Vulnerability Scan

The platform periodically runs vulnerability scans on imported SBOM for a version and supports disabling vulnerability scans if necessary.

With the SBOM in Interlynk, each vulnerability's exploitability status (e.g., Not Applicable or Fixed) can be recorded in place and exported as VEX.

However, in a build/release pipeline, the newer versions might have the same vulnerability and exploitability status.

Interlynk supports retaining exploitability status across newer SBOMs if the underlying data—the vulnerable component name and version—does not change.

See 'Disposing Vulnerabilities' for more details on vulnerabilities and their exploitability status.

Managing Vulnerability Scan

Disable Vulnerabilty Scan

1. Click on the 'Products' side-navigation button

2. Click on the Product Name (or specific Environment icon of the Product)

3. Click on the 'Settings' tab

4. Toggle the 'Vulnerability Scan' switch to disable running the scan

5. ℹ️ These settings are specific to the Environment, and to disable all Environments, you must switch to each one and disable Vulnerability Scan.

Retaining Vulnerability Status

1. Click on the 'Products' side-navigation button

2. Click on the Product Name (or specific Environment icon of the Product)

3. Click on the 'Settings' tab

4. Toggle the 'Retain Vulnerability Status' switch to retain vulnerability status

5. ℹ️ These settings are specific to the Environment, and to disable all Environments, you must switch to each one and toggle Retain Vulnerability Status.