15.2. Viewing and addressing vulnerabilities

Procedure

1. In the RHACS portal, go to Platform Configuration Integrations.
2. Under Image Integrations, select StackRox Scanner.
3. From the list of scanners, select StackRox Scanner to view its details.
4. Click Edit.
5. To use only the image scanner and not the node scanner, click Image Scanner.
6. Click Save.

Procedure

1. In the RHACS portal, go to Vulnerability Management Results.
2. Click More Views and select All vulnerable images.

3. Optional: You can choose to view observed vulnerabilities or those that have been deferred or marked as false positives. Click one of the following tabs:

   • Observed: Lists vulnerabilities that RHACS observed across all images and workloads.
   • Deferred: Lists vulnerabilities that have been observed but had a deferral request submitted and approved in the exception management workflow.
   • False positives: Lists vulnerabilities that have been observed but were identified as false positives in the exception management workflow.

4. Optional: You can select the following options to refine the list of results:

   • Prioritize by namespace view: Displays a list of namespaces sorted according to the risk priority. You can use this view to quickly identify and address the most critical areas. In this view, click <number> deployments in a table row to return to the all vulnerable images view, with filters applied to show only deployments for the selected namespace.
   • Default filters: You can select filters for CVE severity and CVE status that are automatically applied across all views on this page. These filters are applied when you visit the page from another section of the RHACS web portal or from a bookmarked URL. They are saved in the local storage of your browser.

5. Click one of the following tabs to view the data that you want:

   • <number> CVEs: Displays vulnerabilities organized by CVE
   • <number> Images: Displays images that contain discovered vulnerabilities.
   • <number> Deployments: Displays deployments that contain discovered vulnerabilities.

6. Optional: Choose the appropriate method to re-organize the information in the User Workloads tab:

   • To sort the table in ascending or descending order, select a column heading.
   • To filter the table, use the filter bar.

   • To select the categories that you want to display in the table, perform the following steps:

     1. Click Columns.

     2. Choose the appropriate method to manage the columns:

        • To view all the categories, click Select all.
        • To reset to the default categories, click Reset to default.
        • To view only the selected categories, select the one or more categories that you want to view, and then click Save.

7. To filter the list of results by entity, for example, to search for a specific named CVE, select the appropriate filters and attributes.

   To select multiple entities and attributes, click the right arrow icon to add another criteria. Depending on your choices, enter the appropriate information such as text, or select a date or object.

   The filter entities and attributes are listed in the following table.

   Expand

   표 15.4. CVE filtering

   Entity	Attributes
   Image	Name: The name of the image. Operating system: The operating system of the image. Tag: The tag for the image. Label: The label for the image. Registry: The registry where the image is located.
   CVE	Name: The name of the CVE. Discovered time: The date when RHACS discovered the CVE. CVSS: The severity level for the CVE. The following values are associated with the severity level for the CVE: is greater than is greater than or equal to is equal to is less than or equal to is less than EPSS probability: The likelihood that the vulnerability will be exploited according to the Exploit Prediction Scoring System (EPSS). This EPSS data provides a percentage estimate of the probability that exploitation of this vulnerability will be observed in the next 30 days. The EPSS collects data of observed exploitation activity from partners, and exploitation activity does not mean that an attempted exploitation was successful. The EPSS score should be used as a single data point along with other information, such as the age of the CVE, to help you prioritize the vulnerabilities to address. For more information, see RHACS and EPSS.
   Image Component	Name: The name of the image component, for example, activerecord-sql-server-adapter Source: OS Python Java Ruby Node.js Go Dotnet Core Runtime Infrastructure Version: Version of the image component; for example, 3.4.21. You can use this to search for a specific version of a component, for example, in conjunction with a component name.
   Deployment	Name: Name of the deployment. Label: Label for the deployment. Annotation: The annotation for the deployment. Status: Whether the deployment is inactive or active.
   Namespace	ID: The metadata.uid of the namespace that is created by Kubernetes. Name: The name of the namespace. Label: The label for the namespace. Annotation: The annotation for the namespace.
   Cluster	ID: The alphanumeric ID for the cluster. This is an internal identifier that RHACS assigns for tracking purposes. Name: The name of the cluster. Label: The label for the cluster. Type: The cluster type, for example, OCP. Platform type: The platform type, for example, OpenShift 4 cluster.

   Show more
   • CVE severity: You can select one or more levels.
   • CVE status: You can select Fixable or Not fixable.

Procedure

1. In the RHACS portal, click Vulnerability Management Results.
2. Click More Views Inactive images.
3. Click Manage watched images.
4. In the Image name field, enter the fully-qualified image name that begins with the registry and ends with the image tag, for example, docker.io/library/nginx:latest.
5. Click Add image to watch list.

