Container images assets - The Container Images asset inventory provides a centralized view of all scanned container images and their details across your environments, enabling efficient tracking and management to ensure compliance with security and governance standards - Administrator Guide - Cortex XDR - Cortex

Container images assets - The Container Images asset inventory provides a centralized view of all scanned container images and their details across your environments, enabling efficient tracking and management to ensure compliance with security and governance standards - Administrator Guide - Cortex XDR - Cortex - Security Operations

Cortex XDR 5.x Documentation

Product

Cortex XDR

License

XDR + Cloud

Creation date

2025-07-13

Last date published

2026-06-04

Category

Administrator Guide

Abstract

The Container Images asset inventory provides a centralized view of all scanned container images and their details across your environments, enabling efficient tracking and management to ensure compliance with security and governance standards

Container Images are fundamental, immutable assets that package applications and their dependencies for consistent deployment across cloud environments. Each image is uniquely identified by a SHA256 digest, ensuring content verifiability throughout its lifecycle across build, deploy, and run stages. You can assign multiple names and tags to a single container image, allowing you to reference the same image in various contexts and versions within container registries.

Container images are represented as different asset types based on where they exist in the lifecycle. Understanding these types helps you investigate findings, track lineage, and apply policies effectively. You can also use this information to:

query assets by image Type using graph searches or XQL
group assets based on image classification
apply cloud workload policies to monitor and protect your environmentCloud Workload Policies

The container images asset inventory provides a centralized view of all scanned container images and their details across your environments. The platform enables efficient tracking and management of your container images, ensuring compliance with security and governance standards.

The following table summarizes each container image type, its purpose, and key characteristics to help you effectively manage container images.

Image Type	Description	Key Characteristics
Core Image	Represents the immutable content of the container image.	Purpose: Serves as the foundational definition for all other image types: Build, Registry, and Runtime Images. Properties: Identified by a unique SHA256 digest. Contains file-related findings such as vulnerabilities, secrets, and malware. Has no scope and cannot directly be part of an asset group or policy, as it purely represents the image's content. Does not include issues. Relationships with other image types: Can reference another Core Image as its base, establishing a hierarchical relationship between images. Can be the "base of" another Core Image. User Interaction: You can query Core Image assets through XQL. Find Core Images listed under Inventory → All Assets → Compute → Container Images
Build Image	Represents a container image created from a CI/CD pipeline or build processes.	Purpose: Exists when discovered through CLI scanning in the platform. Helps with build traceability and integrity verification. Properties: Includes build metadata such as build time, source code repository, and build environment. Contains findings and issues related to the build image. Relationships with other image types: A Build Image represents a Core Image, and a Core Image can be represented by a Build Image. User Interaction: You can query Build Image assets through XQL. Find Build Images listed under Inventory → All Assets → Compute → Container Images
Registry Image	Represents a container image stored within a container registry (for example, AWS ECR, Azure ACR, Google GAR, JFrog Artifactory, Docker).	Purpose: Exists only when discovered through cloud discovery or registry scanning for onboarded registries. Helps manage images within registries and ensures compliance with registry policies. Properties: Includes registry-specific findings (for example, retention policy, FQDN, repository name, image tags, manifest digests). Relationship with other image types: The container image registry contains an image repository, and a Registry Image resides within the image repository. A Registry Image represents a Core Image, and a Core Image can be represented by a Registry Image. A Registry Image can have a base image relationship to one or more other Registry Images, where those images act as its logical base images, as defined by a Base Images Rule.Base Images Rule User Interaction: You can query Registry Image assets through XQL. Find Registry Images listed under Inventory → All Assets → Compute → Container Images
Runtime Image	Represents container images stored, running, or defined in a workload asset (such as VMs, Kubernetes workloads).	Purpose: Exists when discovered through Agentless Disk scan, XDR agent scan, and Kubernetes Connector. Ensures that runtime images adhere to security policies and provides visibility into their deployment and operational state. Properties: Contains findings related to its deployment and operational state, such as configuration deviations and security policy violations. File-related findings are derived from the connected Core Image. Relationships with other images: A Runtime Image "represents" a Core Image, linking the runtime state to the immutable content of the image. A Core Image is "represented by" a Runtime Image, ensuring that any findings related to the image files are considered during runtime evaluations. A Runtime Image can have a base image relationship to one or more Registry Images, where those registry images act as the logical base images of the runtime image, as defined by a Base Images rule.Base Images Rule User Interactions: You can query Runtime Image assets through XQL. Find Runtime images listed under Inventory → All Assets → Compute → Container Images

Container images asset inventory

To access container images assets, go to Inventory, select All Assets → Compute → Container Images.

The container image assets inventory provides a centralized view of all scanned container images and their details across your environments. The platform enables efficient tracking and management of your container images, ensuring compliance with security and governance standards. The container images assets page includes a dashboard with OS Distro, OS Version, and Base Image widgets displayed by default, and an inventory table. Selecting a widget automatically filters the inventory table based on the widget's criteria.

