Reporting

1 - Search

Search answers questions that span more than one asset in your catalog: “Which application versions are affected by a specific CVE?”, “Which images have a Critical finding with a known KEV?”, “Which images contain a vulnerable version of a specific package?”

Anchore Enterprise runs search at two scopes: applications and container images. Pick the one that matches how your team organizes software. Image search is available in the GUI and the API; application search runs in the GUI today, matched by CVE or GHSA identifier.

For producing formal documents such as VEX, VDR, SBOMs, and vulnerability data exports, see Evidence. Evidence exports are available at both image and app-version scopes today.

Search Applications

The application scope answers “is this vulnerability affecting any of my applications, and which versions?” Today this search runs in the GUI, matched by CVE or GHSA identifier. It draws on the same aggregated, deduplicated vulnerability data described in Scan an App Version, so a match points you straight at the affected app version.

Search Applications in the Anchore Enterprise GUI

Open the search box in the top navigation bar and choose the Vulnerability filter, then enter a CVE or GHSA identifier. A vulnerability identifier is the only supported query for application search today.

Anchore Enterprise returns the application versions in your account whose aggregated findings include that vulnerability. Open a result to jump to the affected version’s Vulnerabilities tab, triage by Anchore Score, and pivot to the impacted assets.

Check a Known App Version with AnchoreCTL

AnchoreCTL does not search across applications. To check whether a CVE affects a version you already know, list its vulnerabilities and filter for the identifier:

anchorectl app version vuln list 1.4.0 --app my-service

Add -o json for the full per-finding record, including CVSS, EPSS, and CISA KEV flags; findings are aggregated and deduplicated across the version’s assets rather than attributed to individual ones. See Scan an App Version for the complete command reference.

Check a Known App Version with the API

The stable API returns the vulnerabilities for a version you already know, under /apps/{app_id}/versions/{version_id}/vulnerabilities, with a packages-by-vulnerability pivot for a specific finding:

curl -X GET \
  'https://my-anchore.example.com/apps/{app_id}/versions/{version_id}/vulnerabilities' \
  -H 'accept: application/json'

The full schemas are in the API browser under the App Version Vulnerabilities tag; see Scan an App Version for details.

Search Container Images

The image scope searches across the analyzed image catalog. Both surfaces below draw from the same underlying vulnerability and package data, so the choice is about who is running the query and what they want back.

Search Container Images in the Anchore Enterprise GUI

The Reports tab in the Anchore Enterprise GUI is the interactive search surface for images. Reports are built from templates that define which filters appear on the report form and which columns appear in the result, and from executions that capture the result of running a configured report at a point in time.

New Report

The New Report tab is where reports are composed and executed. Pick a template, set the filter values, and run the report once for an immediate result, or save it for re-use.

Saved Reports

Saved reports retain their template, filter selections, and execution history. From the Saved Reports tab you can:

• Generate Now — run a saved report on demand.
• Schedule — run the report on a recurring cadence and notify subscribers when results are ready.
• Execution history — browse past runs, download their CSVs, or drill into the on-screen results.

Templates

Templates define the shape of a report: which filters are presented to the user, with what defaults, and which columns appear in the result.

Anchore Enterprise ships a set of system templates as starting points, for example “Images Affected by Vulnerability”, “Images Failing Policy Evaluation”, and “Tags by Vulnerability”. System templates cannot be modified, but you can copy any of them into a user template and tailor the filter and column set to your team’s needs.

Templates and reports are both account-scoped. Templates created by other users in the same account are visible and can be used as a starting point for further customization.

Search Container Images with AnchoreCTL

AnchoreCTL returns the findings for a single analyzed image rather than searching across the catalog. To pull an image’s vulnerabilities and filter for a CVE:

anchorectl image vulnerabilities docker.io/my-org/api:1.4.0

See Scan a Container Image for the output formats and filter flags. For questions that span the whole image catalog, use the Reports view above or the Query API below.

Search Container Images with the API

The Query API is the programmatic surface for zero-day investigation and tooling integrations. Two endpoints cover the common patterns: look up a vulnerability by ID, or find images containing a specific package version.

Find Images by Package

When the vulnerability record is incomplete, common in the first hours after disclosure, search by the affected package version directly. The classic example: locate every image with a vulnerable version of k8s.io/ingress-nginx.

curl -X GET \
  'https://my-anchore.example.com/v2/query/images/by-package?name=k8s.io%2Fingress-nginx&package_type=go&version=v1.11.0' \
  -H 'accept: application/json'

The response is a paginated PaginatedImageList, where each entry names the image digest, the tag history that points at it, and the package records that match the filter:

{
  "images": [
    {
      "image": {
        "image_digest": "sha256:4db2297322e827ae13892be1480800471ec83726edea921bd45af0f8ed35e094",
        "tag_history": [
          {
            "full_tag": "registry.k8s.io/ingress-nginx/controller:v1.11.0"
          }
        ]
      },
      "packages": [
        { "name": "k8s.io/ingress-nginx", "version": "v1.11.0", "type": "go" }
      ]
    }
  ],
  "total_count": 1
}

For the full zero-day investigation pattern, including how to escalate from a package match to remediation, see the Find Zero-day Vulnerabilities quickstart.

