Create a Contextual Analysis Policy

Contextual Analysis evaluates security vulnerabilities within the broader system, application, or environment. Instead of flagging issues in isolation, it assesses real-world exploitability based on system configurations, dependencies, and runtime conditions. It also considers the potential impact within the specific environment and examines vulnerabilities in the full artifact, including the build, Release Bundle, or deployment state.
For more information, see Contextual Analysis.

Create a CVE Policy Rule

To create a Contextual Analysis policy:

1. Navigate to Application > Xray > Watches & Policies.
2. In the Policies tab, click New Policy.
3. Enter a Policy Name.
4. (Optional) Add a Description explaining the policy's purpose.
5. Under Select Policy Type, select Security.
6. Click Next.
   The Create New Policy Rule window opens.
7. Enter a Rule Name.
8. Under Rule Type, select CVEs.
9. Define Rule category.
10. Add CVE IDs.
11. Select the Skip Not Applicable CVEs option.
    This ensures that the policy doesn't issue violations for CVEs found not applicable by the Contextual Analysis Scanners, and thus won't impact your environment.
12. Under Then, define the policy actions.
13. Click Save Rule.
14. Click Next.
15. Under Apply on Scope, select one or more Watches in JFrog Xray.
16. Click Save Policy.

Frequently Asked Questions

This section provides answers to frequently asked questions.

Related Topics

• Create Advanced Security Policies
• Exposures Policy
• ML Model Policy
• Policies in JFrog Xray