Registry scanning

Learn about Registry scanning capability in Cortex Cloud

Registry scanning identifies security and compliance risks in container images before you deploy them to runtime environments. It is a foundational component of Cloud Workload Protection (CWP) and container supply chain security.

A container registry stores and distributes container images. Cortex Cloud supports scanning images in managed cloud registries and third-party registry providers. For more information, see Supported container registry integrations.

After you configure registry scanning, Cortex Cloud automatically scans images for the following:

• Vulnerabilities: Vulnerabilities in operating system packages, such as Debian, RHEL, and Alpine, and application dependencies, such as Python, Node.js, Java, and Go.

• Malware: Malware in container images, including binaries and scripts, using WildFire threat intelligence.

• Exposed secrets: API keys, private keys, credentials, tokens, and other secrets embedded in image layers.

• Software bill of materials (SBOM): Packages, libraries, binaries, and licenses identified across image layers.

• Compliance violations: Image configuration and base image issues evaluated against CIS benchmarks, organizational compliance policies, and security best practices.