1. Home
    2. Prisma
    3. Prisma Cloud
    4. Prisma Cloud Administrator’s Guide (Compute)
    5. Vulnerability management
    6. Vulnerability Scan Reports

    Vulnerability Scan Reports

    Prisma Cloud scans images, hosts, and functions to detect vulnerabilities. The Prisma Cloud Intelligence Stream keeps Console up to date with the latest vulnerabilities. The data in this feed is used both for agentless scanning and is distributed to your Defenders for scans. The initial scan is triggered when a Defender is installed, or when you enable agentless scanning, the scans check for:
    • Published Common Vulnerabilities and Exposures (CVEs).
    • Vulnerabilities from misconfigurations.
    • Malware
    • Zero-day vulnerabilities
    • Compliance issues
    • Secrets After the initial scan, subsequent scans are triggered:
    • Periodically, according to the scan interval configured in Console. By default, images are scanned every 24 hours.
    • When new images are deployed onto the host.
    • When scans are forced with the
      Scan
       button in Console.
    Through Console, Defender can be extended to scan images for custom components. For example, you can configure Defender to scan for an internally developed library named libexample.so, and set a policy to block a container from running if version 1.9.9 or earlier at installed. For more information, see Scanning custom components.

    View image scan reports

    Review the health of all images in your environment.
    Sorting the table on vulnerability severity based on data from the last scan. If you update your vulnerability policy with a different alert threshold, rescan your images if you want to be able to sort based on your new settings.
    1. Open Console, then go to
      Monitor > Vulnerabilities > Images
      .
      The table summarizes the state of each image in your environment.
      All vulnerabilities identified in the last image scan can be exported to a CSV file by clicking the
      CSV
       button in the top left of the page.
      In case multiple images share the same image ID, but with different tags on different hosts, then these will be shown using +<Num> in the Tag column, as can be seen in the screenshot below.
    2. Click on an image report to open a detailed report.
    3. Click on the
      Vulnerabilities
       tab to see all CVE issues.
      CVE vulnerabilities are accompanied by a brief description. Click
      Show details
       for more information, including a link to the report on the National Vulnerability Database.
      The
      Vendor Status
       column contains terms such as 'deferred', 'fixed in…​', and 'open'. These strings are imported directly from the vendors' CVE databases. They are not Prisma Cloud-specific.

    Tagging vulnerabilities

    To help you manage and fix the vulnerabilities in your environment, you can assign tags to each vulnerability. The list of available tags is defined under
    Manage > Collections and Tags > Tags > Tag definition
     (see Tag definition). To assign a tag to a vulnerability, click on the
    Add tags to CVE
     action in the
    Tags
     column.
    Tagging a vulnerability will apply by default to the CVE ID, package, and resource you assigned the tag from. You can granularly adjust and extend the tag scope under
    Manage > Collections and Tags > Tags > Tag assignment
     (see Tag assignment).
    For example, assigning a tag from the following scan report, will apply to CVE-2020-16156, package perl, and image ubuntu:20.04.
    You can also add comments to each tag assignment, for example, to explain the reason this tag was added. Do it by clicking the comment icon on the left side of the tag.
    By default, all vulnerabilities, according to your policy, are listed. However, you can also examine vulnerabilities only with specific tags. Use the drop-down list to filter by tags.
    Remove a tag from a vulnerability using the close action available on the tag.
    When removing a tag from the scan report, the entire tag assignment is removed, which may be wider than just the single place you remove it from. For example, removing a tag that is applied to image ubuntu:20.04 by a tag assignment defined for images ubuntu:*, will remove the entire tag assignment, which means the tag will be removed from all ubuntu images.
    For more granular tag removal, go to the
    Manage > Collections and Tags > Tags > Tag assignment
    , and adjust the relevant tag scope.

    Per-layer vulnerability analysis

    To make it easier to understand how images are constructed and what components have vulnerabilities, Prisma Cloud correlates vulnerabilities to layers. This tool helps you assess how vulnerabilities were introduced into an image, and pick a starting point for remediation.
    To see the layer analysis, click on an image to open the scan report, then click the
    Layers
     tab.

    RHEL images

    The Prisma Cloud layers tool shows the instructions used to create each layer in an image. RHEL images, however, don’t contain the necessary metadata, so the Prisma Cloud layers tool shows an empty black box.
    To validate that the required metadata is absent, run docker history IMAGE-ID on a non-RHEL image. The CREATED BY column is fully populated.
    Next, run