1. Collects the distinct operating system image digests reported in device status across enrolled devices.
2. Queries the Red Hat Trusted Profile Analyzer API to resolve each digest to its SBOM and associated advisories.
3. Stores the results in the Red Hat Edge Manager database, keyed by image digest and CVE ID.

Procedure

1. Set vulnerabilityReporting.enabled to true in your Red Hat Edge Manager Helm release values. Merge the following example with your existing configuration:

   vulnerabilityReporting Helm values

   vulnerabilityReporting:
     enabled: true
     syncInterval: "15m"
     trustify:
       endpoint: "https://rhtpa.example.com"
       auth:
         mode: "none"

   Copy code to clipboard

2. If Red Hat Trusted Profile Analyzer uses OAuth2 client credentials, set auth.mode to client-credentials and set oidcIssuerUrl. Reference a Kubernetes secret for the client ID and secret:

   vulnerabilityReporting:
     enabled: true
     syncInterval: "15m"
     trustify:
       endpoint: "https://rhtpa.example.com"
       auth:
         mode: "client-credentials"
         oidcIssuerUrl: "https://sso.example.com/realms/rhtpa"
         secretName: "rhtpa-credentials"

   Copy code to clipboard

3. Create the secret in the same namespace as the Red Hat Edge Manager release before you upgrade:

   $ kubectl create secret generic rhtpa-credentials \
     --from-literal=client_id=<client_id> \
     --from-literal=client_secret=<client_secret> \
     -n <namespace>

   Copy code to clipboard
4. Upgrade the Helm release so flightctl-periodic loads the new configuration. The Red Hat Trusted Profile Analyzer credentials secret is mounted only into the periodic service pod.

Verification

1. Confirm the flightctl-periodic pod logs contain vulnerability-sync entries after the sync interval elapses.
2. Run flightctl get vuln --summary-only after devices report an imageDigest and Red Hat Trusted Profile Analyzer has data for those digests.

Procedure

1. Edit /etc/flightctl/service-config.yaml and set the vulnerabilityReporting block:

   vulnerabilityReporting:
     enabled: true
     syncInterval: 15m
     trustify:
       endpoint: https://rhtpa.example.com
       auth:
         mode: client-credentials
         oidcIssuerUrl: https://sso.example.com/realms/rhtpa
         clientId: <client_id>
         clientSecret: <client_secret>

   Copy code to clipboard
   Important

   Do not store client secrets in plain text in production. Use environment variable overrides as described in Configuration reference.

2. Restart the periodic service:

   $ sudo systemctl restart flightctl-periodic.service

   Copy code to clipboard

Verification

1. Confirm flightctl-periodic logs contain vulnerability-sync entries after the sync interval elapses.
2. Run flightctl get vuln --summary-only after devices report an imageDigest and Red Hat Trusted Profile Analyzer has data for those digests.

Procedure

1. In the navigation menu, open Overview.
2. On the Overview dashboard, review the Security overview card. It shows the total number of active vulnerabilities across your managed fleets and devices.

3. In the card, review the count for each severity band: Critical, Important, Moderate, Low, None, and Undefined.

   Note

   The web console uses Red Hat security rating terms. The CLI and API use CVSS terms for the same severity levels: Important maps to High, Moderate maps to Medium, and Undefined maps to Unknown.

4. To open the full CVE list, click View all CVEs in the card header.

5. On the Security overview page, review the paginated CVE table. The table lists Name, Severity, Affected devices, and Affected images for each CVE.

   CVEs are sorted by severity, with Critical listed first.

6. Use Filter by severity or Find by name to narrow the list. Sort columns or move between pages as needed.
7. Click a CVE Name to open the CVE details panel for that CVE.

Procedure

1. Open Devices and select a device to open the device details page.
2. On the device details page, review the Security overview card. It shows a paginated table of CVEs affecting the device for the reported image digest.
3. Filter by severity or CVE ID and sort columns as needed.
4. To review a single CVE in the context of the device, click a CVE row.

Procedure

1. Click a CVE Name to open the CVE details panel.
2. Review the CVE header, published date, and description.
3. Review Severity and Scanner name (findings are sourced from Red Hat Trusted Profile Analyzer).
4. In Affected images, review the image references that carry this CVE.

5. In the Impact summary section, review how many devices and fleets run affected images.

   The summary table lists Fleet name, Affected devices, and Affected images per fleet. Devices without a fleet owner appear under None.

6. In References, follow links to related Red Hat security advisories when they are available.
7. Click a fleet name to open that fleet’s vulnerability view and see CVEs affecting the fleet.
8. Click the number of affected devices for a fleet to open the Devices list with those devices pre-filtered.
9. For devices without a fleet owner, click the affected device count in the None row to open the Devices list with those devices pre-filtered.

Procedure

1. Open Fleets and select a fleet, or from the Impact summary in a CVE details panel, click a fleet name.
2. On the fleet details page, review the Security overview card. It shows a paginated table of CVEs affecting that fleet only.
3. Filter by severity or CVE ID and sort columns as needed.

4. To review a single CVE in the context of the fleet, click a CVE row.

   When you plan remediation, distinguish fleet-managed devices from devices without a fleet owner. To reach affected devices, use the pre-filtered Devices list from the Impact summary in the CVE details panel. You can update those devices individually or assign them to a fleet.