The inventory table includes the following fields. You can filter results by any heading and value:

Fields	Description
Asset ID	A unique identifier assigned to the image.
Provider	The provider that hosts cloud assets, such as AWS, Azure, Docker, GCP, JFrog Artifactory, OCI, and Not Applicable (for core images).
Asset Type	Types of container images: Core Image: Represents the immutable content of the container image itself. It is identified by a unique SHA256 digest, ensuring that any alteration to its content results in the creation of a new Core Image. Build Image: Represents the image created from a pipeline or build process, capturing the context of the build environment and time. Registry Image: Represents the container image stored in an artifact repository within a container registry. It exists only when discovered as part of cloud discovery or registry scan for onboarded registries. Runtime Image: Represents container images stored, running, or defined in a workload asset (VMs, Kubernetes workloads), identified by its name and digest in the runtime environment.
Name	The container image name.
Image Type	Image file format. For example, Docker and OCI formats.
Image Identifier	A unique identifier assigned to a specific version of a container image, used to distinguish it from other images and ensure consistency across deployments.
Names	Aggregation of all the observed image names over time.
Realms	Indicates which connector the registry belongs to. For managed registries (such as ECR, GAR, and ACR), this field shows the CSP account.
SDLC Stages	Shows the SDLC stage when the image was created. For example, Runtime.
Base Image	Displays the number of images derived from the base image. For example, Base image \|2 indicates there are two images derived from it.
Tags	Labels assigned to container images to identify and reference specific versions or variants.
Digest	A unique, content-based SHA256 hash that immutably identifies a specific container image version.
Architecture	The CPU architecture for which the container image is built. For example, amd64, arm64, x86
Image OS	The base operating system environment version the container image uses. For example, 12.10
OS Distribution	The operating system (OS) distribution name. For example, Debian.
Operating System	Operating system details of the image. For example, Linux.
OS Version	The version or release number of that OS distribution. For example, 20.04 for Ubuntu)
OS Concat	Shows combined values of OS distribution and OS version. For example, Debian 11 or Debian bookworm.
Size	Size of the container image in bytes.
First Observed	Timestamp of when the image was first observed by the source that reported it.
Last Observed	Timestamp of when the image was last observed by the source that reported it.
Scanners	List of scanners that have scanned the container image. As the container image can be scanned by multiple scanners, the values are stored as a concatenated string of all scanner types. If no scanner data exists for an asset in the database, the default value is an empty array. This column is hidden from the default view.
Last Scan	Timestamp of the most recent scan time for the container image, considering all scanners that have scanned it. If no scan data exists in the database for the container image, the default value is 0. This column is hidden from the default view.

On the Container Image page, select an asset in the inventory table to open a detailed Asset card, which provides additional, in-depth information about the asset. The information is organized into tabs, including an Overview tab (displayed by default) that provides highlights and a general summary, while contextual tabs focus on particular properties of the asset. The card also includes details about detected risks, allowing you to explore them directly from the asset inventory. You can also perform actions on the asset using the Actions menu.

The Overview tab summarizes container image Highlights, Properties, Scan information details, and Relationships between the current image and its Core Image.

Highlights include:

Critical/High issues: An aggregation of critical and high issues associated with the container image. Clicking on this property redirects you to the Issues page, filtered by specific asset and severity level.
Visibility timeline: When the container image was first and last detected.

Properties include:

Includes identifying information and cloud location of the container image: Name, ID (such as ARN in AWS), cloud Provider, cloud Region, and Account ID.
Additional details: Includes Asset category, Asset Groups, Image Digest, Base image name along with its URL (if present), and Image name.

OS/ARCH includes:

OS information: Includes OS related information for that container image, such as OS distro, OS release, size in bytes, operating system, Docker Labels, and the type of architecture the image is compatible with.

Scan information includes:

Information about the last scan, including scanner name, version, and scan status for vulnerabilities, compliance, secrets, and malware.

Relationships include:

Information about how each logical image (Build, Registry, Runtime) is linked to the Core Image it represents, ensuring that any findings related to the Core Image are contextualized within the scope of the logical images.

This feature enables you to precisely identify the registry and repository source of any running image, directly linking runtime security findings to their origin. As a result, you can rapidly answer complex audit and security questions, such as determining which registry images are currently deployed in runtime. You can also associate images with specific base images used within your organization by defining Base Images rules. This provides clearer visibility into image lineage and simplifies investigation workflows.Base Images Rule

The SBOM tab displays details about the Software Bill of Materials (SBOM) generated by the scanning process. Exposed properties include Type, Name, Binary Packages, Version, Path, and License.

Export SBOM: You can export the entire SBOM, or selected attributes from any of the tabs in the expanded card:

Select menu → file format. Supported formats: XML, json

The Vulnerabilities tab provides inventories for Findings, Packages, and Layers, enabling you to assess potential risks and prioritize remediation efforts.

Findings: Displays a list of findings, along with their associated CVE ID and description, EPSS score, CVSS score and severity, CVE risk factors, affected software, and fix versions, when available.

Packages: Displays a list of packages, their name and version, the total number of vulnerabilities found within each package, a breakdown of vulnerabilities by severity level and count, their EPSS (Exploit Prediction Scoring System), which estimates the likelihood of exploitation; CVSS (Common Vulnerability Scoring System), which rates the technical severity of the vulnerability; location; base image vulnerability; and whether a fix is available.

Layers: Displays the various layers and their contents within a container image.

The Compliance tab provides visibility into how an asset aligns with assigned security standards and individual controls. Use this tab to evaluate compliance posture and investigate specific control results.

Overall Compliance Score: Displays the asset’s compliance score, along with the number of standards and controls used in the assessment. Use this metric for a high-level view of how the asset aligns with evaluated standards.

Controls by Status: Shows the distribution of controls across Passed, Failed, and Not Assessed. Click a specific status to filter the Standards and Controls data.

Standards, Score, Controls Passed: Lists the standards by which the asset is assessed, including the score and passed control count for each.Controls Table: An exhaustive list of controls for which an asset may be assessed including columns for Standard, Category, Control, Severity, and Status.