Note:
This app version is intended for Unified Security Exposure Management (USEM), a significant architectural upgrade to the Vulnerability Response applications.
If you are currently using Vulnerability Response and upgrading to USEM for the first time, you must use the Migration assistant for Unified Security Exposure Management to ensure a safe and successful upgrade. For full details, please refer to the KB2556844 and documentation before proceeding.
If you do not intend to upgrade to USEM, please select a version below 30.x when installing or upgrading.
Vulnerability Response and Configuration Compliance for Containers helps organizations respond to container vulnerabilities quickly and efficiently by connecting security and application teams, and providing real-time visibility into your security posture. Container Vulnerability Response connects the workflow and automation capabilities of the Now Platform® with vulnerability scan data from leading container security vendors to give your teams a single platform for a response that can be shared between security and application teams.
The Vulnerability Response and Configuration Compliance for Containers application includes the following capabilities:
- Refer to a Docker image as a configuration item (CI) from the container vulnerable items (CVITs).
- Provide runtime context such as Kubernetes Services, Clusters, Namespaces, and cloud account metadata for security teams so they can make decisions on assignment, remediation target, risk score calculation, and more.
- Assignment rules automatically assign container vulnerabilities to the application teams based on Docker Image labels, Kubernetes cluster/namespace/service information, cloud account ID, cloud account name, cloud region, cloud provider, etc.
- Populate base OS image vulnerable items separately to facilitate independent tracking of these vulnerabilities.
- Provide flexibility to configure granularity of container vulnerable items to track at Docker image level, cluster level, service level, etc.
- Automatically detect new versions of container images being deployed and close vulnerabilities reported on older versions.
- Exception management features for remediation owners to request for exceptions, multi-level approval workflow, and exception rules to automatically defer container vulnerable items.
- PA dashboard, which provides visibility into vulnerability and remediation trends.
New:
Added a Fix Intel section to the Details card on the container vulnerable item and container vulnerability overview tabs, so remediation guidance appears alongside the other finding details.
Changed:
- Enhanced accessibility for keyboard and screen reader users in the Create Change Request and Bulk Edit dialogs. Changes include correct headings and titles, a logical focus order, labeled fields, button order, and screen reader announcements.
- Performance enhancements for the scheduled jobs that refresh vulnerability counts. They no longer update records whose counts haven't changed, and you might see reduced run times on instances with large vulnerability tables.
Fixed:
- An issue where container vulnerable items did not reopen correctly when a vulnerability group's exception rule expired.
- Granularity can no longer be edited for any container integration, including Wiz, once container vulnerable items or findings exist. Previously, only the Prisma Cloud Compute integration had this restriction.
- Reduced excessive warning messages in the system log during container image imports.
- An issue where exception expiring and expired notifications for vulnerable items and remediation tasks were not sent.
- An issue where the Ransomware and CISA KEV values on vulnerability groups were swapped after rollup.
- An issue where state changes on a remediation task did not roll down to its vulnerable items if the task had more than 200 associated items. A fix script is provided to correct this issue on vulnerable items affected prior to the fix.
The following application for Vulnerability Response and Configuration Compliance for Containers application must be installed and activated.
- Vulnerability Response
- Security Exposure Management (requires entitlement from the store)
Permissions and roles
- Roles required:
- For installation: System Admin (admin)
- For configurations: Container Vulnerability Admin (sn_vul_container.vulnerability_admin) for Container Vulnerability Response