XRAY: How to manually mark specific Artifacts as vulnerable by Xray

Xray gathers its vulnerabilities information from external & internal sources, however, in some cases you may want to manually mark a specific artifact as vulnerable.

The above can be achieved by using the UI / REST API to create a 'Custom Issue Event.'

Once a custom issue is applied to a component, you may apply any policy and automatic action to it, for example: generate violation, block download, etc.

Prerequisites:

• Activated Xray on the instance 
• The repository that contains the artifacts you wish to mark as vulnerable has to be watched & indexed by Xray on the system
• A corresponding Xray policy should be configured to the repository

Steps: 

1. Select the artifact you wish to assign with an issue:

2. Confirm that this artifact is being indexed and watched by Xray:

 

3. Click ‘Actions’ and then ‘Assign Custom Button’ on the right:
 

4. Fill in informative details regarding the issue:
 

5. After saving the issue, the information should be visible under ‘Xray’ -> ‘Security’ tab:

 

• It is possible to delete issues that were created manually via the UI:

• Alternatively, you may also use our Xray REST API to create custom issue events