Threat Stack Daily Vulnerability Reporting analyzes all packages against the more than 2 million Common Vulnerabilities and Exposures (CVE) listed in the National Vulnerability Database (NVD) run by the National Institute of Standards and Technology (NIST). If business reasons prevent you from remediating a particular Vulnerability, you may choose to create a suppression on that Vulnerability and exclude it from daily reports and the Threat Stack UI.
The suppression of a vulnerability impacts the entire organization. The next time Vulnerability Assessment runs, it will not report on these suppressed vulnerabilities, even if they are found on new servers and agents. You may choose to remove a suppression at any time.
To work with the Vulnerabilities, first navigate to the Servers page in Threat Stack.
To suppress a vulnerability:
- Click on the Vulnerabilities button at the top of the Servers page. (Blue arrow)
- Select the package you want to suppress. (Green Arrow)
- You may want to deselect a CVE you do not want to suppress at this time. (Orange arrow)
- Select your Reason. (Red Arrow)
- The Other option gives you the opportunity to enter your own reason.
- Click on the red Suppress vulnerabilities button.
To un-suppress a vulnerability:
- From the Vulnerabilities page, click on the Suppressed Vulnerabilities button. (Blue Arrow)
- Select the suppressions that you want to remove. (Green Arrow)
- Click the red Remove suppressions button.