Artifact Analysis는 취약점 평가 메모를 CVE당 하나의 메모로 저장합니다. 메모는 지정된 이미지와 동일한 프로젝트 내의 Container Analysis API에 저장됩니다.
VEX 문을 업로드하면 Artifact Analysis는 VEX 상태 정보를 연결된 취약점 발생에도 전달하므로 VEX 상태별로 취약점을 필터링할 수 있습니다. VEX 문이 이미지에 적용되면 Artifact Analysis는 새로 푸시된 버전을 비롯한 해당 이미지의 모든 버전에 VEX 상태를 전달합니다.
단일 버전에 두 개의 VEX 문이 있는 경우(하나는 리소스 URL용으로 작성되고 다른 하나는 연결된 이미지 URL용으로 작성됨) 리소스 URL용으로 작성된 VEX 문이 우선하며 취약점 발생으로 전달됩니다.
다음 단계
VEX를 사용하여 취약점 문제의 우선순위를 지정합니다. VEX 문을 확인하고 VEX 상태별로 취약점을 필터링하는 방법을 알아보세요.
규정 준수 요구사항을 지원하기 위해 소프트웨어 재료명세서 (SBOM)를 생성하는 방법을 알아보세요.
Artifact Analysis를 사용하여 OS 패키지 및 언어 패키지의 취약점을 스캔합니다.
[[["이해하기 쉬움","easyToUnderstand","thumb-up"],["문제가 해결됨","solvedMyProblem","thumb-up"],["기타","otherUp","thumb-up"]],[["이해하기 어려움","hardToUnderstand","thumb-down"],["잘못된 정보 또는 샘플 코드","incorrectInformationOrSampleCode","thumb-down"],["필요한 정보/샘플이 없음","missingTheInformationSamplesINeed","thumb-down"],["번역 문제","translationIssue","thumb-down"],["기타","otherDown","thumb-down"]],["최종 업데이트: 2025-09-03(UTC)"],[[["\u003cp\u003eThis document details the process of uploading Vulnerability Exploitability eXchange (VEX) statements, which must adhere to the Common Security Advisory Format (CSAF) 2.0 standard in JSON, to Artifact Analysis.\u003c/p\u003e\n"],["\u003cp\u003eUploading VEX statements requires specific IAM roles, such as Container Analysis Notes Editor, to create and update notes within the project.\u003c/p\u003e\n"],["\u003cp\u003eThe \u003ccode\u003eartifacts vulnerabilities load-vex\u003c/code\u003e command is used to upload VEX data, where users specify the path to the CSAF-formatted JSON file and the URI of the resource or image.\u003c/p\u003e\n"],["\u003cp\u003eArtifact Analysis converts VEX statements into Grafeas \u003ccode\u003eVulnerabilityAssessment\u003c/code\u003e notes, storing them as one note per CVE within the Container Analysis API, and it carries VEX status information to associated vulnerability occurrences.\u003c/p\u003e\n"],["\u003cp\u003ePre-GA features are available "as is" and might have limited support, and using this feature is subject to the "Pre-GA Offerings Terms" found in the General Service Terms section of the service specific terms.\u003c/p\u003e\n"]]],[],null,["# Upload VEX statements\n\n| **Preview**\n|\n|\n| This feature is subject to the \"Pre-GA Offerings Terms\" in the General Service Terms section\n| of the [Service Specific Terms](/terms/service-terms#1).\n|\n| Pre-GA features are available \"as is\" and might have limited support.\n|\n| For more information, see the\n| [launch stage descriptions](/products#product-launch-stages).\n\nThis document describes how to upload existing\n[Vulnerability Exploitability eXchange (VEX)](https://www.cisa.gov/sites/default/files/2023-04/minimum-requirements-for-vex-508c.pdf)\nstatements to Artifact Analysis. You can also upload statements provided by other\npublishers.\n\nVEX statements must be formatted according to the\n[Common Security Advisory Format (CSAF)](https://oasis-open.github.io/csaf-documentation/) 2.0 standard in JSON.\n\nRequired roles\n--------------\n\n\nTo get the permissions that\nyou need to upload VEX assessments and check the VEX status of vulnerabilities,\n\nask your administrator to grant you the\nfollowing IAM roles on the project:\n\n- To create and update notes: [Container Analysis Notes Editor](/iam/docs/roles-permissions/containeranalysis#containeranalysis.notes.editor) (`roles/containeranalysis.notes.editor`)\n\n\nFor more information about granting roles, see [Manage access to projects, folders, and organizations](/iam/docs/granting-changing-revoking-access).\n\n\nYou might also be able to get\nthe required permissions through [custom\nroles](/iam/docs/creating-custom-roles) or other [predefined\nroles](/iam/docs/roles-overview#predefined).\n\nUpload VEX statements\n---------------------\n\nRun the\n[`artifacts vulnerabilities load-vex`](/sdk/gcloud/reference/artifacts/vulnerabilities/load-vex)\ncommand to upload VEX data and store it in Artifact Analysis: \n\n gcloud artifacts vulnerabilities load-vex /\n --source \u003cvar translate=\"no\"\u003eCSAF_SOURCE\u003c/var\u003e /\n --uri \u003cvar translate=\"no\"\u003eRESOURCE_URI\u003c/var\u003e /\n\nWhere\n\n- \u003cvar translate=\"no\"\u003eCSAF_SOURCE\u003c/var\u003e is the path to your VEX statement file stored locally. The file must be a JSON file following the [CSAF schema](https://github.com/oasis-tcs/csaf/blob/master/csaf_2.0/json_schema/csaf_json_schema.json).\n- \u003cvar translate=\"no\"\u003eRESOURCE_URI\u003c/var\u003e can be one of:\n - the complete URL of the image, similar to `https://LOCATION-docker.pkg.dev/PROJECT_ID/REPOSITORY/IMAGE_ID@sha256:HASH`.\n - the image URL, similar to `https://LOCATION-docker.pkg.dev/PROJECT_ID/REPOSITORY/IMAGE_ID`.\n\nArtifact Analysis converts your VEX statements to\n[Grafeas `VulnerabilityAssessment`](https://github.com/grafeas/grafeas/blob/master/proto/v1/vex.proto#L28) notes.\n\nArtifact Analysis stores vulnerability assessment notes as one note per\nCVE. Notes are stored in the Container Analysis API, within the same project as the\nspecified image.\n\nWhen you upload VEX statements, Artifact Analysis also carries VEX status\ninformation into associated [vulnerability occurrences](/artifact-analysis/docs/metadata-storage#occurrence) so that\nyou can filter vulnerabilities by VEX status. If a VEX statement is applied to\nan image, Artifact Analysis will carry over the VEX status to all versions\nof that image, including newly pushed versions.\n\nIf a single version has two VEX statements, one written for the resource URL\nand one written for the associated image URL, the VEX statement written for the\nresource URL will take precedence and will be carried over to the vulnerability\noccurrence.\n\nWhat's next\n-----------\n\n- Prioritize vulnerability issues using VEX. Learn how to [view VEX statements](/artifact-analysis/docs/view-vex) and filter vulnerabilities by their VEX status.\n- Learn how to [generate a software bill of materials](/artifact-analysis/docs/sbom-overview) (SBOM) to support compliance requirements.\n- [Scan for vulnerabilities](/artifact-analysis/docs/scanning-types) in OS packages and language packages with Artifact Analysis."]]
