Comparing the Runtime Overview and a Runtime Report

The Runtime overview and a Runtime report can show different totals for the same environment. Both totals can be correct. They answer different questions.

Use the overview when you want to decide what to fix first on images that are running now. Use a report when you want a scheduled list that you can email and keep.

• Use the Overview to Prioritize
• Use a Report to Share a Record
• Compare the Totals

Before You Begin

Before you compare the two views, confirm the following:

• At least one cluster is connected and reporting.
• Automatic Security Scanning is enabled, with Software Composition Analysis (SCA) and Contextual Analysis, so applicability data is present.
• You know which repositories and watches the report includes. Report Scope controls that list.

Use the Overview to Prioritize

The overview counts each CVE once, then narrows that list. Use it to decide what to fix first on images that are running now.

To review the overview:

• Open Runtime Security Prioritization on the JFrog Xray overview. The funnel is displayed.

The funnel counts each CVE once. The count includes CVEs on images that are running now, that JFrog Xray has scanned, and that come from a trusted registry on clusters that are reporting.

Each stage is a smaller slice of the stage before it.

The Applicable stage sits inside the Critical & High stage. A report of applicable CVEs at every severity is larger than the Applicable stage.

The overview is live. The number changes as containers start and stop.

For more information, see Prioritizing Runtime Vulnerabilities Using Xray Dashboard.

Use a Report to Share a Record

A report is a scheduled list you can email and keep. The saved report stays fixed after the hour you schedule.

To include running images in a report:

• Create a report and set Detected in Runtime to Running Now. The report lists findings for images that are running. You can also set the applicability filter when you want applicable findings.

Running Now and applicability are separate filters.

• The report is saved at the hour you schedule. It stays fixed after that.
• Report Scope decides the repositories and watches that are included.
• A Violations report counts a policy hit for each image, component, and policy. The same CVE can appear on many rows. The overview counts that CVE once.

Share the report when a team needs the same list every day, or when you need a snapshot for a review.

Compare the Totals

Line the two views up before you treat a difference as a problem.

To compare the totals:

1. A report filtered only to Running Now lines up with All Vulnerabilities. It lines up with Applicable after you also filter the report to applicable CVEs, and only for Critical and High.
2. Count unique CVEs in the report export when you want a number shaped like the overview. A Violations report total counts rows.
3. Read the overview from the time the report was generated. Containers that start or stop after that hour move the overview and leave the report where it was.
4. Use the same scope. The overview follows running images on clusters that are reporting. The report follows the repositories and watches in Report Scope.

Related Topics

• Prioritizing Runtime Vulnerabilities Using Xray Dashboard