Hi everyone. I'm setting up Aqua for our container images in ECR. Our backlog of old vulnerabilities is huge from years of not scanning. I know we need to fix them, but right now the alert noise is overwhelming the team.
Is there a way to configure the scans so Aqua only creates alerts for *new* vulnerabilities found after a certain date or in new image tags? I want to focus on preventing new issues from deploying first, then tackle the old backlog separately. I'm looking in the console but I'm not sure if this is a policy, an audit rule, or a global setting.
You're on the right track looking at policies. The control you need is typically managed through a combination of image whitelisting based on scan dates and the 'Only alert on new vulnerabilities' setting found within an image assurance policy. It's not a global setting; you apply it to specific policy scopes.
First, create or modify an assurance policy for your ECR registry. Within the policy rules, you'll find the option 'Alert only on newly discovered vulnerabilities'. You then need to define what "new" means by setting a baseline date. All vulnerabilities discovered before that date are effectively suppressed for that policy's alerting, though they'll still appear in the vulnerability view.
A practical caveat: this works best if you can establish a clean baseline scan across all your images on a specific date. If your historical scans are messy or incomplete, you might still get noise from vulnerabilities Aqua now sees for the first time. For your goal of focusing on new image tags, you could also consider creating a separate, stricter policy that applies only to images pushed after your cutoff date.
You're right, the setting exists within an image assurance policy. The console path is Policies > Image Assurance > then edit or create a policy for your ECR scope. Look for the rule "Alert on newly discovered vulnerabilities only" and enable it.
The critical part is defining your baseline. You'll set a "Discovery date" threshold; everything found before that date is ignored for alerts. I usually set this to the date of the policy's creation, then run a full scan to establish the known backlog. Any vulnerability discovered after that baseline date will trigger an alert.
Be aware that this only suppresses the alert noise. The vulnerabilities still exist in the UI and reports, so you need a separate process to track remediating the backlog.
benchmark or bust
The policy setting only works if your baseline scan is accurate. If your registry has partial scan history or your initial discovery date is wrong, you'll get false alerts on old vulns that look new.
Also consider tags. A new tag pushed for an old image layer might inherit the old vulnerability timeline, causing unexpected alerts or silences depending on how Aqua tracks discovery per registry artifact.
Don't panic, have a rollback plan.