Look Up a Vulnerability by ID

When the vulnerability ID is known, GET /v2/query/vulnerabilities returns the underlying record and the packages it affects:

curl -X GET \
  'https://my-anchore.example.com/v2/query/vulnerabilities?id=CVE-2024-3094' \
  -H 'accept: application/json'

Useful as a quick “does Anchore Enterprise know about this yet?” check before kicking off a broader hunt.

The full request and response schemas for both endpoints are in the API browser under the Query tag.

Where to Go Next

• Evidence — produce formal documents from search results: VEX, VDR, vulnerability data exports.
• Annotations — record VEX dispositions on findings; annotations feed the VEX evidence exports and will be filterable through the future app-version search surface.
• Reporting Service configuration — tune the data-refresh cadence that drives the Reports view.

2 - Evidence

Evidence is what you hand to a customer, an auditor, a regulator, or a downstream consumer. Anchore Enterprise turns the vulnerability and annotation data it already holds into three kinds of formal, standards-aligned documents:

Evidence is available at both app-version and image scope.

For SBOM evidence — CycloneDX and SPDX SBOM exports of an app version’s contents — see Export an SBOM.

Evidence from an App Version

App-version evidence runs as an asynchronous job — submit the job, wait for completion, and the result is written to a file or stdout.

Via the Anchore Enterprise GUI

Open the app version detail page, click on the Download button, and choose the document type from the menu along with the desired format (where supported), and click Download. The My Recent Activity panel on the App Version Summary tab shows the job’s progress and, once complete, the link to download the generated document.

Via AnchoreCTL

Each evidence type has a dedicated subcommand under anchorectl app version export:

anchorectl app version export vex 1.4.0 \
  --app my-service \
  --format cyclonedx-json \
  --file my-service-1.4.0-vex.json

anchorectl app version export vdr 1.4.0 \
  --app my-service \
  --file my-service-1.4.0-vdr.json

anchorectl app version export vulnerabilities 1.4.0 \
  --app my-service \
  --file my-service-1.4.0-vulns.csv

Each command submits a job, waits for completion, and writes the resulting document to the path supplied with --file (or to stdout if --file is omitted).

Today the app-version VEX and VDR exports both produce CycloneDX JSON. The vulnerability data export — the raw finding rows surfaced by anchorectl app version export vulnerabilities — is CSV-only at app-version scope; VEX and VDR carry the same findings wrapped in their respective document forms.

Via the API

App-version exports live under the App Jobs tag of the API:

The job lifecycle is: POST to submit, poll GET .../{job_id} until status is completed, then fetch download_id from the job’s response and GET /apps/{app_id}/downloads/{download_id}. The full request and response schemas are in the API browser; search for the App Jobs tag.

Evidence from an Image

Image-scoped evidence is synchronous — the document is generated on the fly when you request it. No job to track, no separate download step.

Via the Anchore Enterprise GUI

Open the image detail page, switch to the Vulnerabilities tab, and use the Download menu to pick a format. The document streams back to your browser when the request completes.

Via AnchoreCTL

anchorectl image vulnerabilities doubles as the image evidence command — the -o flag selects the output format:

anchorectl image vulnerabilities sha256:<digest> -o csv             > image-vulns.csv
anchorectl image vulnerabilities sha256:<digest> -o cyclonedx-json  > image-vulns.cdx.json
anchorectl image vulnerabilities sha256:<digest> -o html -d ~/reports/  # -d takes a directory; the HTML file is written into ~/reports/

Supported formats are text, json, json-raw, csv, cyclonedx-json, cyclonedx-xml, and html. The CycloneDX outputs embed VEX annotations recorded on the image’s findings; HTML produces a human-readable summary document suitable as a build artifact.

Via the API

Image VEX exports support OpenVEX in addition to CycloneDX — useful for downstream consumers that have standardized on the OpenVEX format.

Where to Go Next

• Search — investigate vulnerabilities before producing the formal documents.
• Annotations — record the VEX dispositions that drive every VEX and VDR document.
• Export an SBOM — produce Syft-native, CycloneDX, or SPDX SBOMs for the components that the vulnerability evidence above sits alongside.