Tetap teratur dengan koleksi
Simpan dan kategorikan konten berdasarkan preferensi Anda.
Artifact Analysis adalah rangkaian layanan yang menyediakan analisis komposisi software, penyimpanan dan pengambilan metadata. Titik deteksinya digunakan ke dalam sejumlah produk seperti Artifact Registry dan Google Kubernetes Engine (GKE) untuk pengaktifan yang cepat. Google Cloud Layanan ini berfungsi dengan produk pihak pertama Google Cloud' dan juga memungkinkan Anda menyimpan informasi dari sumber pihak ketiga. Layanan pemindaian menggunakan penyimpanan kerentanan umum untuk mencocokkan file dengan kerentanan yang diketahui.
Layanan ini sebelumnya dikenal sebagai Container Analysis. Nama baru ini tidak mengubah produk atau API yang ada, tetapi mencerminkan rangkaian fitur produk yang semakin luas di luar penampung.
Gambar 1. Diagram yang menunjukkan Analisis Artefak membuat dan berinteraksi
dengan metadata di seluruh lingkungan sumber, build, penyimpanan, deployment, dan runtime.
Pemindaian registri
Bagian ini menguraikan fitur pemindaian kerentanan Artifact Analysis berdasarkan Artifact Registry, dan mencantumkan produk terkait tempat Anda dapat mengaktifkan kemampuan pelengkap untuk mendukung postur keamanan Anda. Google Cloud
Pemindaian otomatis di Artifact Registry
Proses pemindaian dipicu secara otomatis setiap kali Anda mengirimkan image baru ke Artifact Registry.
Informasi kerentanan terus diperbarui saat kerentanan baru ditemukan. Artifact Registry menyertakan pemindaian paket bahasa aplikasi. Untuk memulai, aktifkan
pemindaian otomatis.
Manajemen risiko terpusat dengan Security Command Center
Security Command Center memusatkan keamanan cloud Anda, dengan menawarkan pemindaian kerentanan, deteksi ancaman, pemantauan postur, dan pengelolaan data.
Security Command Center mengagregasi temuan kerentanan dari pemindaian Artifact Registry, sehingga Anda dapat melihat kerentanan image container dalam workload yang sedang berjalan, di semua project bersama dengan risiko keamanan lainnya di Security Command Center. Anda juga dapat mengekspor temuan ini ke
BigQuery untuk analisis mendalam dan penyimpanan jangka panjang.
Untuk mengetahui informasi selengkapnya, lihat
Penilaian kerentanan Artifact Registry.
Pemindaian kerentanan workload GKE - tingkat standar
Sebagai bagian dari dasbor postur keamanan GKE, pemindaian kerentanan workload mendeteksi kerentanan OS image container. Pemindaian gratis dan dapat diaktifkan per cluster. Hasilnya
dapat dilihat di dasbor postur keamanan.
Selain pemindaian OS container dasar, pengguna GKE dapat mengupgrade ke advanced vulnerability insights untuk memanfaatkan deteksi kerentanan paket bahasa berkelanjutan. Anda harus mengaktifkan fitur ini secara manual di cluster Anda, setelah itu Anda akan menerima hasil kerentanan paket bahasa dan OS. Pelajari lebih lanjut
pemindaian kerentanan di workload GKE.
Pemindaian On-Demand
Layanan ini tidak berkelanjutan; Anda harus menjalankan perintah untuk memulai pemindaian secara manual. Hasil pemindaian tersedia hingga 48 jam setelah pemindaian selesai. Informasi kerentanan tidak diperbarui setelah pemindaian selesai. Anda dapat memindai image yang disimpan secara lokal, tanpa harus mengirimkannya ke runtime GKE atau Artifact Registry terlebih dahulu. Untuk
mempelajari lebih lanjut, lihat pemindaian sesuai permintaan.
