Frequently Asked Questions

What is the difference between the release vulnerability report and the "on-demand" vulnerability report data grid option on the Vulnerabilities page?

The vulnerability report can be downloaded in three different ways. The first way is through the release documents page. The second is by generating an "on-demand" vulnerabilities report for a selected version on the page SBOM > Vulnerabilities. The last way is by generating an "on-demand" vulnerabilities report that shows the current data grid that is displayed as either a CSV or XLSX file.

Image 1: Documents for this version

Image 2: Download vulnerability report

Image 3: Download data grid view

The data grid allows you to download the currently displayed data as CSV and XLSX. However, there are some caveats to this. To name a few:

• The grid-view vulnerability report should not be used as validated evidence documentation. Only the Ketryx release reports should be used as the source of truth. For example, Image 1 and Image 2 are the evidence documents. Image 3, "Download as CSV" should only be used "for information only".
• The vulnerability report downloaded from the grid view only displays what’s contained in a row, not what’s available in the detail pane, once expanded, such as links to mitigations and risks.
• This is raw data, so sometimes you may see unexpected data in the columns. For example, on the All items page, if you download the CSV you will see numbers such as "100", "50", "0" in the Approval state column. These values indicate to the system "behind the scenes" to then map to what you see in the table in your browser.