View Security Information in Vendor Portal
The Security Center is Alpha. The features and functionality described on this page are subject to change.
In the Vendor Portal, the Security Center provides dashboards for monitoring vulnerabilities across your releases and assessing the impact of CVEs across your customer fleet. You can also view security information for a specific release or customer instance.
Security Center dashboard
The Security Center dashboard is available in the Vendor Portal at [App name] > Security.
The following shows an example of the Security Center dashboard:
View a larger version of this image
You can filter for the information on the Security Center dashboard by release type (Linux/Embedded Cluster or Helm) and release channel. The information displayed on the Security Center dashboard applies to the currently promoted release of the selected type on the selected channel.
The Security Center dashboard includes the following:
- The number of customers affected by Critical or High CVEs, with a link to view the impact by customer
- An overview of vulnerabilities present in the release, including a breakdown of CVE severity (Critical, High, Medium, Low) and a detailed list of the top security risks
- The software bill of materials (SBOM) for the release, with a Download SBOM option
- On the Container images tab, a complete list of scanned images with vulnerability counts per image
- On the CVE details tab, for each CVE identified:
- The CVE identifier and description
- The CVSS score and severity rating
- A list of images affected by the CVE
- Fixed versions (when available)
Software bill of materials (SBOM)
The Security Center dashboard displays the software bill of materials (SBOM) for the release in view. The SBOM includes the format, the number of components and dependencies, the generation date, and the tool used. Select Download SBOM to download the SBOM as a JSON file.
Filter container images by source
On the Container images tab, you can filter the list of scanned images by source:
- All Images: All scanned images in the release.
- Application Images: Images that belong to your application.
- Replicated Platform Images: Replicated-owned images, such as the Replicated SDK and Embedded Cluster or KOTS components.
You can also select Show only vulnerable images to limit the list to images that have known vulnerabilities.
Find other releases that use a vulnerable image
On the Container images tab, each image includes a Find in other releases option that shows every other release referencing the same image. This is useful for assessing the blast radius of a vulnerability. If an image has a CVE, the panel shows which other releases, channels, and customer instances the CVE might also affect.
Select Find in other releases on an image to expand a panel listing matching releases, grouped as follows:
- Active Releases: The latest promoted release on each channel that references the image.
- All Releases: Every release that references the image, whether active or previously promoted, along with the number of active instances running each release.
A release can span more than one channel, so it can appear multiple times in the results, one row per channel.
For each matching release, the panel shows:
- The release sequence and version, linked to that release's Security tab
- The channel the release ships to
- The number of active instances running that release
- The specific image tag or reference that matched. Releases can reference the same image differently — for example, with different registry prefixes or tags
The All Releases list also shows a Total exposure count of active instances across every matching release.
Filter CVEs by severity
On the CVE details tab, you can filter the list of CVEs by severity level. Select any combination of the following to narrow the list:
- All: All CVEs in the release. This is the default. Selecting one or more individual severity levels clears it.
- Critical, High, Medium, and Low: Show only CVEs with the selected severity levels. Each option displays the number of CVEs at that level in the release.
The Showing X of Y CVEs label reflects how many CVEs match the current filter.
Security Center groups each CVE by its highest severity level across all affected images. For example, a CVE with a Critical rating in one image and a Low rating in another appears in the Critical group. This ensures that each CVE reflects its most severe rating.
Customer Impact dashboard
The Customer Impact dashboard shows fleet-wide CVE exposure for Helm and Embedded Cluster instances that report data to the Vendor Portal.
To open the dashboard, go to [App name] > Security and select Customer Impact.
The following shows an example of the Customer Impact dashboard:
View a larger version of this image
Review the customer impact overview
The Overview tab includes:
- A security posture snapshot that compares the number of customers with Critical or High CVEs to the total number of customers.
- The number of actively promoted releases with Critical or High CVEs, compared to the number of promoted releases with security data.
- The Actively promoted releases table, which lists the current release on each active channel. For each release, the table shows the version, channel, CVE counts by severity, number of customers on the channel, number of active instances, and number of instances with Critical CVEs.
By default, the dashboard counts only CVEs that have a known fix. Turn on Show unfixable CVEs to include CVEs for which no fix is currently available.
View impact by customer
On the By Customer tab, you can:
- Search for a customer.
- Filter customers by one or more CVE severity levels.
- Sort the results by Critical CVEs, total CVEs, customer name, or number of instances.
- Turn on Show unfixable CVEs to include CVEs without a known fix.
Each customer row shows the number and status of its instances and the aggregate CVE counts across instances, where each severity count is the highest value reported by any single instance rather than a sum. Expand a row to view each instance's status, installation type, channel, application version, last check-in, and CVE counts reported by the Replicated SDK.
An air gap instance might not have SDK-reported CVE data. In this case, Security Center displays the CVE counts for the latest release on the instance's channel as a reference. These counts represent the release and not the instance's reported security posture.
Release-specific CVE information
CVE details are available for all current and previously promoted application release versions. To view CVE information for a specific release, go to Releases > [Release Version] > Security. This page shows the same container image list, source filter, and SBOM as the Security Center dashboard.
Customer-specific CVE information
You can view CVE details at the customer level for active instances running the Replicated SDK version 1.9.0 or later. This gives you visibility into all container images running alongside your application, helping you identify security risks and urgent upgrade needs across your customer base.
To view CVE information for a specific customer instance, go to Customers > [Customer] > [Instance] > Security.