Impact Search

Impact Search is a capability in JFrog Xray that enables security and DevOps teams to quickly identify which artifacts in their organization are affected by specific vulnerabilities or contain particular software packages.

By allowing targeted searches across scanned artifacts, Impact Search helps teams understand the blast radius of vulnerabilities and risky dependencies across their software supply chain. This enables faster triage, accurate risk assessment, and more effective remediation prioritization.

Why Use Impact Search

In large-scale environments, artifacts are distributed across numerous repositories and ecosystems. When a new zero-day vulnerability or risky dependency is disclosed, manually locating every instance of that component is time-consuming.

Impact Search allows you to:

• Trace Vulnerabilities: Locate all artifacts affected by a specific Vulnerability ID (e.g., CVE).
• Inventory Packages: Find artifacts containing a specific package, ecosystem, or version.
• Audit Exposure: View exactly where components are stored and verify the last scan timestamp.
• Accelerate Response: Generate reliable, scan-based data for stakeholders and auditors.

Supported Search Criteria

Impact Search supports structured searches based on vulnerability, package, and JFrog Catalog metadata, including:

• Vulnerability ID (for example, CVE identifiers)
• Package Name, which you can search on its own without a package type
• Package Type, which you can use to narrow a package search to an ecosystem such as npm, Maven, or PyPI
• Package Version, as an exact version or a range using >=, >, <=, or <
• Label, to search by a Catalog public label

Multiple criteria can be combined to refine results and improve accuracy. A label search runs on its own and can't be combined with the other criteria.

Searching by Catalog Label

A single package campaign can affect hundreds of packages at once. Instead of searching for each package, you can search for a label that covers them all and get every affected artifact in one search. JFrog Security Research curates labels for known campaigns, and labels you define yourself work the same way.

If a label isn't recognized, the search returns no results. Very large labels are capped, so a search may not return every package version the label covers.

Search Results

Impact Search returns a list of affected resources, including:

• Resource name with a direct link to the scanned artifact
• Repository location
• Component and package details
• Artifact path
• Last Xray scan date

When you search by vulnerability, each result also shows how many policy violations are active and how many are already ignored, so you can see whether the issue is already breaching policy. You can create an ignore rule for a violation directly from the result row.

This information helps teams quickly determine exposure and remediation priorities.

Scope and Coverage

Impact Search is limited to artifacts that have been indexed and scanned by Xray.

This means:

• Only repositories with Xray indexing enabled are included
• Results reflect the most recent Xray scan
• Unscanned or unindexed artifacts do not appear in results

To ensure comprehensive coverage, verify that critical repositories are indexed and monitored by Xray.

Export and API Support

Export search results to CSV for offline analysis, reporting, or audits. For vulnerability searches, the exported file includes a Violation State column.

Impact Search is powered by the Search Resources by Vulnerability and Package REST API.