6. Optional: To remove a watched image, locate the image in the Manage watched images window, and click Remove watch.

   중요

   In the RHACS portal, click Platform Configuration System Configuration to view the data retention configuration.

   All the data related to the image removed from the watched image list continues to appear in the RHACS portal for the number of days mentioned on the System Configuration page and is only removed after that period is over.

7. Click Close to return to the Inactive images page.

Procedure

1. In the RHACS portal, go to Vulnerability Management Results.
2. Click More Views and select Images without CVEs.

3. To filter the list of results by entity, for example, to search for a specific image, select the appropriate filters and attributes.

   To select multiple entities and attributes, click the right arrow icon to add another criteria. Depending on your choices, enter the appropriate information such as text, or select a date or object.

   The filter entities and attributes are listed in the following table.

   참고

   The Filtered view icon indicates that the displayed results were filtered based on the criteria that you selected. You can click Clear filters to remove all filters, or remove individual filters by clicking on them.

   Expand

   표 15.5. Filter options

   Entity	Attributes
   Image	Name: The name of the image. Operating system: The operating system of the image. Tag: The tag for the image. Label: The label for the image. Registry: The registry where the image is located.
   Image Component	Name: The name of the image component, for example, activerecord-sql-server-adapter Source: OS Python Java Ruby Node.js Go Dotnet Core Runtime Infrastructure Version: Version of the image component; for example, 3.4.21. You can use this to search for a specific version of a component, for example, in conjunction with a component name.
   Deployment	Name: Name of the deployment. Label: Label for the deployment. Annotation: The annotation for the deployment. Status: Whether the deployment is inactive or active.
   Namespace	ID: The metadata.uid of the namespace that is created by Kubernetes. Name: The name of the namespace. Label: The label for the namespace. Annotation: The annotation for the namespace.
   Cluster	ID: The alphanumeric ID for the cluster. This is an internal identifier that RHACS assigns for tracking purposes. Name: The name of the cluster. Label: The label for the cluster. Type: The cluster type, for example, OCP. Platform type: The platform type, for example, OpenShift 4 cluster.

   Show more

4. Click one of the following tabs to view the data that you want:

   • <number> Images: Displays images that contain discovered vulnerabilities.
   • <number> Deployments: Displays deployments that contain discovered vulnerabilities.

5. Optional: Choose the appropriate method to re-organize the information in the page:

   • To select the categories that you want to display in the table, perform the following steps:

     1. Click Columns.

     2. Choose the appropriate method to manage the columns:

        • To view all the categories, click Select all.
        • To reset to the default categories, click Reset to default.
        • To view only the selected categories, select the one or more categories that you want to view, and then click Save.
        • To sort the table in ascending or descending order, select a column heading.
6. In the list of results, click an image name or deployment name to view more information about the item.

Procedure

1. Go to Vulnerability Management Results.
2. Click More Views and select Kubernetes components.
3. Click the <number> CVEs or <number> Clusters to display by CVE or cluster.

4. Optional: Within the results list, you can filter results by cluster and CVE. To filter vulnerabilities based on an entity, select the appropriate filters and attributes.

   To select multiple entities and attributes, click the right arrow icon to add another criteria. Depending on your choices, enter the appropriate information such as text, or select a date or object.

   The filter entities and attributes are listed in the following table.

   Expand

   표 15.6. Filter options

   Entity	Attributes
   Cluster	ID: The alphanumeric ID for the cluster. This is an internal identifier that RHACS assigns for tracking purposes. Name: The name of the cluster. Label: The label for the cluster. Type: The cluster type, for example, OCP. Platform type: The platform type, for example, OpenShift 4 cluster.
   CVE	Name: The name of the CVE. Discovered time: The date when RHACS discovered the CVE. CVSS: The severity level for the CVE. The following values are associated with the severity level for the CVE: is greater than is greater than or equal to is equal to is less than or equal to is less than Type: The type of CVE: Kubernetes Istio OpenShift

   Show more

5. Optional: To filter the table based on the status of a CVE, from the CVE status drop-down list, select one or more statuses.

   The following values are associated with the status of a CVE:

   • Fixable
   • Not fixable

Procedure

1. In the RHACS portal, do any of the following tasks:

   • To view platform CVEs, click Vulnerability Management Platform CVEs.
   • To view node CVEs, click Vulnerability Management Node CVEs.
2. Select one or more CVEs.

3. Select the appropriate method to snooze the CVE:

   • If you selected a single CVE, click the overflow menu, , and then select Snooze CVE.
   • If you selected multiple CVEs, click Bulk actions Snooze CVEs.
4. Select the duration of time to snooze.

5. Click Snooze CVEs.

   You receive a confirmation that you have requested to snooze the CVEs.

