Exploring Container Vulnerability Response

The Container Vulnerability Response application imports container vulnerable items (CVITs). According to the rules, the feature enables you to remediate the container vulnerabilities. Container Vulnerability Response is available through a separate subscription.

Container images overview

Unlike traditional applications, containers package all the application source codes along with their dependencies into a binary file called a container image. The image is published to a registry to provide an option to run this image as an application or a container instance on any platform. The stages in a container pre-deployment life cycle are as follows:

1. Compose the container image: The container image is composed and pointed to a source code or a dependent library.
2. Build the container image
3. Publish the container image: The container image file is published to a registry. Each image has its own unique ID based on the contents of the image. These images are pulled from the registry into the run-time environment in post-deployment mode. The images then run as container instances on the host in the production environment.

Scanning container images

A container image can be scanned for vulnerabilities either before or after deployment. If container images are scanned during the pre-deployment phase, you may get many vulnerability alerts, which may not need your immediate attention. However, scanning for vulnerabilities during the post-deployment phase provides greater benefits, such as the following:

• Providing visibility on the risk associated with the deployed applications.
• Providing a focused view on only the images in the production environment.
• Identifying and prioritizing the vulnerabilities that must be acted on immediately.
• Grouping and assignment of vulnerabilities based on the metadata of the image. For example, an image repository, an image label, and other attributes related to the container image can be used for grouping and assignment rules.

Each container image has the following key components:

• Container or image repository: Represents the docker image with a given repository or name. It hosts all the versions of the image.
• Docker image: Represents a specific version of the build docker image.
• Docker container: Represents a running instance of the docker image. Each version has a unique ID and has multiple instances of the containers running in the production environment.

Closing CVITs

• CVIT states
• Why/reasons CVITs get closed
• Exceptions
• False positives

CVIT states

Container Vulnerability Response modules

The Container Vulnerability Response module provides details on the following:

Container Vulnerable Items

The container vulnerable items (CVITs) are grouped and listed based on assignment, criticality, exploitability, and remediation status.

Libraries

Get access to the National Vulnerability Database (NVD) and third-party libraries. While the NVD library provides information limited to vulnerability item ID, the third-party library provides most of the details on a vulnerability item. Information in the NVD screen is populated only when the NVD integration is triggered.

Administration

The Administration module provides information on the vulnerable items' assignment rules, remediation target rules, and container vulnerability integrations. In addition, you can also configure the duration after which a vulnerable item should be auto closed. You can use the Configure VI Granularity section to configure the granularity of CVITs by specifying the key combinations. By default, a CVIT is created for a combination of an image repository, an image tag, and a vulnerability. You can add additional components to the key for further granularity. For example, you can create a CVIT for a combination of image repository, image tag, vulnerability, and cluster.

Available versions

Release version	Release Notes
If you intend to upgrade to Unified Security Exposure Management (USEM), please select a version starting with 30.x when installing or upgrading. Container Vulnerability Response v30.2 Container Vulnerability Response v30.1	For full details, please refer to the Knowledge Base article [KB2556844] and Installing Security Exposure Management Workspace applicationsdocumentation before proceeding.
If you do not intend to upgrade to Unified Security Exposure Management (USEM), please select a version below 30.x when installing or upgrading. Container Vulnerability Response v2.1	Container Vulnerability Response release notes For compatibility information, see KB0856498 Vulnerability Response Compatibility Matrix and Release Schema Changes.