> For the complete documentation index, see [llms.txt](https://docs.prismacloud.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.prismacloud.io/admin-guide/32/vulnerability-management/base-images.md).

# Exclude Base Image Vulnerabilities

Prisma Cloud lets you filter out base image vulnerabilities from your scan reports.

A base image is a starting point or an initial step for the image. Dockerfile usually starts from a base image. Filtering out vulnerabilities, whose source is the base image, can help your teams focus on the vulnerabilities relevant for them to fix.

Excluding base image vulnerabilities is currently not supported for Windows images and images built by kaniko.

## Define base images

For Prisma Cloud to be able to exclude base image vulnerabilities, first identify the base images in your environment.

The base images you define must reside in your registry, and they must be scanned to exclude their vulnerabilities from scan reports.

1. Open Console.
2. Go to **Defend > Vulnerabilities > Images > Base images**.
3. Select **Add New**.
4. Specify the base image and enter a **Description** for it.

   The base image should be specified in the following format: *registry/repo:tag*. You can use wildcards for the tag definition.
5. Select **Add**.

   <figure><img src="/files/xadRBs4ygUjwoo1B92kt" alt="base images add"><figcaption></figcaption></figure>
6. You can view the specific base image digests of the base image you created using the **View images** action.

   These are the digests found in the registry scanning that are matching the base image you defined.

   <figure><img src="/files/wcKs5eLcSbsLMDlKtobb" alt="base images view"><figcaption></figcaption></figure>

## Exclude base images vulnerabilities in the Monitor view

When reviewing the health of the images in your environment, whether they are deployed images, registry images, or images scanned in a CI process, you can exclude the base image’s vulnerabilities from the scan results.

If you enabled "Exclude base images vulnerabilities" under **Defend > Vulnerabilities > Images > Deployed/CI**, the filter will not yield any results on the scan results monitor.

1. Open the Console, then go to **Monitor > Vulnerabilities > Images > Deployed images/Registries/CI**.
2. Use the **Exclude base images vulns** filter to exclude the vulnerabilities coming from base images. You will see the vulnerability counters changing.

   <figure><img src="/files/u7VlCbZ21o7zVke3QwUA" alt="base images before filter"><figcaption></figcaption></figure>

   <figure><img src="/files/OJeJTQpTjMg1PkVUPijZ" alt="base images after filter"><figcaption></figcaption></figure>
3. Click on an image report to open a detailed report.
4. Review the filtered vulnerabilities. For reviewing the base image, use the link at the top of the page.

   <figure><img src="/files/NJrgMDUqnrl0uRt9SnKL" alt="base images vulnerabilities tab"><figcaption></figcaption></figure>
5. In the **Layers** tab, the vulnerabilities counters will also exclude base image vulnerabilities, and you’ll see an indication for the base image’s layers.

   <figure><img src="/files/bUcfoF2KP4wsN3MHkWeS" alt="base images layers tab"><figcaption></figcaption></figure>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.prismacloud.io/admin-guide/32/vulnerability-management/base-images.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.