Procedure

1. In the RHACS portal, do any of the following tasks:

   • To view the list of platform CVEs, click Vulnerability Management Platform CVEs.
   • To view the list of node CVEs, click Vulnerability Management Node CVEs.
2. To view the list of snoozed CVEs, click Show snoozed CVEs in the header view.
3. Select one or more CVEs from the list of snoozed CVEs.

4. Select the appropriate method to unsnooze the CVE:

   • If you selected a single CVE, click the overflow menu, , and then select Unsnooze CVE.
   • If you selected multiple CVEs, click Bulk actions Unsnooze CVEs.

5. Click Unsnooze CVEs again.

   You receive a confirmation that you have requested to unsnooze the CVEs.

Procedure

1. In the RHACS portal, do any of the following tasks:

   • To view the list of platform CVEs, click Vulnerability Management Platform CVEs.
   • To view the list of node CVEs, click Vulnerability Management Node CVEs.
2. Click Show snoozed CVEs to view the list.

Procedure

1. In the RHACS portal, click Vulnerability Management Results.
2. Click User Workloads.

3. Choose the appropriate method to mark the CVEs:

   • If you want to mark a single CVE, perform the following steps:

     1. Find the row which contains the CVE that you want to take action on.
     2. Click the overflow menu, , for the CVE that you identified, and then select Mark as false positive.

   • If you want to mark multiple CVEs, perform the following steps:

     1. Select each CVE.
     2. From the Bulk actions drop-down list, select Mark as false positives.
4. Enter a rationale for requesting the exception.
5. Optional: To review the CVEs that are included in the exception request, click CVE selections.

6. Click Submit request.

   You receive a confirmation that you have requested an exception.

7. Optional: To copy the approval link and share it with your organization’s exception approver, click the copy icon.
8. Click Close.

Procedure

1. In the RHACS portal, click Vulnerability Management Results.
2. Click the User Workloads tab.
3. To view the list of images, click <number> Images.
4. Find the row that lists the image that you want to mark as a false positive, and click the image name.

5. Choose the appropriate method to mark the CVEs:

   • If you want to mark a single CVE, perform the following steps:

     1. Find the row which contains the CVE that you want to take action on.
     2. Click the overflow menu, , for the CVE that you identified, and then select Mark as false positive.

   • If you want to mark multiple CVEs, perform the following steps:

     1. Select each CVE.
     2. From the Bulk actions drop-down list, select Mark as false positives.
6. Select the scope. You can select either all tags associated with the image or only the image.
7. Enter a rationale for requesting the exception.
8. Optional: To review the CVEs that are included in the exception request, click CVE selections.

9. Click Submit request.

   You receive a confirmation that you have requested an exception.

10. Optional: To copy the approval link and share it with your organization’s exception approver, click the copy icon.
11. Click Close.

Procedure

1. To see CVEs that have been deferred or marked as false positives, with the exceptions approved by an approver, click Vulnerability Management Results.
2. Click the User Workloads tab.

3. Complete any of the following actions:

   • To see CVEs that have been deferred, click the Deferred tab.

   • To see CVEs that have been marked as false positives, click the False positives tab.

     참고

     To approve, deny, or change deferred or false positive CVEs, click Vulnerability Management Exception Management.

4. Optional: To view additional information about the deferral or false positive, click View in the Request details column. The Exception Management page is displayed.

Procedure

1. In the RHACS portal, click Vulnerability Management Results.
2. Click the User Workloads tab.

3. Choose the appropriate method to defer a CVE:

   • If you want to defer a single CVE, perform the following steps:

     1. Find the row which contains the CVE that you want to mark as a false positive.
     2. Click the overflow menu, , for the CVE that you identified, and then click Defer CVE.

   • If you want to defer multiple CVEs, perform the following steps:

     1. Select each CVE.
     2. Click Bulk actions Defer CVEs.
4. Select the time period for the deferral.
5. Enter a rationale for requesting the exception.
6. Optional: To review the CVEs that are included in the exception menu, click CVE selections.

7. Click Submit request.

   You receive a confirmation that you have requested a deferral.

8. Optional: To copy the approval link to share it with your organization’s exception approver, click the copy icon.
9. Click Close.

Procedure

1. To view the list of pending requests, do any of the following tasks:

   • Paste the approval link into your browser.
   • Click Vulnerability Management Exception Management, and then click the request name in the Pending requests tab.
2. Review the scope of the vulnerability and decide whether or not to approve it.

3. Choose the appropriate option to manage a pending request:

   • If you want to deny the request and return the CVE to observed status, click Deny request.

     Enter a rationale for the denial, and click Deny.

   • If you want to approve the request, click Approve request.

     Enter a rationale for the approval, and click Approve.

4. To cancel a request that you have created and return the CVE to observed status, click Cancel request. You can only cancel requests that you have created.

5. To update the deferral time period or rationale for a request that you have created, click Update request. You can only update requests that you have created.

   After you make changes, click Submit request.

   You receive a confirmation that you have submitted a request.