is also an OPAL Co-Pilot that generates OPAL code in response to natural language inputs.

    Observe

    The Hubble interface furthers those capabilities by simplifying the onboarding experience anytime there is a new member added to an IT team, he added. Hubble also expands the range of data access options available, including a public application programming interface (API), a command line interface (CLI), export to CSV and data sharing to the Snowflake cloud platform.

    IT teams are also coping with an explosion of telemetry data generated by modern distributed applications based on microservices architectures. Legacy observability and monitoring tools were not designed for these data volumes, so when there is an incident, the mean-time-to-resolution (MTTR) is increasingly extended. In contrast, the Observe platform now features a ‘Live’ mode that enables data to be queried in 20 seconds or less from when it was created.

    Other capabilities include an assistant embedded in Slack to help users troubleshoot issues and summarize threads for incident response.

    While it’s still early days as far as the adoption of observability platforms are concerned, there is already no shortage of options. The pending acquisition of Splunk by Cisco next year will cause more organizations to reevaluate their IT management options, so the pace at which organizations are transitioning to cloud-hosted observability platforms should increase, noted Burton. Even after the merger is completed, it might be several more months before Cisco integrates its AppDynamics platform with the observability platforms that Splunk added to its IT operational analytics platform, he added.

    In the meantime, IT environments are only going to become more complex. It won’t be feasible for most IT teams to manage highly distributed computing environments without some help from AI. The challenge, as always, will be finding the budget dollars needed to deploy an observability platform before the number of increased IT incidents makes the need for one painfully obvious.

  • Raspberry Pi 5: Faster, Better, Stronger — Spendier

    Raspberry Pi 5: Faster, Better, Stronger — Spendier

    Welcome to The Long View—where we peruse the news of the week and strip it to the essentials. Let’s work out what really matters.

    In a cheeky extra post this week: Everyone’s favorite single-board ARM computer, the Raspberry Pi, has a new generation coming soon. Compared to the ’4, RPi5 has double the performance, quadruple the base RAM and far more capable I/O. (more…)

  • Checkmarx Surfaces Threat to GitHub Repositories

    Checkmarx Surfaces Threat to GitHub Repositories

    Checkmarx, a provider of application security testing tools, today reported that malicious actors have been able to compromise the free automated dependency management tool for software projects, known as Dependabot, that GitHub provides.

    It’s not clear how prevalent the compromise is, but the attack involves the tokens that GitHub provides to allow access to Dependabot. Once cybercriminals gain access to a repository, they then add additional emails to the account that, once authorized, are used to inject malicious code into a repository that exfiltrates defined secrets to an external server. Cybercriminals can then modify any existing JavaScript files using a password-stealer to steal the credentials of any end user submitting their password in a web form.

    Guy Nachshon, a security researcher for Checkmarx, said Checkmarx was only able to discover the threat because one of the cyberattackers made a mistake. DevOps teams are advised to confirm the identity of each user that has access to both public and private GitHub repositories to ensure their software supply chain has not been compromised, he added.

    In general, attacks against software supply chains are becoming more sophisticated, noted Nachshon. Beyond launching phishing attacks to steal the credentials of individual members of an application development team, it appears cybercriminals are employing tactics and techniques that enable them to steal the credentials of an entire team contributing to a repository.

    These attacks, of course, have become a matter of national security. Governments around the world are crafting legislation that will hold organizations more accountable for the security of the applications they build and deploy. It may be a while before those proposals become law, but it’s clear the pressure on organizations to secure their software supply chains is building. More organizations than ever are, as a result, embracing DevSecOps best practices to better protect their software supply chains.

    The challenge is that many of the components used within those supply chains are from open source projects that organizations don’t have the ability to patch should a vulnerability be discovered. More troubling still, even when a patch is available, many organizations are reluctant to upgrade for fear of breaking an application. In effect, they are betting cybercriminals are not going to discover a potential exploit that exists in their application portfolio or that the damage inflicted will be less than what might otherwise be experienced should an application break following the update of a critical component.

    Playing the equivalent of Russian Roulette with application security is, to put it mildly, inadvisable. DevSecOps teams need to not only address vulnerabilities in applications as they are being built but also address the massive amount of technical debt relating to known vulnerabilities that have been allowed to accrue for more years than most anyone cares to admit.

    Unfortunately, cybercriminals are now clearly aware of the soft underbelly that exists within application environments, so the race to address an issue that has been allowed to fester is now on. And the odds, alas, are already stacked in favor of the malicious actors that are ready and willing to wreak havoc.

  • Dell Taps Microsoft to Simplify Hybrid Cloud Computing

    Dell Taps Microsoft to Simplify Hybrid Cloud Computing

    Dell Technologies, in collaboration with Microsoft, today unveiled a platform that tightly integrates an on-premises IT environment with the Azure cloud.

    Caitlin Gordon, vice president of multi-cloud product management for Dell Technologies, said the Dell APEX Cloud Platform for Microsoft Azure is the first instance of a hybrid cloud computing platform designed specifically to address that requirement using a Premier Solution of the Microsoft Azure Stack hyperconverged infrastructure (HCI) platform that Microsoft added to its portfolio today.

    The Premier Edition of Microsoft Azure Stack HCI makes available an instance of that platform that provides a more turnkey management experience than the existing editions, said Gordon.

    In the face of increased economic headwinds, more organizations are looking to lower the total cost of managing IT by reducing the number of control planes that need to be managed. Each platform that an IT team typically supports today has its own control plane that requires IT staff to manage it. Reducing the number of control planes creates an opportunity to reduce the total headcount currently required to manage multiple IT platforms.

    It also serves to streamline workflows in a way that enables DevOps teams to reduce the current level of friction encountered when managing multiple IT platforms, noted Gordon.

    At the core of Microsoft’s approach to hybrid cloud computing that Dell is embracing is Arc, a management framework that makes it possible to manage Azure cloud instances alongside on-premises IT environments. In terms of the ability to manage hybrid cloud computing environments, Microsoft is significantly more advanced than any other cloud service provider, said Gordon.

    It’s not clear whether IT organizations are embracing HCI platforms running an instance of the same core stack of software that Microsoft relies on to provide Azure services. If IT organizations expect to lower the cost of managing IT, there is no doubt they will need to modernize on-premises IT infrastructure. The older the platform, the more expensive it becomes to automate using various third-party frameworks.

    Regardless of the approach, IT teams need to reconcile the need to invest in automating workflows that span multiple IT platforms. Over time, those investments will reduce the total cost of IT, but getting the required funding to start that process will require IT teams to make a strong case for increasing the return on investment (ROI).

    In the meantime, the number of workloads running both in the cloud and at the network edge is only going to increase. At the same time, the bulk of existing workloads continue to run in local data center environments. Most IT teams will be required to find additional ways to automate the management of all those environments simply because the cost of adding additional IT staff to manage highly distributed computing environments as scale will otherwise be prohibitive.

    As such, the issues that IT teams are facing today may be a matter of not if the management of IT will become more automated but how soon.