#Examining Images for Vulnerabilities

Alauda Security Service enables you to analyze container images for vulnerabilities by using the built-in Scanner V4. The scanner inspects image layers, identifies packages, and matches them against vulnerability databases from sources such as NVD, OSV, and OS-specific feeds.

When vulnerabilities are detected, Alauda Security Service:

• Displays them in Vulnerability Management > Results
• Ranks and highlights them for risk assessment
• Checks them against enabled security policies

The scanner identifies installed components by inspecting specific files. If these files are missing, some vulnerabilities may not be detected. Required files include:

#Results Views

In the current UI, vulnerability findings are organized primarily through Vulnerability Management > Results. Common entry points include:

• User Workloads
• Platform
• Nodes
• More Views

Use these views to separate application images, platform components, and node-related findings during triage.

#Scanner V4 Overview

Scanner V4 is the default scanner. It improves coverage for language-specific and OS-specific components and is used for the image scanning workflows described in this guide.

#Scanner Workflow

#Workflow Steps

1. Central requests Scanner V4 Indexer to analyze images.
2. Indexer pulls metadata and downloads layers.
3. Indexer produces an index report.
4. Matcher matches images to vulnerabilities and generates reports.

#Common Scanner Warning Messages

#Supported Platforms and Formats

#Supported Linux Distributions

#Supported Package Formats

#Supported Programming Languages

#Supported Container Image Layer Formats

#Active and Watched Images

Alauda Security Service scans all active images every 4 hours. You can also add inactive images to the watched image list so they continue to be scanned and tracked.

Steps:

1. In the portal, go to Vulnerability Management > Results.
2. Click More Views > Inactive images.
3. Click Manage watched images and add or remove images as needed.

#On-Demand Scanning

To retrieve scan results on demand, you can also use the CLI:

roxctl image scan --image=<image_name>

If delegated scanning is configured for a cluster, you can add --cluster=<cluster_name> to route the image scan request to that cluster.

#Vulnerability Data Updates

In connected environments, Central fetches vulnerability definitions every 5 minutes from https://definitions.stackrox.io.

For disconnected environments, use the offline workflow described in Using Alauda Security Service in Offline Mode.