Investigate and remediate vulnerabilities

Learn how to investigate vulnerability issues, findings, and affected assets, then track remediation.

Cortex XDR provides several ways to view and track vulnerability data so you can monitor, investigate, and remediate vulnerabilities in your environment.

View all Vulnerabilities

The Vulnerabilites page displays all your vulnerabilities grouped by CVE or other vulnerability ID. This view shows you how prevalent each vulnerability is in your environment. The Vulnerabilities page includes key information about each vulnerability, with links to the related lists of instances (also called findings), related issues, and impacted assets.

Go to Posture Management → Vulnerability Management → Vulnerabilities.

View vulnerability issues

The Vulnerability Issues page displays all vulnerability issues along with critical vulnerability intelligence and context so you can assign an issue to an owner, investigate, remediate, and track progress. Follow the steps below to view Vulnerability Issues and investigate them further:

1. Go to Posture Management → Vulnerability Management → Vulnerability Issues. Click on an issue in the table to display the issue details panel. You can also optionally generate a .tsv file export of the data if required from the Vulnerability Issues page.

2. The Overview tab on the Vulnerability Issues panel captures all the relevant details to further investigate the vulnerability including Summary, Vulnerable Asset and Code Details, Security Controls, and Remediation Steps. In addition, you can further isolate the vulnerability by examining the Exposure Graph. Use the graph to investigate relationships between K8s Namespaces, Clusters, Workloads, and Container Images.

   

   exposure-graph.png
3. Review the Exposure Graph to understand where the vulnerability originates and how it impacts Findings and Assets. Select More Info to view granular details about each of the impacted assets.

4. You can also select View Details from the Details view to be directed to the Finding or Asset in question.

View All Vulnerability Findings

A vulnerability finding is a specific instance of a vulnerability that was discovered in your environment. The All Vulnerability Findings page lists every instance of every vulnerability that was discovered in your environment.

Go to Posture Management → Vulnerability Management → Vulnerability Issues and click the All Vulnerability Findings button.

View vulnerable assets

The Vulnerable Assets page displays all assets with a vulnerability finding. This view enables you to prioritize vulnerabilities by asset and asset type and focus on assets most critical to fix. The Vulnerable Assets list provides links to the findings and issues for each asset. Click on an asset in the table to see the asset details.

Go to Posture Management → Vulnerability Management → Vulnerable Assets.