This is the multi-page printable view of this section. Click here to print.

Return to the regular view of this page.

Working with Subscriptions

Introduction

Anchore Enterprise supports 7 types of subscriptions:

  • Tag Update
  • Policy Update
  • Vulnerability Update
  • Analysis Update
  • Alerts
  • Repository Update
  • Runtime Inventory

Enabling some of these will generate a notification when the event is triggered while others may have a more significant impact on the system.

Tag Update

GranularityPer Image Tag
Notification GeneratedYes
Background ProcessYes
Default Timer Frequencyevery 60 min
Default StateDisabled (Unless the Tag is added by AnchoreCTL)
Other ConsiderationsAdds new tag/digest pairs to the system

When the tag_update subscription is enabled, a background process, called a “watcher”, will periodically query the repository for any new image digests with the same tag. For each new image digest found:

  • it will be pulled into the catalog and analyzed
  • a Tag Update Notification will be triggered.

Policy Updates

GranularityPer Image Tag
Notification GeneratedYes
Background ProcessYes
Default Timer Frequencyevery 60 min
Default StateDisabled
Other ConsiderationsNone

This class of notification is triggered if a Tag to which a user has subscribed has a change in its policy evaluation status. The policy evaluation status of an image can be one of two states: Pass or Fail. If an image that was previously marked as Pass changes status to Fail or vice-versa then the policy update notification will be triggered.

The policy status of a Tag may be changed by a number of methods.

  • Change to policy
    • If an policy was changed, for example adding, editing or removing a policy check, then the policy status of an image may be effected. For example adding policy rule that denylists a specific package that is present in a given Tag may cause the Tag’s policy status to move to Fail.
  • Changes to Allowlist
    • If a allowlist is changed to add or remove a CVE then this may cause a policy status change. For example if an image contains a package that is vulnerable to Crticial Severity CVE-2017-9999 then this image may fail in it’s policy evaluation. If CVE-2017-9999 is added to a CVE Allowlist that is mapped to the subscribed Tag then the policy status may change from Fail to Pass.
  • Change in Policy / Allowlist Mapping
    • If the policy mapping is changed then a new policy or allowlist may be applied to an image which may change the status of the image. For example changing the mapping to add a more restrictive policy may change an Tag’s status from Pass to Fail.
  • Change in Package or Vulnerability Data
    • Some policy checks make use of data from external feeds. For example vulnerability checks use CVE data feeds. Changes in data within these feed may change the policy status, such as adding a new CVE vulnerability.

Vulnerability / CVE Update

GranularityPer Image Tag
Notification GeneratedYes
Background ProcessYes
Default Timer Frequencyevery 4 hours
Default StateDisabled
Other ConsiderationsNone

This class of notification is triggered if the list of CVEs or other security vulnerabilities in the image changes.

For example, a user was subscribed to the library/nginx:latest tag. On the 12th of September 2017 a new vulnerability was added to the Debian 9 vulnerability feed which matched a package in the library/nginx:latest image, triggering a notification.

Based on the changes made by the upstream providers of CVE data (operating system vendors and NIST) CVEs may be added, removed or modified – for example a CVE initially marked as severity level Unknown may be upgraded to a higher severity level.

Note: A change to the CVE list in a Tag may not trigger a policy status change based on the policy rules configured for an image. In the example above the CVE had an unknown severity level which may not be tested by the policy mapped to this image.

Analysis Update

GranularityPer Image Tag
Notification GeneratedYes
Background ProcessNo
Default Timer Frequencyn/a
Default StateEnabled
Other ConsiderationsNone

This class of notification is triggered when an image has been analyzed. Typically, this is triggered when a new Tag has been added to the catalog. A common use case for this trigger is to alert an external system that a new Tag was added and has been successfully analyzed. Forcing a re-analysis on an existing image will also cause this notification to be generated.

Alerts

GranularityPer Image Tag
Notification GeneratedNo
Background ProcessYes
Default Timer Frequency10 minutes
Default StateDisabled
Other ConsiderationsEnabling this Subscription may be resource intensive as frequent policy evaluations will occur

The UI and API use stateful alerts that will be raised for policy violations on tags to which you are subscribed for alerts. This raises a clear notification in the UI to help initiate the remediation workflow and address the violations via the remediation feature. Once all findings are addressed the alert is closed, allowing an efficient workflow for users to bring their image’s into compliance with their policy.

Repository Update

GranularityPer Repository
Notification GeneratedNo
Background ProcessYes
Default Timer Frequency60 seconds
Default StateDisabled
Other ConsiderationsAdds all the tags found in a repository to the system

This subscription, when enabled, will query the provided repository for any new tags. Any tag not already managed with in Anchore, will be added. This subscription also provides the ability to determine if the tag_update subscription should be enabled for any new tag added to Anchore.

Please Note: Enabling this subscription may add a large number of tags to the system.

Runtime Inventory

GranularityPer Runtime Inventory Context (Cluster/Namespace)
Notification GeneratedNo
Background ProcessYes
Default Timer Frequency2.5 minutes
Default StateDisabled
Other ConsiderationsAdds all the images found in the Context to the system

This subscription, when enabled, will find any newly reported images from the runtime inventory and add them to Anchore to be analyzed.

Please Note: Enabling this subscription may add a large number of tags to the system.