Other Integrations & Connections

Setting up Vulnerability Scanning

Katie D.
Katie D.
  • Updated

Vanta can fetch container vulnerabilities from supported container scanning tools. For supported tools, Vanta will:

  • Display container vulnerabilities on Vanta's Vulnerabilities page
  • Track SLA deadlines on vulnerabilities and surface remediation status for use in audits
  • Alert customers when new vulnerabilities are found or vulnerabilities are close to SLA

The currently supported container scanning registries + scanners are:

General Vulnerability Scanners:

AWS Inspector (for EC2 & ECR) and ECR Scanning

  • The permissions used for Vanta to obtain the scan details already exists inside the AWS managed SecurityAudit policy that is attached to the role that is used for the integration.
  • If Inspector EC2 scans are not showing in Vanta, please see the following article - Troubleshooting Missing EC2 Instance Inspector Scans
  • Vanta will pull in ECR scans that are available in Inspector or on the container itself directly. If you see these scans in AWS but they aren't showing in Vanta, please reach out to support@vanta.com!
GCP GCR (Google Cloud Provider, Google Container Registry)

To enable Vanta to fetch vulnerabilities surfaced by GCP Container Registry, enable both the Container Analysis API and Container Scanning API in GCP.
  • The Container Analysis API lets Vanta fetch container metadata. This API is free.
  • The Container Scanning API enables vulnerability scanning on each container. This may incur additional charges from GCP.
 
If you're already doing container vulnerability scanning in GCP, both should be enabled already. If not, Vanta recommends you start container scanning, but do decide whether you want to do so yourself. You can learn more about container scanning here. When you're ready, follow the instructions below to enable for each GCP project.
 
Setup Instructions:
 
  • You can enable these APIs via either the online console or the gcloud terminal command.
  • If you've set up GCP such that the Vanta scanner service account is in a separate project from your container repositories, make sure to enable these APIs in both the project containing your container repositories and the project containing the Vanta service account. 
 
Via the online console: Go to the following links and follow the instructions:
  1. Container analysis: https://console.cloud.google.com/flows/enableapi?apiid=containeranalysis.googleapis.com
  2. Container scanning: https://console.cloud.google.com/flows/enableapi?apiid=containerscanning.googleapis.com
Via Gcloud: Enter the following commands in your terminal:
gcloud services enable containerscanning.googleapis.com
gcloud services enable containeranalysis.googleapis.com

Please note that enabling
Container Scanning API will incur additional charges from GCP.
 
For additional information on GCP container analysis, please refer to: https://cloud.google.com/container-analysis/docs/container-analysis
 
 

Microsoft Defender for Containers

  • Vanta's Microsoft Defender for Cloud Scanning integration fetches data from Microsoft Defender Vulnerability Management. Microsoft Defender Vulnerability Management is a feature that automatically scans containers uploaded to Azure Container Registry for vulnerabilities.
If you already use Defender for Cloud, you don't need to take any action - you should already see vulnerabilities from ACR repositories reflected on Vanta's Vulnerabilities page.
 
However, if you'd like to start using container scanning, follow these instructions:
  1. From Defender for Cloud's menu, open the Settings page and select the relevant subscription.

  2. In the Defender plans page, select Defender for Containers and select Settings.

  3. Turn the relevant component on to enable it.

 
Within an hour of enabling, ACR repositories and vulnerabilities should start being displayed on Vanta's Vulnerabilities page.
 

GitHub Dependabot

  • Vanta requests permission to read Dependabot alerts when connecting the GitHub integration by default.
    To confirm Dependabot is enabled for vulnerability scanning in your monitor repositories, see GitHub's Dependabot Quick Start Guide.
 

Snyk

 

Viewing vulnerabilities 

  • Vanta will fetch the vulnerabilities from the latest container image uploaded to each container repository. You may click on a repository from the Vulnerabilities page to view more details about the vulnerabilities and Vanta-assigned SLA deadlines.

 

Screenshot 2023-11-30 at 4.19.45 PM.png


 

Scope 

  • If a container repository is irrelevant, you may mark it out of scope using the scoping option from the Integrations page. This will also mark any vulnerabilities on that container repository as out of scope.

    configure_scope_connections_page.png

Alerts

  • You will receive an email notification regarding any new vulnerabilities or upcoming SLA deadlines.

Remediation tracking/audit evidence

  • Vulnerability remediation and SLA information are tracked in the history tab, including SLA misses, and on-time remediations 
 
 
Screenshot 2023-11-30 at 4.20.50 PM.png