> For the complete documentation index, see [llms.txt](https://docs.prismacloud.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.prismacloud.io/admin-guide/33/vulnerability-management/scan-images-for-custom-vulnerabilities.md).

# Scan Images for Custom Vulnerabilities

Prisma Cloud lets you scan for insecure versions of proprietary software components.

First, augment the Intelligence Stream of Prisma Cloud with your custom data that specifies a package type, name, and version number. Then configure Prisma Cloud to take action (alert or block) when the scanner finds this package in an image. By default, Prisma Cloud raises an alert when it detects a vulnerability in a custom component.

Prisma Cloud supports the following package types:

* Distro packages (deb, rpm)
* App packages
* Nodejs packages
* Python packages
* Ruby gems
* Java artifacts (JAR files)

For cases where Prisma Cloud does not offer built-in support for a package type, you can specify an MD5 hash for the file.

## Add a Custom Vulnerability

Define a custom vulnerability.

1. Open Console.
2. Go to **Manage > System > Custom Feeds > Custom Vulnerabilities**.
3. Select **Add**.
   1. Enter a **Name** for your vulnerability.
   2. Select a package **Type**.

      For Debian packages, RPM packages, and shared libraries, select **package**.

      If your package type is not supported, select **app**.
   3. Enter a name for your package or app.

      Package names must be specific for matching. For example, `containerd` is valid, `containerd*` is not.
   4. Specify the range of package versions for which your rule applies.

      The following formats can be used to specify versions:

      | Rule                                          | Format                                                                                                                 | Example     |
      | --------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------- | ----------- |
      | Specific version                              | Enter a single multi-dot number.                                                                                       | 1.1         |
      | Range of versions: Min and max are known.     | Enter two multi-dot numbers, separated by a dash.                                                                      | 5.4-5.5     |
      | Range of versions: Only min version is known. | Specify a multi-dot number for the minimum version, followed by a dash, then a wild card.                              | 0.22.4.1-\* |
      | Range of versions: Only max version is known. | Specify a wild card (\*) for the minimum version, followed by a dash, then a multi-dot number for the maximum version. | \*-0.22.4.1 |

      If package type is set to app, the version fields are not visible. Instead, enter the MD5 hash for your file or binary.
4. Select **Save**.

   Your custom vulnerability is now available to the scanner.

   By default, an alert is logged if an image scan detects a component that you have designated as vulnerable. To see the default rule, go to **Defend > Vulnerabilities > Images**, and click on the **Default - alert all components** rule. To change the default rule, select a different Alert or Block threshold. To take a different action, create a new vulnerability rule.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.prismacloud.io/admin-guide/33/vulnerability-management/scan-images-for-custom-vulnerabilities.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.