Mengakses metadata
Artifact Analysis adalah komponen infrastruktur Google Cloud yang memungkinkan Anda menyimpan dan mengambil metadata terstruktur untuk Google Cloudresource. Pada berbagai tahap proses rilis, orang atau sistem otomatis dapat menambahkan metadata yang menjelaskan hasil aktivitas. Misalnya, Anda dapat menambahkan metadata ke gambar yang menunjukkan bahwa gambar tersebut telah lulus rangkaian pengujian integrasi atau pemindaian kerentanan.
Dengan Analisis Artefak yang terintegrasi ke dalam pipeline CI/CD, Anda dapat membuat keputusan berdasarkan metadata. Misalnya, Anda dapat menggunakan Otorisasi Biner untuk membuat kebijakan deployment yang hanya mengizinkan deployment untuk image yang sesuai dari registry tepercaya.
Analisis Artefak mengaitkan metadata dengan gambar melalui catatan dan
kemunculan. Untuk mempelajari konsep ini lebih lanjut, lihat
halaman pengelolaan metadata.
Untuk mempelajari cara menggunakan Artifact Analysis untuk pengelolaan metadata, dan biaya untuk layanan pemindaian kerentanan opsional, lihat
dokumentasi Artifact Analysis.
[[["Mudah dipahami","easyToUnderstand","thumb-up"],["Memecahkan masalah saya","solvedMyProblem","thumb-up"],["Lainnya","otherUp","thumb-up"]],[["Sulit dipahami","hardToUnderstand","thumb-down"],["Informasi atau kode contoh salah","incorrectInformationOrSampleCode","thumb-down"],["Informasi/contoh yang saya butuhkan tidak ada","missingTheInformationSamplesINeed","thumb-down"],["Masalah terjemahan","translationIssue","thumb-down"],["Lainnya","otherDown","thumb-down"]],["Terakhir diperbarui pada 2025-08-18 UTC."],[[["\u003cp\u003eArtifact Analysis provides software composition analysis, metadata storage, and retrieval, extending beyond containers to various software artifacts.\u003c/p\u003e\n"],["\u003cp\u003eAutomatic scanning is triggered upon pushing new images to Artifact Registry, with continuous updates for newly discovered vulnerabilities and support for application language package scanning.\u003c/p\u003e\n"],["\u003cp\u003eGKE offers both standard and advanced vulnerability scanning tiers, with the latter including continual language package vulnerability detection, which can be manually enabled per cluster.\u003c/p\u003e\n"],["\u003cp\u003eOn-demand scanning allows for manual scans of images without needing to push them to a registry, but results are not continually updated and are available only up to 48 hours after the scan.\u003c/p\u003e\n"],["\u003cp\u003eMetadata, such as test results or vulnerability scan outcomes, can be stored and retrieved through Artifact Analysis to make informed decisions during the CI/CD pipeline, including defining deployment policies with Binary Authorization.\u003c/p\u003e\n"]]],[],null,["# Artifact analysis and vulnerability scanning\n\nArtifact Analysis is a family of services that provide software\ncomposition analysis, metadata storage and retrieval. Its detection points are\nbuilt into a number of Google Cloud products such as Artifact Registry and\nGoogle Kubernetes Engine (GKE) for quick enablement. The service works with\nboth Google Cloud's first-party products and also lets you store\ninformation from third-party sources. The scanning services use a common\nvulnerability store for matching files against known vulnerabilities.\n\nThis service was formerly known as Container Analysis. The new name does not\nchange existing products or APIs, but reflects the product's expanding range of\nfeatures beyond containers.\n\n**Figure 1.** Diagram that shows Artifact Analysis creating and interacting\nwith metadata across source, build, storage, deployment and runtime\nenvironments.\n\nRegistry scanning\n-----------------\n\nThis section outlines Artifact Analysis vulnerability scanning\nfeatures based in Artifact Registry, and lists related Google Cloud\nproducts where you can enable complementary capabilities to support your\nsecurity posture.\n\n### Automatic scanning in Artifact Registry\n\n- The scanning process is triggered automatically every time you push a new image to Artifact Registry. The vulnerability information is continuously updated when new vulnerabilities are discovered. Artifact Registry includes application language package scanning. To get started, enable [automatic scanning](/artifact-analysis/docs/os-overview).