Cortex Cloud: Stale assets removal

• SBOM has not been updated after image patching and re-scanning
• Vulnerability issues persist in Cortex even after patching
• Cortex displays multiple entries for the same application/image, only one of which is active
• Old runtime images are detected via agentless scanning in EKS cluster even if they are not present/deployed
• Old images retain relationships with EKS EC2 nodes and SHA values despite not being deployed
• Cortex retains old Images and Image related issues impacting all images
• Cortex data inaccuracy prevents measuring performance to resolution for vulnerability management.

Product_versions

• Cortex CLOUD V1.3
• UI Version: xsiam--master-platform-v4.3.0-5978322-g0eb8c482
• SERVER Version: master-platform-v4.3.0-7890-gd118b-db87
  Hardware Details
• EC2 nodes
  Network Config
• Kubernetes deployment
• EKS cluster
• container registry
• ECR registry

Cortex Cloud retains records of old, undeployed container images and their associated vulnerability data. This happens because images are treated as distinct assets based on immutable tags, and the platform does not automatically purge historical data for images that are no longer active but still exist in the registry or have not aged out based on retention policies. As a result, even if a new, patched image is deployed, the old, vulnerable image's data continues to be displayed in the inventory, leading to perceived inaccurate vulnerability reporting and asset counts. An underlying asset cleanup solution for VM instances and Kubernetes resources is under validation by the engineering team.

**REMEDIATION_PLAN**

1. Delete the old, vulnerable image tags/images from the container registry to remove them and their associated vulnerabilities from the Cortex inventory.
2. Restart the Kubernetes pod or deployment corresponding to the active application to force the Cortex agentless scanner to perform a new assessment and update the SBOM.
3. Engineering team is validating an asset cleanup solution for VM Instances and Kubernetes resources to address the issue of stale assets.

PREVENTIVE_MEASURES

1. Implement a process to delete old, unused image tags/images from the container registry to prevent their vulnerability data from persisting in Cortex.
2. Monitor for updates or fixes from the engineering team regarding the asset cleanup solution for VM Instances and Kubernetes resources.

To clear the vulnerability from the view, the old image tag/image (e.g., experian-service:0a3369fc) must be deleted from the container registry. Once the image is deleted, the agent/scanner detects the deletion event, and after processing, the asset and its associated vulnerabilities are removed from the inventory view.