Policy management
Vulnerability policy
Vulnerability policies enable you to set the acceptable severity threshold for vulnerabilities within your workspace. When a package is scanned and a vulnerability meets or exceeds the configured threshold, the policy triggers, and based on the policy configuration, the package may be quarantined.
Vulnerability policies are evaluated using vulnerability scanning, which uses the Trivy scanner as its data source.
Important
The Cloudsmith web app displays vulnerability data from OSV.dev as part of the move to continuous risk detection. During this transition, vulnerability data shown in the web app may not match the results used to evaluate vulnerability policies. Cloudsmith plans to transition vulnerability policies to use OSV.dev as their data source in a future update.
You can view Trivy vulnerability scan results in the Security scan results section of the legacy web app (cloudsmith.io).
Supported package formats
Vulnerability scanning and vulnerability policies are supported for the following package formats:
Manage vulnerability policies
To manage vulnerability policies in your workspace, go to the Policies tab of the overview page in the Cloudsmith web app and select Vulnerability.
Warning
Disabling a policy is not supported, so any policy created will remain active until deleted.
Create a vulnerability policy
To create a new vulnerability policy, click +Create vulnerability policy.
You are then presented with the Create vulnerability policy form:
Here you can define the following:
| Field | Description |
|---|---|
| Policy Name | A display name for the vulnerability policy. |
| Description | A description of the vulnerability policy. |
| Vulnerability threshold | The vulnerability threshold for the policy. Following a package vulnerability scan, if a vulnerability matching or exceeding this value is returned, the package will be in violation of the policy. Vulnerability thresholds are based on the following CVSS v3.1 severity ratings: - Critical (9.0 - 10.0) - High (7.0 - 8.9) - Medium (4.0 - 6.9) - Low (0.1 - 3.9) |
| Quarantine packages which violate policy | If set to Yes, any package that has a vulnerability equal to or higher than the threshold will be flagged and automatically quarantined. If set to No, packages that violate the policy will be flagged, but not automatically quarantined. |
| Allow unknown severity level | Vulnerabilities may have no CVSS score or severity rating, in which case the severity level is categorized as "Unknown". This setting determines whether or not the vulnerability policy should be applied to packages which have vulnerabilities in that category. If set to Yes, a package with vulnerabilities of an unknown severity level will not be considered to be in violation of the policy. If set to No, a package with vulnerabilities of an unknown severity level will be considered to be in violation of the policy, and the configured policy actions will be taken. |
Once saved, the policy is enabled across your workspace, and the vulnerability policy check is run on a package whenever it undergoes a vulnerability scan.
Note
Packages are automatically scanned for vulnerabilities on upload, and subsequent scans can be triggered manually via the Cloudsmith web app or API. For more details, see Vulnerability scanning.
Viewing policy violations
You can see vulnerability policy violations on the workspace Overview tab, and on the workspace and repository Compliance tabs. Click the Vulnerability policy violations card to display a list of all vulnerability policy violations across the workspace or repository.
Note
The Vulnerability policy violations card is only shown in workspaces with active vulnerability policies. Otherwise, the card is hidden.
You can also search for vulnerability policy violations on the workspace or repository packages list view by using the package search with the policy_violated:true filter for all policy violations, or vulnerability_policy_violated:true to only display vulnerability policy violations.
Logs
Logs of policy violations and quarantining actions are also displayed on the Logs > Package logs page:
Audit logs are generated whenever users create, update, or delete a vulnerability policy.
Restore a package that violates a policy
To remove a policy violation, you have three options:
- Upgrade the package to a version that has resolved the security vulnerability.
- Edit the vulnerability policy to lower the threshold below the violated level. A manual rescan of the package is required to remove the policy violation flag and the package must also be manually released from quarantine.
- Use the unquarantine functionality to remove the package from quarantine.
See Release from quarantine for instructions on restoring a package from quarantine.Note
Subsequent vulnerability scans may return the package to quarantine.