\n\n### Centralized risk management with Security Command Center\n\n|\n| **Preview**\n|\n|\n| This product or feature is subject to the \"Pre-GA Offerings Terms\" in the General Service Terms section\n| of the [Service Specific Terms](/terms/service-terms#1).\n|\n| Pre-GA products and features are available \"as is\" and might have limited support.\n|\n| For more information, see the\n| [launch stage descriptions](/products#product-launch-stages).\n\n- Security Command Center centralizes your cloud security, offering vulnerability scanning, threat detection, posture monitoring, and data management. Security Command Center aggregates vulnerability findings from Artifact Registry scans, allowing you to view container image vulnerabilities within your running workloads, across all projects alongside your other security risks in Security Command Center. You can also export these findings to BigQuery for in-depth analysis and long-term storage. For more information, see [Artifact Registry vulnerability assessment](/security-command-center/docs/concepts-security-sources#ar-vuln-assessment).\n\n### GKE workload vulnerability scanning - standard tier\n\n| **Caution:** Starting on July 23, 2024, standard tier/container OS vulnerability scanning is deprecated and is scheduled for shutdown on July 31, 2025. For more information about deprecation and shutdown dates, see [Vulnerability scanning removal from GKE](/kubernetes-engine/docs/deprecations/vulnerability-scanning-gkee).\n\n- As part of GKE security posture dashboard, workload vulnerability scanning provides detection of container image OS vulnerabilities. Scanning is free and can be enabled per cluster. Results are available to view in the [security posture dashboard](/kubernetes-engine/docs/concepts/about-security-posture-dashboard).\n\n### GKE workload vulnerability scanning - advanced vulnerability insights\n\n| **Caution:** Starting on June 16, 2025 Advanced Vulnerability Insights is deprecated and is scheduled for shutdown on June 16, 2026 as part of the deprecation of various GKE security posture dashboard features. For more information about deprecation and shutdown dates, see [Vulnerability\n| scanning removal from GKE](/kubernetes-engine/docs/deprecations/vulnerability-scanning-gkee).\n\n- In addition to basic container OS scanning, GKE users can upgrade to *advanced vulnerability insights* to take advantage of continual language package vulnerability detection. You must manually enable this feature on your clusters, after which you'll receive OS and language package vulnerability results. Learn more about [vulnerability scanning in GKE workloads](/kubernetes-engine/docs/how-to/security-posture-vulnerability-scanning).\n\nOn-Demand scanning\n------------------\n\n- This service is not continual; you must run a command to manually initiate the scan. Scan results are available up to 48 hours after the scan is completed. The vulnerability information is not updated after the scan is finished. You can scan images stored locally, without having to push them to Artifact Registry or GKE runtimes first. To learn more, see [on-demand scanning](/artifact-analysis/docs/os-scanning-on-demand).\n\nAccess metadata\n---------------\n\n- Artifact Analysis is a Google Cloud infrastructure\n component that lets you\n [store and retrieve structured metadata](/artifact-analysis/docs/metadata-management-overview) for Google Cloud\n resources. At various phases of your release process, people or automated\n systems can add metadata that describes the result of an activity. For\n example, you can add metadata to your image indicating that the image has\n passed an integration test suite or a vulnerability scan.\n\n- With Artifact Analysis integrated into your CI/CD pipeline, you\n can make decisions based on metadata. For example, you can use\n [Binary Authorization](/binary-authorization/docs) to create deployment policies\n that only allow deployments for compliant images from trusted registries.\n\n- Artifact Analysis associates metadata with images through **notes** and\n **occurrences** . To learn more about these concepts, see the\n [metadata management page](/artifact-analysis/docs/metadata-management-overview).\n\nTo learn about using Artifact Analysis for metadata management, and\ncosts for the optional vulnerability scanning service, see the\n[Artifact Analysis documentation](/artifact-analysis/docs)."]]
