Table of Contents
Base images
Prisma Cloud lets you filter out base image vulnerabilities from your scan reports.
A base image is a starting point or an initial step for the image. Dockerfile usually starts from a base image.
Filtering out vulnerabilities, whose source is the base image, can help your teams focus on the vulnerabilities relevant for them to fix.
Excluding base image vulnerabilities is currently not supported for Windows images and images built by kaniko.
Define base images
For Prisma Cloud to be able to exclude base image vulnerabilities, first identify the base images in your environment.
To define your base images, go to
Defend > Vulnerabilities > Images > Base images
.
The base images you define must reside in your registry, and they must be scanned to exclude their vulnerabilities from scan reports.- Open Console.
- Go toDefend > Vulnerabilities > Images > Base images.
- ClickAdd New.
- Specify the base image and enter aDescriptionfor it.The base image should be specified in the following format: registry/repo:tag. You can use wildcards for the tag definition.
- ClickSave.
- You can view the specific base image digests of the base image you created using theView imagesaction.These are the digests found in the registry scanning that are matching the base image you defined.Prisma Cloud stores a maximum of the 50 latest digests per base image. When the limit is reached, the oldest digests are overwritten as new digests are discovered.
Exclude base images vulnerabilities in the Monitor view
When reviewing the health of the images in your environment, whether they are deployed images, registry images, or images scanned in a CI process, you can exclude the base image’s vulnerabilities from the scan results.
If you enabled "Exclude base images vulnerabilities" under
Defend > Vulnerabilities > Images > Deployed/CI
, the filter will not yield any results on the scan results monitor.- Open the Console, then go toMonitor > Vulnerabilities > Images > Deployed images/Registries/CI.
- Use theExclude base images vulnsfilter to exclude the vulnerabilities coming from base images. You will see the vulnerability counters changing.
- Click on an image report to open a detailed report.
- Review the filtered vulnerabilities. For reviewing the base image, use the link at the top of the page.
- In theLayerstab, the vulnerabilities counters will also exclude base image vulnerabilities, and you’ll see an indication for the base image’s layers.
