Vulnerability Explorer
Most scanners find and list vulnerabilities, but Vulnerability Explorer takes it a step further by analyzing the data within the context of your environment.
Because Prisma Cloud can see how the containers run in your environment, we can identify the biggest risks and prioritize them for remediation.
To view Vulnerability Explorer, open Console, then go to
Monitor > Vulnerabilities > Vulnerability Explorer
.Roll-ups
The charts at the top of the Vulnerability Explorer helps you answer two questions:
For each object type (image, host, function), the chart reports a count of vulnerabilities in each object class in your environment as a function of time.
Consider an environment that has just a single image, where that image has three vulnerabilities: one high, one medium, and one low.
Then at time=today on the
Images vulnerabilities
chart, you could read the following values: Critical - 0
High - 1
Medium - 1
Low - 1
For each object type (image, host, function), the chart reports a count of the highest severity vulnerability in each object class in your environment as a function of time.
Consider an environment that has just a single image, where that image has three vulnerabilities: one high, one medium, and one low.
Then at time=today on the
Impacted images
chart, you could read the following values: Critical - 0
High - 1
Medium - 0
Low - 0
Let’s look at it another way with a different set of data.
Assume the reading at t=today reports the following values, where t is some point on the x-axis of the chart.
Critical - 1
High - 1
Medium - 0
Low - 2
If your policy calls for addressing all critical vulnerabilities, then the chart tells you that there is precisely one image in your environment that has at least one critical vulnerability.
Therefore, your work for today is to fix one image.
That image might also have two high vulnerabilities and twenty low vulnerabilities, which you will see when you open the image’s scan report, but this chart is not designed to give you a count of total number of vulnerabilities.
Search tool
The search tool at the top of the page lets you determine if any image or host in your environment is impacted by a specific vulnerability (whether it is in the top ten list or not).
Top ten lists
Vulnerability Explorer gives you a ranked list of the most critical vulnerabilities in your environment based on a scoring system.
There are separate top ten lists for the container images, hosts, and functions in your environment.
The top ten table is driven by a risk score.
The most important factor in the risk score is the vulnerability’s severity.
But additional factors are taken into account, such as:
- Is a fix available from the vendor?
- Is the container exposed to the Internet?
- Are ingress ports open?
- Is the container privileged?
- Is an exploit available?
The underlying goal of the risk score is to make it actionable (should you address the vulnerability, and with what urgency).
Factors that contribute to the risk score are shown in the Risk Factors column.
Running containers can introduce additional environmental factors that increase the calculated score for a vulnerability.
For example, when the container runs as root, it could exacerbate the problem