Exploring Container Vulnerability Response

Release version: Washingtondc

Updated April 25, 2025

2 minutes to read

Summarize

Summarized using AI

Summary of Exploring Container Vulnerability Response

The Container Vulnerability Response application enables organizations to manage and remediate vulnerabilities associated with container images. It operates under a separate subscription and is essential for enhancing the security posture of applications running in containerized environments.

Show full answer Show less

Key Features

Vulnerability Management: Imports and organizes container vulnerable items (CVITs) based on criticality and remediation status.
Scanning Capabilities: Supports vulnerability scanning of container images pre- and post-deployment, with post-deployment scans offering better risk visibility.
Integration with NVD: Provides access to the National Vulnerability Database and third-party library details on vulnerabilities.
Administration Tools: Allows configuration of assignment rules, remediation targets, and automation for closing vulnerable items.
Granularity Configuration: Users can specify key combinations for more detailed CVIT tracking, enhancing vulnerability management precision.

Key Outcomes

By utilizing the Container Vulnerability Response application, customers can expect to:

Improve visibility into vulnerabilities within deployed applications.
Prioritize vulnerabilities effectively based on production environment context.
Enhance remediation strategies through organized grouping and assignment of vulnerabilities.
Streamline vulnerability management processes with configurable rules and integration capabilities.

The Container Vulnerability Response application imports container vulnerable items (CVITs). According to the rules, the feature enables you to remediate the container vulnerabilities. Container Vulnerability Response is available through a separate subscription.

Unlike traditional applications, containers package all the application source codes along with their dependencies into a binary file called a container image. The image is published to a registry to provide an option to run this image as an application or a container instance on any platform. The stages in a container pre-deployment life cycle are as follows:

Compose the container image: The container image is composed and pointed to a source code or a dependent library.
Build the container image
Publish the container image: The container image file is published to a registry. Each image has its own unique ID based on the contents of the image. These images are pulled from the registry into the run-time environment in post-deployment mode. The images then run as container instances on the host in the production environment.

Scanning container images

A container image can be scanned for vulnerabilities either before or after deployment. If container images are scanned during the pre-deployment phase, you may get many vulnerability alerts, which may not need your immediate attention. However, scanning for vulnerabilities during the post-deployment phase provides greater benefits, such as the following:

Providing visibility on the risk associated with the deployed applications.
Providing a focused view on only the images in the production environment.
Identifying and prioritizing the vulnerabilities that must be acted on immediately.
Grouping and assignment of vulnerabilities based on the metadata of the image. For example, an image repository, an image label, and other attributes related to the container image can be used for grouping and assignment rules.

Each container image has the following key components:

Container or image repository: Represents the docker image with a given repository or name. It hosts all the versions of the image.
Docker image: Represents a specific version of the build docker image.
Docker container: Represents a running instance of the docker image. Each version has a unique ID and has multiple instances of the containers running in the production environment.

Container Vulnerability Response modules

The Container Vulnerability Response module provides details on the following:

Container Vulnerable Items: The container vulnerable items (CVITs) are grouped and listed based on assignment, criticality, exploitability, and remediation status.
Libraries: Get access to the National Vulnerability Database (NVD) and third-party libraries. While the NVD library provides information limited to vulnerability item ID, the third-party library provides most of the details on a vulnerability item. Information in the NVD screen is populated only when the NVD integration is triggered.
Administration: The Administration module provides information on the vulnerable items' assignment rules, remediation target rules, and container vulnerability integrations. In addition, you can also configure the duration after which a vulnerable item should be auto closed. You can use the Configure VI Granularity section to configure the granularity of CVITs by specifying the key combinations. By default, a CVIT is created for a combination of an image repository, an image tag, and a vulnerability. You can add additional components to the key for further granularity. For example, you can create a CVIT for a combination of image repository, image tag, vulnerability, and cluster.

Available versions


Release version	Release Notes
Container Vulnerability Response v2.13, v2.12, v2.11, v2.10, v2.6, v2.5