mirror of
https://github.com/Studio-Saelix/sencho.git
synced 2026-07-26 11:49:16 +00:00
Anso
b1630788ba
* feat(security): rework Overview charts around posture and exploit intel Replace the three severity-variation charts (severity donut, top exposed images, findings by type) with prioritization views, keeping the risk trend for context: - Action posture: bars of fixable / known-exploited / needs-review / accepted / not-affected with a known-exploited headline, derived from the existing overview facts (no new fetch). - Top exploit-risk findings: ranked actionable Critical/High by KEV, then EPSS, then CVSS, each row opening its scan. - Severity x exploitability: a CVSS-by-EPSS quadrant that separates scary-but-not-exploitable from act-first. The two intel panels are fed by a new bounded GET /security/overview/exploit-intel (latest-scan Critical/High, suppression-filtered, KEV/EPSS joined at read time) and degrade to clear empty states until exploit intel is fetched and images are rescanned. * fix(security): drop the redundant SECURITY kicker from the desktop masthead The desktop nav strip already names the page, so the masthead's "SECURITY" label above the posture word was redundant. Make PageMasthead's kicker optional (pages that pass one render unchanged) and omit it on the Security masthead. The mobile masthead keeps its kicker, since on the phone layout it is the page identity and there is no nav strip. * docs(security): describe the prioritization-led Overview charts Update the Security overview docs for the reworked chart set (risk trend, action posture, top exploit-risk, and the severity-by-exploitability quadrant) and note the exploit-risk charts populate once exploit intelligence is enabled. * fix(security): move the scanner-detections note into a masthead info icon Replace the standing "scanner detections show vulnerable components..." caption below the masthead (desktop and mobile) with an info affordance next to the scanned-images count in the masthead subtitle. Declutters the overview while keeping the disclaimer one hover away. * fix(security): apply "assume it's automatable" to exploit-risk ranking Absence of exploitability evidence must not be treated as low risk. Rank the top exploit-risk list by tier (known-exploited > known-high EPSS > unknown EPSS > known-low EPSS) so an unrated finding outranks one with evidence of low likelihood; label unrated findings "EPSS n/a"; and reword the quadrant footnote so excluded findings read as unrated rather than lower risk.
103 lines
5.8 KiB
Plaintext
103 lines
5.8 KiB
Plaintext
---
|
|
title: "Security"
|
|
description: "The command center for your fleet's security posture: an overview dashboard, image and Compose findings, secrets, scan history, suppressions, and scanner setup, all in one place."
|
|
---
|
|
|
|
Security is a primary surface in Sencho. The **Security** page in the top navigation brings the
|
|
capabilities that power [vulnerability scanning](/features/vulnerability-scanning) into one command
|
|
center, so you can answer "what should I look at first?" without hunting through other pages. It is
|
|
scoped to the active node: the findings and scanner status you see reflect whichever node is selected.
|
|
|
|
The page is organized into tabs.
|
|
|
|
## Overview
|
|
|
|
The overview opens with a status masthead that reads your **action posture** at a glance, the answer
|
|
to "what can and should I do right now?":
|
|
|
|
- **Action needed**: something concrete to act on, such as a fixable Critical or High finding, a
|
|
detected secret, a dangerous Compose setting, or a known-exploited (CISA KEV) CVE.
|
|
- **Monitoring**: Critical or High findings exist, but none are currently actionable (no fix
|
|
available, or already triaged).
|
|
- **Secure**: nothing actionable right now. This is never a claim that no vulnerabilities exist.
|
|
- **Unknown**: the scanner is not installed, or no scan has completed yet.
|
|
|
|
Raw Critical and High counts stay visible next to the posture as **scanner detections**, not as the
|
|
posture itself: a vulnerable component being present is not the same as a reachable, exploitable risk.
|
|
The masthead carries a standing note to that effect, and posture weighs fix availability, exploit
|
|
intelligence, and triage decisions rather than raw severity alone.
