Skip to main content

Container Image Triage

Use this playbook to prioritize container image fixes by risk and deployment footprint using Cloudaware.

Identify Impacted Images​

  1. Use vulnerability dashboards or list views scoped to:
    • Source: container scanners (registries, CNAPP tools).
    • Asset type: container images and Kubernetes workloads.
  2. Filter by:
    • Target CVE, advisory, or package.
    • Risk band (e.g., Critical/High).

Understand Deployment Footprint​

  1. For each affected image, identify:
    • Kubernetes clusters and namespaces where it is deployed.
    • Number of running pods and key services impacted.
  2. Use CMDB relationships to map workloads to:
    • Applications.
    • OUs or teams.
    • Environments (prod vs non‑prod).

Prioritize Fixes​

  1. Focus first on:
    • Production workloads, especially internet‑facing services.
    • Images with multiple Critical/High vulnerabilities.
  2. Consider:
    • Whether an updated base image or package is available.
    • Whether compensating controls (e.g., WAF rules) can temporarily reduce risk.

Plan Remediation​

  1. Create Remediation Tasks grouped by:
    • Application or team.
    • CVE or package family.
  2. For each task:
    • Describe required actions (e.g., “Upgrade base image to vX.Y”).
    • Link affected images, workloads, and vulnerabilities.
    • Set due dates based on risk (see Verification & SLAs).

Coordinate with CI/CD owners to:

  • Update Dockerfiles and dependency manifests.
  • Push new images and roll out updated deployments.

See also: Processes

Verify and Close​

  1. rigger or wait for scans on updated images and running workloads.
  2. Confirm that Vulnerability Scan records disappear or move to remediated state.
  3. Close related Remediation Tasks and [ITSM] tickets once verification is complete.

For data relationships and configuration, see: