Explore

Zurich Security Management

Release

zurich

ft:locale

en-US

ft:publication_title

Zurich Security Management

ft:clusterId

security

bundleId

security

workflow

Technology

Exploring Container Vulnerability Response

Release version: Zurich

Updated July 31, 2025

2 minutes to read

Summarize

Summarized using AI

Summary of Exploring Container Vulnerability Response

The Container Vulnerability Response application enables ServiceNow customers to import and remediate container vulnerable items (CVITs) effectively. This capability supports managing security risks associated with containerized applications by identifying vulnerabilities in container images either before or after deployment. Container Vulnerability Response is offered as a separate subscription and is designed to address the unique challenges of container security in modern application environments.

Show full answer Show less

Container Lifecycle and Vulnerability Scanning

Containers bundle application source code and dependencies into a container image, which is then published to a registry. Images are deployed as container instances on various platforms. The container lifecycle stages include composing, building, publishing, and running container images.

Scanning container images for vulnerabilities can occur during pre-deployment or post-deployment phases. Post-deployment scanning is particularly valuable for ServiceNow customers as it:

Provides visibility into risks of deployed applications in the production environment.
Focuses on images actively running, reducing noise from irrelevant vulnerability alerts.
Helps prioritize vulnerabilities that require immediate remediation.
Enables grouping and assignment of vulnerabilities based on image metadata such as repository, labels, and other attributes.

Key Components of Container Images

Container/Image Repository: Hosts all versions of a Docker image under a repository name.
Docker Image: A specific version of a built Docker image identified by a unique ID.
Docker Container: A running instance of a Docker image in the production environment.

Container Vulnerability Response Modules and Features

Container Vulnerable Items (CVITs): Lists vulnerabilities grouped by assignment, criticality, exploitability, and remediation status to streamline management and action.
Libraries: Integrates with the National Vulnerability Database (NVD) and third-party libraries to provide detailed vulnerability information. NVD data is loaded upon integration triggers.
Administration: Allows configuration of assignment rules, remediation targets, vulnerability integrations, and auto-closure timing of vulnerable items. Customers can customize the granularity of CVITs by defining key combinations (e.g., image repository, tag, vulnerability, cluster) to better tailor vulnerability tracking.

Practical Benefits for ServiceNow Customers

By leveraging Container Vulnerability Response, customers can:

Gain focused and actionable insights into container security risks in production.
Prioritize and remediate container vulnerabilities efficiently based on risk and operational context.
Customize vulnerability grouping and assignment to align with organizational processes.
Integrate vulnerability intelligence from authoritative sources to enrich investigation and response.

This application supports ongoing container security management as part of a comprehensive vulnerability response strategy.

The Container Vulnerability Response application imports container vulnerable items (CVITs). According to the rules, the feature enables you to remediate the container vulnerabilities. Container Vulnerability Response is available through a separate subscription.

Unlike traditional applications, containers package all the application source codes along with their dependencies into a binary file called a container image. The image is published to a registry to provide an option to run this image as an application or a container instance on any platform. The stages in a container pre-deployment life cycle are as follows:

Compose the container image: The container image is composed and pointed to a source code or a dependent library.
Build the container image
Publish the container image: The container image file is published to a registry. Each image has its own unique ID based on the contents of the image. These images are pulled from the registry into the run-time environment in post-deployment mode. The images then run as container instances on the host in the production environment.

Scanning container images

A container image can be scanned for vulnerabilities either before or after deployment. If container images are scanned during the pre-deployment phase, you may get many vulnerability alerts, which may not need your immediate attention. However, scanning for vulnerabilities during the post-deployment phase provides greater benefits, such as the following:

Providing visibility on the risk associated with the deployed applications.
Providing a focused view on only the images in the production environment.
Identifying and prioritizing the vulnerabilities that must be acted on immediately.
Grouping and assignment of vulnerabilities based on the metadata of the image. For example, an image repository, an image label, and other attributes related to the container image can be used for grouping and assignment rules.

Each container image has the following key components:

Container or image repository: Represents the docker image with a given repository or name. It hosts all the versions of the image.
Docker image: Represents a specific version of the build docker image.
Docker container: Represents a running instance of the docker image. Each version has a unique ID and has multiple instances of the containers running in the production environment.

Container Vulnerability Response modules

The Container Vulnerability Response module provides details on the following:

Container Vulnerable Items: The container vulnerable items (CVITs) are grouped and listed based on assignment, criticality, exploitability, and remediation status.
Libraries: Get access to the National Vulnerability Database (NVD) and third-party libraries. While the NVD library provides information limited to vulnerability item ID, the third-party library provides most of the details on a vulnerability item. Information in the NVD screen is populated only when the NVD integration is triggered.
Administration: The Administration module provides information on the vulnerable items' assignment rules, remediation target rules, and container vulnerability integrations. In addition, you can also configure the duration after which a vulnerable item should be auto closed. You can use the Configure VI Granularity section to configure the granularity of CVITs by specifying the key combinations. By default, a CVIT is created for a combination of an image repository, an image tag, and a vulnerability. You can add additional components to the key for further granularity. For example, you can create a CVIT for a combination of image repository, image tag, vulnerability, and cluster.

Available versions


Release version	Release Notes
Container Vulnerability Response v2.1 Container Vulnerability Response v2.06 Container Vulnerability Response v2.0.4	Container Vulnerability Response release notes For compatibility information, see KB0856498 Vulnerability Response Compatibility Matrix and Release Schema Changes.