Vulnerabilities Dashboard
Prisma Cloud Vulnerabilities Dashboard gives you a holistic graphical view of all the vulnerabilities across your Code to Cloud environment. An overview of the top impacting CVEs enables you to prioritize vulnerabilities based on existing risks and trace them from runtime back to the source. This risk assessment capability helps you to make informed decisions with findings and fix the vulnerable package or base image in code so that you remediate the root cause and resolve the issue when the build is next executed.
The dashboard helps you answer:
What are all the vulnerable assets across my entire application lifecycle?
Where should I focus to find and fix the vulnerabilities? What are the critical and urgent ones, and the ones that are patchable?
What actions can I take to remediate or mitigate the vulnerabilities in Code or Cloud?
The dashboard is only available to users with the System Administrator role on all stacks, except for app.gov and app.cn stacks. Additionally, app.gov stack users with a business license will not have access to the dashboard.
Discover Vulnerabilities
On Dashboard > Vulnerabilities you can discover all the vulnerabilities across your environment. Let’s say, there are 25K vulnerabilities in your environment out of which only 20637 are critical and high, 7470 are exploitable, out of which 7400 are patchable meaning these vulnerabilities are actionable for you to fix them. The funnel in the Prioritized Vulnerabilities further narrows down to just 35 vulnerable packages that are in use in the runtime that you can focus on.
Prerequisites
The following visualizations are available for you to help contextualize risks from vulnerabilities:
Vulnerabilities Overview - Provides a summarized view of the total vulnerabilities in your environment further divided into Vulnerabilities by Asset and Vulnerabilities that have already been remediated, allowing you to track and share your progress in securing your environment. Visualize the trends with Total Vulnerable Assets, and their metadata, Total Vulnerabilities Remediated, and Total Vulnerabilities count in the current snapshot.
Prioritized Vulnerabilities - Discover all the vulnerabilities across your workloads and identify the top-priority vulnerabilities (aggregated vulnerabilities that are urgent, exploitable, patchable, and vulnerable packages in use).
The vulnerabilities sourced from Compute and CAS (Cloud App Sec) are prioritized and aggregated based on the most urgent, exploitable, patchable, and vulnerable packages in use. This prioritization helps you to identify the top-priority vulnerabilities to focus on.
The aggregation is based on vulnerabilities that are:
Urgent: Critical, High
Exploitable: Exploit in the Wild and Exploit in POC
Patchable: Vulnerabilities that are actionable and have a patch to fix or mitigate.
Vulnerable packages in use
Top Impacting Vulnerabilities - Provides a ranked list of the most critical vulnerabilities in your environment based on the risk score. The ranked list consists of CVEs affecting the environment. Each CVE includes data about its risk factors, severity, CVSS, risk factors, and assets impacted.
Review the top-impacting vulnerabilities based on the CVE severity, CVSS score, Risk Factors, and the assets impacted across your CI/CD pipeline.
Vulnerability Impact by Stage - Visualize the sources of the vulnerabilities and the impact of the vulnerability across app stages of your application lifecycle. Trace vulnerabilities from runtime back to the repositories they originate from.
At each stage, you can select and investigate any of the impacted assets such as Packages, Images in IaC Files, Host VM Images, Registry Images, Deployed Images, Serverless Functions, and Hosts. This makes it easier for you to trace back the packages and images that were used to build a workload that is now vulnerable in the deploy stage, or runtime.
Prioritize and Assess Risk
Once you get a summarized view of all the discovered vulnerabilities, the dashboard helps you to narrow down to the most important and critical vulnerabilities to focus on.
Following are the paths you take to investigate and assess risk across the CBDR graph:
What do you want to do
Where to go
Result
View the top critical and high vulnerabilities
In Prioritized Vulnerabilities select Critical and High
Vulnerabilities with Critical and High Severity are listed under Investigate.
