Search


Cloud customer?
Upgrade in MyJFrog >


Working with an older version?

JFrog Artifactory 6.x
JFrog Xray 2.x
JFrog Mission Control 3.x
JFrog Distribution 1.x
JFrog Enterprise+ (Pre-Platform Release)




Overview

Xray scanning requires Artifactory Pro X, Enterprise with Xray, or an Enterprise+ license.

You can review and manage all the violations generated by a Watch under a central location within the Violations tab on an ongoing basis. In addition to the Xray Data that is displayed on each of the resource levels.

You can perform the following:

Page Contents


Viewing Violations

The Violations tab in a Watch is the central location for viewing the detected violations based on the policies and rules you have predefined  on the Watch. You can view the list of the violations, search for violations according to filters, set ignore rules and edit the Watch in the Settings tab.

  1. In the Application module, under Security & Compliance, click Watches.
  2. Select the required Watch and click the Violations tab to view the violations.


Viewing Violation Details

Click on a specific watch from the main Watch module page to examine all of its defined violations. You can filter the watch violations using the search mechanism, according to text, created date, type, severity and CVE ID.

To examine the details of a violation, click the violation from the list to display the Violation Details popup. 



Searching for Violations

You can search for specific violations according the text, minimum severity level, CVE number and Policy Type - Security or License, or both.


Ignoring Violations on a Watch

Users can choose to ignore violations detected on a watch in cases whereby a violation is low priority, or needs to be whitelisted or dealt with in future versions.

The following procedures are supported when Ignoring violations:

Ignore a Violation

  1. Select the required Watch and click the Violations tab.
  2. From the Violations list on the Watch, hover over the required violation in the list and click Ignore Violation located on the rightmost side of the line.
    The Ignore Violation dialog opens. 
  3. Choose one of the following methods to ignore the violation:
    • Once: The violation will be tagged as an 'Ignored Violation', however it will reappear in the list the next time the violating artifact is scanned.
    • Permanently: The violation will be tagged as an "Ignored Violation' and an Ignore Rule will be created and will apply to future scans. 

      Ignore Rules from Component Details

      You can also specify violations to ignore in the Violations tab of the Component Details page.

      Under the Watch, you can view ignored rules in the Ignore Rules tab.
       


      To view security or licence details of an ignored rule, select the Ignore rule in the Summary column.

Search for Ignored Violations

To view a list of ignored violations, from the Violations tab on the Watch select the Ignored Violations status from the Status filter and click Search.

Restore an Ignored Violation

  1. In the Violations page, select the violation and click Restore Ignored Violation.
  2. Click Restore Ignored Violation.

  3. Click Restore. The violation will be added to the Active Violations list.

Delete an Ignore Rule

You can delete an Ignore rule and select the Restore previous violations checkbox to restore previous violations tagged with this Ignore Rule.

  1. From the Ignore Rules tab, select the Ignore Rule and select the Delete icon.
  2. Click Delete.

REST API

To retrieve a list of ignored violations on a watch, run the following Get Ignored Violations command.

  • No labels
Copyright © 2020 JFrog Ltd.