Investigating Findings

The All findings tab in the CVEs view of Tetrate Patch Service shows one row per finding: one CVE on one image, with everything you need to judge urgency. Every row already deserves attention, because only Critical and High findings with a fix available are reported at all. This page shows how to browse, filter, and search the table, read a single finding in full, and recognize the two ways a finding leaves your list.

Browsing All Findings

Open CVEs in the sidebar and switch to the All findings tab. Use the cluster selector (All clusters by default) to scope the table to a single cluster when you are investigating just one. Each row carries the finding's severity, category, and status alongside the image, the CVE, and the affected package:

Column	What it tells you
Image	The image the CVE was found in.
CVE	The CVE ID, linked to its entry in the National Vulnerability Database (NVD) for the full advisory.
Severity	Critical or High. Nothing lower appears: CVE Scanning and Findings explains why lower severities and CVEs without a fix are left out.
Package	The package inside the image that carries the vulnerability.
Category	Who acts: actionable (you, by upgrading), pending (Tetrate, in its next release), or third party (informational, not a Tetrate image).
Status	Open or resolved. Only a scan changes it. Resolved rows render dimmed and struck through, so open work stands out at a glance.

The table opens in triage order: most severe first, and oldest first within a severity, so the top row is the worst thing that has been waiting longest. Sort by the Image, CVE, Severity, or Status column headers to reorder it. Sorting and the filters below apply to the complete result set, not just the page on screen, so the top of a severity sort is the worst finding in your fleet, not the worst on the current page.

Filtering Findings

The filter row above the table cuts the list down to exactly the slice you are working on.

1. Filter by severity: Critical or High. Critical is the natural first pass, and it is already what the default order puts on top.
2. Filter by category: Actionable for findings you close by upgrading, Pending for findings whose fix arrives in Tetrate's next release (they re-categorize to actionable on their own when it ships), or Third party for informational findings on images Tetrate does not distribute.
3. Filter by status. Open is the default, so resolved findings never clutter the working view. Switch to Resolved to confirm a fix landed, or All statuses to see both at once.
4. Search for text in the box at the end of the row. It matches any part of the image, the CVE ID, or the package name, so CVE-2025-1234 answers whether a freshly published advisory affects you, openssl collects every finding in that package, and envoy narrows to one image. Severity, category, and status are deliberately not searched: they have exact filters of their own, and searching them would make partial words match the wrong rows.

The filters and the search box combine, and all of them apply to your whole result set rather than the page on screen. When nothing matches, the table says so rather than showing an empty page, so a blank result means no such findings exist, not that they failed to load.

Reading a Finding's Details

Click the arrow at the start of a row to expand the finding. The expansion is where a row becomes a decision: which clusters are exposed, what exactly is vulnerable, and how long it has been.

Clusters lists every cluster of yours running the affected image: one finding can expose several clusters, and this field is where you see which. Package, Installed version, and Fixed version pin down the vulnerability itself: the affected package, the version the image ships, and the version that fixes it. On an actionable finding, Latest release names the upgrade target, the release whose image carries the fix.

Three timestamps date the finding. First detected is when the CVE was first reported on this image and never moves, so it is the finding's true age. Last scanned is when the evidence was last refreshed. Resolved findings add Resolved at.

How Findings Resolve

Only a scan moves a finding. The Patch Service deliberately offers no dismiss or accept-risk action: Tetrate owns remediation, so findings close on evidence that the fix is running, never on judgment that the risk is acceptable. A finding leaves your list in one of two ways:

What you see	What happened
The status flips to resolved and the row renders dimmed and struck through.	The image was scanned again and the CVE is no longer present, the normal aftermath of an upgrade replacing the image.
The finding disappears from the list entirely.	No cluster of yours runs the affected image any longer. The table shows your current exposure, not your history.

An upgrade does not resolve a finding the moment it rolls out

The agent must observe the new image running and a scan must confirm the CVE is gone; until then the finding stays open. That gap is the point: status reflects what your clusters run, not what you approved.

Next Steps

• Remediate the vulnerability when an actionable finding names an upgrade target you are ready to move to.
• Monitor vulnerabilities across your fleet when you want the summary picture, open counts, finding ages, and whether scans are current, instead of individual rows.
• Read CVE Scanning and Findings for the model behind severities, categories, and the scans that feed this table.