|
|
|
|
Below it, the charts lead with prioritization rather than raw severity: a **risk trend** for context,
|
|
an **action posture** breakdown (fixable, known-exploited, needs-review, accepted, not-affected), a
|
|
**top exploit-risk** list ranking actionable findings by known-exploited status then EPSS, and a
|
|
**severity-by-exploitability** quadrant that separates high-severity-but-unlikely findings from the
|
|
ones to act on first. The exploit-risk charts populate once exploit intelligence is enabled and images
|
|
are scanned. A signal rail summarizes the supporting numbers (scanned images, fixable findings,
|
|
secrets, Compose misconfigurations, stale scans, failed scans), and a status strip shows scanner health
|
|
and the active node's deploy enforcement posture.
|
|
|
|
If a node does not report an overview (for example an older remote node), the page falls back to a
|
|
clear "overview unavailable" state and the other tabs keep working.
|
|
|
|
## Images
|
|
|
|
Image findings list every scanned image on the active node with its highest severity. Selecting an
|
|
image opens the full scan report, where you can review vulnerabilities, triage a CVE, and export an
|
|
SBOM. Each finding carries evidence tags so you can tell scary from exploitable at a glance:
|
|
known-exploited (KEV), EPSS exploitation probability, the CVSS score, and vendor "will not fix"
|
|
status, alongside whether a fix is available.
|
|
|
|
## Compose risks
|
|
|
|
Compose risks surface the security misconfigurations Trivy finds in your stack definitions rather than
|
|
image CVEs: privileged containers, Docker socket mounts, host networking, broad host bind mounts, public
|
|
database ports, and containers running as root. Each entry opens its scan report with the specific
|
|
findings and how to fix them. This is a security audit of the Compose file; for deploy-readiness checks
|
|
(port conflicts, missing bind paths, unset variables, no healthcheck), use
|
|
[Compose Doctor](/features/compose-doctor) from the stack page instead.
|
|
|
|
## Secrets
|
|
|
|
The secrets tab lists images where Trivy detected exposed credentials or keys, and opens straight to
|
|
the secret findings for a scan.
|
|
|
|
## Policies
|
|
|
|
The Policies tab manages deploy-enforcement scan policies: severity thresholds that block or warn on a
|
|
deploy, scoped by stack pattern. Enforcement is an Admiral capability; see
|
|
[scan policies](/features/vulnerability-scanning#scan-policies) for the full configuration.
|
|
|
|
## Suppressions
|
|
|
|
CVE suppressions and misconfiguration acknowledgements are managed here, the same controls available
|
|
in Settings. These are governed by the local instance, so this tab is shown when you are on the local
|
|
node; switch to the local node to manage them.
|
|
|
|
Suppressing a CVE records a **triage decision**: accepted risk, not affected, false positive, fixed,
|
|
ignored, or needs review, with an optional OpenVEX justification. Decided findings stop driving the
|
|
action posture; a "needs review" decision stays counted but keeps the finding actionable. Admiral
|
|
instances can export the fleet's triage decisions as an OpenVEX document for use with other tooling.
|
|
|
|
## History
|
|
|
|
The History tab opens the scan history sheet, listing completed scans grouped by image with search and
|
|
two-scan comparison. Closing the sheet leaves the tab in place so you can reopen it. The **Scan
|
|
history** button in the [Resources Hub](/features/resources) is a shortcut to the same place.
|
|
|
|
## Scanner setup
|
|
|
|
Scanner setup manages the Trivy binary for the active node: install the managed binary, update it when
|
|
a new release is available, and toggle automatic updates. Trivy is installed independently on each
|
|
node. See [Installing Trivy](/operations/trivy-setup) for the full setup options.
|
|
|
|
It also toggles **exploit intelligence**: a daily background fetch of the CISA KEV catalog and FIRST
|
|
EPSS scores that powers the known-exploited and EPSS evidence tags. It degrades gracefully when
|
|
offline and can be turned off for air-gapped or firewalled hosts.
|
|
|
|
## What stays where
|
|
|
|
Resources keeps its per-image severity badges and scan actions, so you can still scan and inspect an
|
|
image from your inventory. Security is the place to review the whole picture; the deeper scanning
|
|
workflow (on-demand scans, scheduled fleet scans, scan policies, SBOM and SARIF export) is documented
|
|
under [Vulnerability scanning](/features/vulnerability-scanning).
|