Skip to content
AlertaVuln DocsAlertaVuln DocsAlertaVuln Docs

Continuous monitoring

Continuous monitoring re-checks a scanned image against fresh vulnerability data as new CVEs are announced - without re-pulling the image - by re-matching its stored inventory. It is an Enterprise feature, enabled per image.

How it works

Section titled “How it works”

When you scan an image with av image scan --project, AlertaVuln stores its CycloneDX inventory. With monitoring on, that inventory is re-matched against the latest vulnerability data on two triggers:

  • Nightly sweep - every monitored image is re-matched against a fresh vulnerability database.
  • Event-driven re-match - when a newly ingested CVE names a package that is present in a monitored image’s inventory, that image is re-matched right away.

A re-match works from the stored inventory alone, so it can only add or reopen findings. A finding disappears (flips to Fixed) only when you run a real new scan of the image itself with av image scan - an inventory re-match cannot observe a rebuilt image.

New or reopened RED / YELLOW findings raise alerts through the project’s configured notification channels, respecting the project’s minimum-severity threshold. GREEN findings are visible in the UI only.

Enabling it

Section titled “Enabling it”

Monitoring is set per image and requires an Enterprise entitlement:

  • Web app - open the project’s Containers page, select an image, and use the Monitor toggle. Without the entitlement the toggle shows an Enterprise upsell instead of switching on.
  • API - PUT /api/projects/{projectId}/container/images/{imageId}/monitor with { "enabled": true }. The endpoint returns 403 for organisations without the entitlement.

The entitlement is re-checked when a monitor job runs, so a lapsed subscription stops the sweep even for images that were already enabled.

See also

Section titled “See also”