View top exploitable vulnerabilities
In Prioritized Vulnerabilities select Exploitable
Vulnerabilities that are high and critical with Risk factors Exploitable are listed under Investigate.
View top patchable vulnerabilities
In Prioritized Vulnerabilities select Patchable
Vulnerabilities that are high and critical with Risk factors Has fix are listed under Investigate.
View vulnerabilities (packages) in use
In Prioritized Vulnerabilities select In Use
Vulnerabilities that are high and critical with Risk factors Package in use are listed under Investigate.
You need to deploy Defenders to get real-time monitoring to detect the vulnerable packages in use in runtime.
Identify the assets vulnerable to a CVE
In Top Impacting Vulnerabilities select a CVE-XXXX-XXXXX
Assets affected by the vulnerability with cve.id=CVE-XXXX-XXXXX are listed in a CBDR graph under Investigate.
View vulnerable serverless functions on Runtime
In Vulnerability Impact By Stage select Serverless Functions
Serverless functions with high vulnerability are listed under Investigate
See vulnerable deployed container images in Runtime
In Vulnerability Impact By Stage select Deployed images
Container images with high vulnerability are listed under Investigate.
Show vulnerable hosts in Runtime
In Vulnerability Impact By Stage select Hosts
Hosts with high vulnerability are listed under Investigate.
See vulnerable registry images in Deploy
In Vulnerability Impact By Stage select Registry Images
Container Registry images with high vulnerabilities are listed under Investigate
View host VM images with high vulnerability
In Vulnerability Impact By Stage select Host VM Images
Host VMs with high vulnerability are listed under Investigate.
You can expand the assets in each CBDR stage and view details.
Remediate or Mitigate Vulnerabilities
As you access the vulnerability Overview, Top Impacting Vulnerabilities, and Vulnerability Impact by Stage, you can now explore the remediation options.
Select Dashboard > Vulnerabilities.
Select a vulnerability from any of the entry paths on the dashboard. Refer to the possible entry paths in prioritize and assess risks.
In the CBDR graph under Investigate, click on a vulnerable CVE > View Details.
The CVE side panel gives you an overview of the CVE with its CVSS score, the impacted stages, severity, risk factors, the package name, and the distros affected by this CVE.
Remediate or Mitigate a CVE
In the CVE side panel, you can either remediate or create a Jira ticket:
Select Remediate > Submit Pull Request for all packages and IaC files impacted by this vulnerability across all repositories.
Send To > Jira to create a Jira ticket with all the vulnerability details of the deployed images, registry images, and hosts.
Select Template* from the available ones, or add a new integration template under Settings > Integrations & Notifications.
Select Send.
Note: Dashboard > Vulnerabilities shows a total count of all the vulnerabilities across all the distro releases in your workload, which is higher than the total count of only the CVEs affecting your assets shown under Investigate > Search.
For example, when multiple vulnerabilities are attached to a single CVE, the vulnerability search shows a total count of only the CVEs impacted by these vulnerabilities.
Assess the impact on an Asset and take action
In the CVE side panel select Assets.
This lists all the assets affected by this CVE from the packages and IaC files in code & build to the images in the registry that are being deployed to the runtime as Hosts, Containers, and Serverless functions.
You can filter the assets based on Risk Factors, download all asset configurations, or take mitigation actions per asset type.
Following are the actions available for each asset type:
Asset Type: How can you mitigate or what action can you take
CVE: Remediate > Submit Pull Request Send To > Jira
Packages: Actions > Submit Pull Request and Actions > Suppress
Images in IaC files: Actions > Submit Pull Request and Actions > Suppress
Hosts: Actions > Create Jira Ticket
Deployed Images: Actions > Create Jira Ticket
Registry Images: Actions > Create Jira Ticket
Serverless Functions: Actions > Create Jira Ticket
Vulnerabilities Queries (RQL)
Investigate the vulnerable assets in Prisma Cloud with the vulnerability where RQL clause. Refer to the Vulnerabilities Queries.
Last updated
Was this helpful?