Vulnerability objectives

A vulnerability objective tracks open vulnerability (CVE) issues on your code and artifact assets — repositories and container images — toward a remediation goal. You define which assets to cover (the scope) and which vulnerabilities matter (the condition), and Cortex Cloud tracks the matching issues to resolution. Vulnerability objectives are the only objective type available in the current release.

Create a vulnerability objective to track vulnerability (CVE) issues on code and artifact assets — repositories and container images. You can start from a predefined starter prompt or compose a custom prompt. For the full set of asset scope and vulnerability condition filters the AppSec Agent supports, refer to see Reference A: Objective scope filters and Reference B: Objective condition filters.

Vulnerability objective prerequisites

Fulfill the prerequisites for the vulnerability sources you intend to track:

• Enable the Application Security SCA scanner, unless you intend to track only ingested CVE vulnerabilities
• Fulfill any prerequisites required to ingest third-party CVE vulnerability data — for example, onboarding the vendor. For more information refer to Ingest third-party data sources

Vulnerability issue sources

Vulnerability objectives evaluate vulnerability (CVE) issues on repositories and container images, regardless of how the underlying vulnerability was detected. A vulnerability issue counts toward an objective whether the CVE was found by:

• The native Cortex Cloud SCA scanner, which inventories open-source dependencies to detect CVE vulnerabilities in code and artifact assets
• Ingested SCA data from supported third-party vendors, such as Snyk and Semgrep, whose vulnerability findings Cortex Cloud normalizes into the unified data model

Vulnerability objectives scope

• Repositories: Objectives evaluate CVE issues carrying the vulnerability detection method
• Container images: Objectives evaluate vulnerability-category issues
• Exclusions: License, operational-risk, IaC, secrets, SAST, and CI/CD issues are not counted by vulnerability objectives

NOTE:

For the full set of supported filters, see:

• Reference A: Objective scope filters

• Reference B: Objective condition filters

Predefined vulnerability starter prompts

The vulnerability objective type ships with the following predefined starter prompts. Select one from the AppSec Objectives tab to create a vulnerability objective without composing a prompt yourself.

• Create an objective for critical vulnerabilities in deployed repositories
• Create an objective for critical vulnerabilities in registry images
• Create an objective for exploitable vulnerabilities in critical applications