1.2. New features

With RHACS 4.7, you can integrate with the GitHub Container Registry (GHCR) to scan container images stored in ghcr.io. RHACS now includes a default integration that supports both public and private GHCR instances to secure your containerized workloads.

For more information, see Manually configuring GitHub Container Registry.

RHACS 4.7 introduces improved visibility for the OpenShift Container Platform component Common Vulnerabilities and Exposures (CVEs). You can now view these CVEs separately to assess and manage security risks.

To view the platform CVEs, click Vulnerability Management Results in the RHACS portal, and then click the Platform tab.

In RHACS 4.7, you can now enable machine-to-machine authentication by using short-lived RHACS Central tokens when you use Microsoft Entra ID, formerly known as Azure AD, as the OpenID Connect (OIDC) identity provider for your enterprise. You can exchange ID tokens with access tokens from RHACS Central. Microsoft Entra ID issues these ID tokens to your application’s service principals, and you can then use the RHACS access tokens to securely authenticate to the RHACS APIs.

For more information about how to exchange an identity token, see Exchanging an identity token.

For more information about how to use the Azure Entra ID service principals for machine to machine authentication with RHACS, see Using Azure Entra ID service principals for machine to machine auth with RHACS.

With RHACS 4.7, you can now see the status of a violation directly on the Violations page so that you can quickly determine whether the violation is still active. This streamlines automation workflows, such as creating a Jira ticket and sending it to an owner who does not use RHACS regularly.

By following the link in the ticket, the owner can immediately see if the violation is still relevant, reducing the risk of unnecessary delays or deprioritization. In addition, the page provides the full context of the violation and ensures that all relevant details are immediately available.

RHACS 4.7 introduces integration with the Exploit Prediction Scoring System (EPSS), a data-driven model that estimates the likelihood of a software vulnerability being exploited.

In addition to the severity and Common Vulnerability Scoring System (CVSS) score, an EPSS probability score from 0%-100% is now displayed for detected Common Vulnerabilities and Exposures (CVEs). You can use the EPSS score to better prioritize the remediation of CVE vulnerabilities and strengthen your security strategy.

For more information, see Prioritizing the vulnerabilities.

With RHACS 4.7, you can now get a better insight into the external IPs behind external entities in the network graph.

This enhancement helps you identify the specific IP addresses that your deployments are communicating with and gives you better insight into the external interactions and potential risks.

For more information, see Visualizing external entities.

In RHACS 4.7, the roxctl netpol generate command automatically detects when DNS connections are required and generates them accordingly. If you do not specify a port, port 53 is selected automatically, but you can change this by using the --dnsport flag. The --dnsport flag also accepts port names in addition to numbers. For example,--dnsport dns.

You can use port names as a more robust method of specifying the port if the service has a defined name. If you are a Red Hat OpenShift customer and use the default DNS setting, you should use the --dnsport flag to change the default port, as the OpenShift DNS pod listens on port 5353.

For more information, see roxctl netpol generate.

In RHACS 4.7, you can now bring vulnerability findings directly into the Red Hat Developer Hub (RHDH) and other platforms based on the upstream Backstage project by using the Backstage Plugin.

You can incorporate the RHACS plugin into your developer environment and review key vulnerabilities for your applications within the platform. This provides information that you need before you can take the necessary remediation actions.

For more information, see Viewing security information in Red Hat Developer Hub.

With RHACS 4.7, you can now generate a Software Bill of Materials (SBOM) from the scanned container images.

These SBOMs give you a detailed overview of all software components, dependencies, and libraries within your application. RHACS creates SBOMs of the Analyzed type and complies with the Software Package Data Exchange (SPDX) 2.3 specification.

For more information about the SBOMs of the Analyzed type, see Types of SBOM Documents (America’s Cyber Defense Agency documentation).

For more information about how to use RHACS to generate SBOMs, see Generating SBOMs from scanned images.

RHACS 4.7 introduces automatic certificate rotation for the secured cluster components, which ensures secure communication between Sensor, Admission Controller, and Collector within the cluster. Sensor also uses these certificates for a secure certificate-based architecture (mTLS) connection with Central.

For more information about the automatic certificate renewal, see Reissuing internal certificates for secured clusters by using automatic certificate renewal.

In RHACS 4.7, you can now use the Cluster Registration Secret (CRS) to bootstrap a secured cluster and register it with Central.

Unlike previous methods, CRS separates the bootstrap credentials from the operational certificates so that the cluster continues to work even if the bootstrap credentials are revoked. You can generate the CRS by using the roxctl CLI commands and revoke it if required.

RHACS 4.7 supports both the init bundle and CRS, but in a future release the init bundle will be deprecated in favor of CRS.

For more information, see:

In RHACS 4.7, you can now protect Red Hat OpenShift on IBM Cloud and run secured clusters on Red Hat OpenShift on IBM Cloud.

With RHACS 4.7, you can now use short-lived OpenID Connect (OIDC) credentials. The Microsoft Azure Identity Provider provides these credentials, and you can use these credentials to access the services in Microsoft Azure, such as the Azure Container Registry and Azure Sentinel.

This feature builds on the RHACS 4.4 release, which introduced the ability to use short-lived OIDC credentials from Amazon Web Services (AWS) and Google Cloud Platform (GCP) cloud providers to authenticate to the services hosted on these platforms.

For more information, see Manually configuring Microsoft Azure Container Registry.