What is the best approach to handle the output of the Falcon CWPP Image Scanning Script to ensure vulnerabilities are addressed effectively?

Question

Options

• AParse the output to filter critical vulnerabilities and send alerts to the security team.
• BDisable output logging for sensitive image scans to ensure security.
• CIgnore the script output in the pipeline and review results manually later.
• DAutomatically fail the pipeline if any vulnerabilities are found, regardless of severity.

• A
  78% (25)
• B
  13% (4)
• C
  3% (1)
• D
  6% (2)

Explanation

Option A: Filtering critical vulnerabilities ensures that the most significant issues are addressed promptly while allowing the pipeline to continue for lower-priority issues. This approach balances security and productivity effectively. Option B: Disabling logging hinders visibility into vulnerabilities. Security concerns about logs can be mitigated through secure storage and access control rather than disabling logging altogether. Option C: Ignoring the script output negates the value of integrating the Image Scanning Script into the pipeline. Automated handling ensures vulnerabilities are addressed consistently and Option D: Automatically failing the pipeline for all vulnerabilities, including low and informational ones, can disrupt development unnecessarily. The severity of vulnerabilities should be considered before deciding on pipeline actions.

No community discussion yet for this question.