Overview

Cloud Security Management Vulnerabilities (CSM Vulnerabilities) helps you proactively secure your cloud infrastructure by detecting, prioritizing, and managing vulnerabilities across your container images and hosts. It leverages deep observability context and industry insights to help you remediate vulnerabilities that are most important to you at a given point in time.

Note: If you’re looking for vulnerability management for your application libraries and custom application code, see Software Composition Analysis.

Explore vulnerabilities

The Vulnerabilities Explorer shows a complete list of vulnerabilities detected across your infrastructure, ordering them based on their severity, offering grouping, filtering, and triaging capabilities so you can investigate, assign, and remediate problems.

Select a specific vulnerability to see its details, including which containers and hosts are affected, severity breakdown score, and recommended remediation steps. The severity of a vulnerability is modified from the base score to take into account the following:

• Whether the underlying infrastructure is running and how wide-spread the impact is.
• The environment in which the underlying infrastructure is running. For example, if the environment is not production, the severity is downgraded.
• Whether there is an active exploit for a given vulnerability from sources such as CISA KEV catalog.

You can also view vulnerabilities in your container images on the container images page. Sort by source, image tag, repo digest, and more. View additional details about any vulnerability by clicking the container image and reviewing the Vulnerabilities tab.

On the details explorer, you can also view impacted resources in CSM to gain better insights to your overall risk.

All vulnerabilities include a collection of links and references to websites or information sources that help you understand the context behind each vulnerability.

Triage and remediate

The Vulnerabilities Explorer also offers triaging options for detected vulnerabilities that enable you to change the status of a vulnerability, and assign it to individual members for remediation and tracking.

Note: To help you focus on the vulnerabilities that truly matter, vulnerabilities are auto-closed for infrastructure that is either no longer running, or contains the remediated fixed version of the previously-vulnerable package.

Further reading

Additional helpful documentation, links, and articles:

Setting up container image vulnerabilitiesDOCUMENTATION Setting up host vulnerabilitiesDOCUMENTATION Viewing Container ImagesDOCUMENTATION Troubleshooting CSM VulnerabilitiesDOCUMENTATION Mitigate infrastructure vulnerabilities with Datadog Cloud Security ManagementBLOG Enhance your troubleshooting workflow with Container Images in Datadog Container MonitoringBLOG