Creating a Watch
Set up your your policies prior to creating the Watch. For more information, see Creating Xray Policies and Rules.
To create a Watch, you need to have the Manage Watches global permission configured on the user or group.
Step 1 Configure General Watch Settings
- In the Administration module, select Watches & Policies and from the Watches tab click New Watch.
In the Create New Watch page, set the general information on the watch and assign Watch recipients on the watch.
When selected, all the Watch recipients will receive email notifications if a policy set to notify recipient has detected a vulnerability.
Step 2 Assign Resources to the Watch
You can only see resources in a Watch if they are indexed for scanning by Xray and you have "View" permission on the resource.
You can only add resources to a Watch or remove them if they are indexed for scanning by Xray and you have "Manage" permission on the resource.
The next step is to assign resources to a Watch. The Resources are the set of repositories and builds in the connected Artifactory services that the Watch monitors.
Managing resources for a Watch involves two steps:
- Specifying the repositories, builds and Release Bundles to monitor.
- Applying filters to focus only on those artifacts within those repositories and builds that you are interested in.
To assign resources on a watch:
- In the Manage Resources section, access each resource type and select the resources to be monitored.
- Select the resources to be included within each resource type. You have a number of options to select the resources to be included:
- All resources within the resource type: Set the Any Repository, Any Build, or Any Bundle checkboxes to monitor all those resources that have been specified for indexing by Xray.
Note that this setting will also apply to new repositories and builds that are created after the Watch is defined.
- Packages: Set according to the Repo Path Include and Repo Path Exclude patterns.
- Builds and Release Bundles: Select By Name or By Pattern.
- Move the resources you are interested in from the list of Available Resources on the left to the list of Selected Resources on the right by dragging them, or by selecting them and using the arrow icons.
Scanning External Resources
From version 2.6, when scanning builds for supported package formats, external (transitive) dependencies that are not directly included in the build are also scanned and will trigger violations if the meet the criteria specified in a Watch. Currently, the supported package formats are: Maven, NuGet, npm and Gradle and scans external resources using SHA-256.
Step 3 Set Filters on Repositories
The filters you define for a watch determine which artifacts in the repositories specified will generate violations and under what conditions. You can define any number of filters on each of the repositories specified for the watch, and it will only trigger a violation if an artifact meets the conditions of all of the filters defined for that resource.
Pass through ALL filters
You can define any number of filters for a resource, and only artifacts that pass through all of them will trigger a violation.
- To specify filters on repositories, select the Filters tab.
- Select the repository. The repository will be displayed in the right column with a list of predefined filters.
- Select a filter from the Filter list to apply to the repository.
In the following example, you set a filter to trigger a violation for application/JSONs if their performance value is set to false in the docker-local repo.
The following content filters are available:
|A Name filter uses a regular expression to specify the name of an artifact. The watch will only trigger a violation if an artifact's name matches the expression.|
For example, the filter specifies that the watch should only trigger a violation for rpm files.
|A Path filter uses a regular expression to specify the path of an artifact in the repository. The watch will only trigger a violation if an artifact's name matches the expression. Note that the filter does not consider the repository name to be a part of the path.|
For example, the filter specifies that the watch should only trigger a violation for artifacts that have the expressions "jfrog" in their path
|A Package Type filter specifies an artifact's package type. The watch will only trigger a violation if an artifact has the specified package type.|
|A Mime Type filter specifies an artifact's mime type. The watch will only trigger a violation if an artifact has the specified mime type.|
For example, the filter specifies that the watch should trigger a violation for any artifact with an "application/json" mime type.
|A Property filter specifies a property annotating an artifact and its value. The watch will only trigger a violation if the property has the specified value.|
For example, the filter above specifies that the watch should trigger a violation if an artifact with a property named "performance" has the value "false".
Step 4 Assign Policies to a Watch
- To assign a policy to a watch, click Manage Policies in the Assigned Policies section.
- From the list of Available Policies on the left, select the policies you want to apply to the Watch and drag them, or use the arrows to move them to the list of Selected Policies on the right.
Click Save to assign the policies to the Watch.
Editing a Policy
Edits made to a policy will automatically be applied to all watches the policy is assigned to. This will take affect only for newly scanned artifacts. You can manually apply the watch on existing artifacts.
Editing a Watch
To edit a Watch select it from the list of Watches and go to the Settings tab.
Manually Activating a Watch
Once a Watch is created, it will scan artifacts in the specified resources when a scan-triggering event happens, and issue Violations accordingly. However, until a scan-triggering event happens, artifacts already existing in the system will not be scanned by the Watch. So, to make sure a Watch is immediately applied to the relevant artifacts, you can invoke it manually by hovering over it and selecting Apply on Existing Content.
Not available for All Repositories or All Builds
You can only manually invoke a Watch on existing content if the Watch is defined on specific resources and not on All Repositories or All Builds
Clicking the button pops up a dialog that lets you specify which of the resources assigned to the watch should be scanned, and a date range which defines the amount of time an artifacts needs to have resided in the target in order to be scanned.
For example, selecting "Last 7 days" will only scan artifacts that have resided in the target for the last 7 days.