Search

Search answers questions that span more than one asset in your catalog: “Which application versions are affected by a specific CVE?”, “Which images have a Critical finding with a known KEV?”, “Which images contain a vulnerable version of a specific package?”

Anchore Enterprise runs search at two scopes: applications and container images. Pick the one that matches how your team organizes software. Image search is available in the GUI and the API; application search runs in the GUI today, matched by CVE or GHSA identifier.

For producing formal documents such as VEX, VDR, SBOMs, and vulnerability data exports, see Evidence. Evidence exports are available at both image and app-version scopes today.

Search Applications

The application scope answers “is this vulnerability affecting any of my applications, and which versions?” Today this search runs in the GUI, matched by CVE or GHSA identifier. It draws on the same aggregated, deduplicated vulnerability data described in Scan an App Version, so a match points you straight at the affected app version.

Search Applications in the Anchore Enterprise GUI

Open the search box in the top navigation bar and choose the Vulnerability filter, then enter a CVE or GHSA identifier. A vulnerability identifier is the only supported query for application search today.

Anchore Enterprise returns the application versions in your account whose aggregated findings include that vulnerability. Open a result to jump to the affected version’s Vulnerabilities tab, triage by Anchore Score, and pivot to the impacted assets.

Check a Known App Version with AnchoreCTL

AnchoreCTL does not search across applications. To check whether a CVE affects a version you already know, list its vulnerabilities and filter for the identifier:

anchorectl app version vuln list 1.4.0 --app my-service

Add -o json for the full per-finding record, including CVSS, EPSS, and CISA KEV flags; findings are aggregated and deduplicated across the version’s assets rather than attributed to individual ones. See Scan an App Version for the complete command reference.

Check a Known App Version with the API

The stable API returns the vulnerabilities for a version you already know, under /apps/{app_id}/versions/{version_id}/vulnerabilities, with a packages-by-vulnerability pivot for a specific finding:

curl -X GET \
  'https://my-anchore.example.com/apps/{app_id}/versions/{version_id}/vulnerabilities' \
  -H 'accept: application/json'

The full schemas are in the API browser under the App Version Vulnerabilities tag; see Scan an App Version for details.

Search Container Images

The image scope searches across the analyzed image catalog. Both surfaces below draw from the same underlying vulnerability and package data, so the choice is about who is running the query and what they want back.

Search Container Images in the Anchore Enterprise GUI

The Reports tab in the Anchore Enterprise GUI is the interactive search surface for images. Reports are built from templates that define which filters appear on the report form and which columns appear in the result, and from executions that capture the result of running a configured report at a point in time.

New Report

The New Report tab is where reports are composed and executed. Pick a template, set the filter values, and run the report once for an immediate result, or save it for re-use.

Saved Reports

Saved reports retain their template, filter selections, and execution history. From the Saved Reports tab you can:

• Generate Now — run a saved report on demand.
• Schedule — run the report on a recurring cadence and notify subscribers when results are ready.
• Execution history — browse past runs, download their CSVs, or drill into the on-screen results.

Templates

Templates define the shape of a report: which filters are presented to the user, with what defaults, and which columns appear in the result.

Anchore Enterprise ships a set of system templates as starting points, for example “Images Affected by Vulnerability”, “Images Failing Policy Evaluation”, and “Tags by Vulnerability”. System templates cannot be modified, but you can copy any of them into a user template and tailor the filter and column set to your team’s needs.

Templates and reports are both account-scoped. Templates created by other users in the same account are visible and can be used as a starting point for further customization.

Search Container Images with AnchoreCTL

AnchoreCTL returns the findings for a single analyzed image rather than searching across the catalog. To pull an image’s vulnerabilities and filter for a CVE:

anchorectl image vulnerabilities docker.io/my-org/api:1.4.0

See Scan a Container Image for the output formats and filter flags. For questions that span the whole image catalog, use the Reports view above or the Query API below.

Search Container Images with the API

The Query API is the programmatic surface for zero-day investigation and tooling integrations. Two endpoints cover the common patterns: look up a vulnerability by ID, or find images containing a specific package version.

Find Images by Package

When the vulnerability record is incomplete, common in the first hours after disclosure, search by the affected package version directly. The classic example: locate every image with a vulnerable version of k8s.io/ingress-nginx.

curl -X GET \
  'https://my-anchore.example.com/v2/query/images/by-package?name=k8s.io%2Fingress-nginx&package_type=go&version=v1.11.0' \
  -H 'accept: application/json'

The response is a paginated PaginatedImageList, where each entry names the image digest, the tag history that points at it, and the package records that match the filter:

{
  "images": [
    {
      "image": {
        "image_digest": "sha256:4db2297322e827ae13892be1480800471ec83726edea921bd45af0f8ed35e094",
        "tag_history": [
          {
            "full_tag": "registry.k8s.io/ingress-nginx/controller:v1.11.0"
          }
        ]
      },
      "packages": [
        { "name": "k8s.io/ingress-nginx", "version": "v1.11.0", "type": "go" }
      ]
    }
  ],
  "total_count": 1
}

For the full zero-day investigation pattern, including how to escalate from a package match to remediation, see the Find Zero-day Vulnerabilities quickstart.

Look Up a Vulnerability by ID

When the vulnerability ID is known, GET /v2/query/vulnerabilities returns the underlying record and the packages it affects:

curl -X GET \
  'https://my-anchore.example.com/v2/query/vulnerabilities?id=CVE-2024-3094' \
  -H 'accept: application/json'

Useful as a quick “does Anchore Enterprise know about this yet?” check before kicking off a broader hunt.

The full request and response schemas for both endpoints are in the API browser under the Query tag.

Where to Go Next

• Evidence — produce formal documents from search results: VEX, VDR, vulnerability data exports.
• Annotations — record VEX dispositions on findings; annotations feed the VEX evidence exports and will be filterable through the future app-version search surface.
• Reporting Service configuration — tune the data-refresh cadence that drives the Reports view.