CVE lifecycle events

When vulnerability reporting is enabled, Red Hat Edge Manager emits per-device CVE lifecycle events after each sync for High and Critical findings. You can inspect these events by querying the event log.

The periodic service evaluates stored findings against each device’s reported image digest and emits:

Event reason When it is emitted

DeviceVulnerabilityCVECritical

A Critical severity CVE affects the device’s running image digest and no unresolved Critical detection event exists for that device and CVE.

DeviceVulnerabilityCVEWarning

A High severity CVE affects the device under the same deduplication rules.

DeviceVulnerabilityCVEResolved

The condition clears because the device runs a different digest, severity drops below the event threshold, or the finding status is not_affected.

Medium, Low, and None severities do not generate lifecycle events.

Events reference the device in involvedObject and include cve_id, image_ref, and image_digest in details. A CVE marked as fixed in Red Hat Trusted Profile Analyzer does not resolve the event until the device runs an image digest that is no longer affected.

Use flightctl get events with a field selector on reason to audit detections and resolutions. See View CVE lifecycle events in the Additional resources section.