Phoenix Security

No entries match these filters. Clear filters

1. Container Lineage – Base Image Associations & Remediation (2026-11-03) Nov 3, 2026 · issue 130

   Phoenix Security adds container lineage to trace inherited vulnerabilities from base images to downstream services and surface fixed base versions⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   ⤢ ⤢ ⤢ ⤢
   └──▷ HOW TO FIND IT
   Identify how many downstream images inherit vulnerabilities from the same base, then find the minimum base version needed to remediate them.
   📍1. Go to Assets › Container. 2. Next to Group by, select Base image. 3. Expand the affected base-image group to see downstream image count, risk level and finding counts by severity. 4. Open the lineage graph for a downstream image to confirm the base-image digest in use. 5. Go to Vulnerabilities › Remedies › Containers, set Group by to Image cluster, expand the image group and version, then expand the BASE IMAGE remedy to read the minimum corrected base-image version recommended for the rebuild.
   • Group container assets by base image in Assets > Container by selecting Base image next to Group by, showing downstream image counts, risk level, risk magnitude and finding counts per severity.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Inspect a lineage graph from any image or image group to view the connected base image, downstream image version, image group, registry and associated running containers as a node cluster.
   • Separate inherited from self-introduced findings in Vulnerabilities > Remedies > Containers by grouping by Image cluster, where Phoenix labels findings SELF or BASE IMAGE to indicate whether a downstream package change or base rebuild is needed.

   3 details in Everything

2. Phoenix DAST Scanner – Configuration Guide (2026-10-27) Oct 27, 2026 · issue 123

   Phoenix adds a native DASTDASTDynamic application security testing, probing a running application from the outside for vulnerabilities. It checks behavior exposed through the application's interfaces. Scanner integration for scheduling authenticated web scans and monitoring target status from the platform.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   ⤢ ⤢
   └──▷ HOW TO FIND IT
   Set up a scheduled authenticated DAST scan for a web target that requires a bearer tokenbearer tokenA credential that grants access to whoever presents it, without a separate proof of possession. Protecting the token matters because a stolen copy can be used by someone else. for login.
   📍In Phoenix, go to Integrations › Scanners › WEB › Phoenix DAST Scanner. Expand Target 1, enter the target URL, set Start Time and Schedule, and paste the bearer or JWT token into the Auth Token (Bearer) field. Select Create Scanner.
   Pause all DAST target processing during a maintenance window without removing the integration.
   📍Open the created scanner integration page in Phoenix. Select Fetch/pause all to pause processing for every configured target. Select it again to re-enable when the window closes.
   • Adds a Phoenix DAST Scanner integration under Integrations > Scanners > WEB section, enabling scheduled web application scanning managed from within Phoenix.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Supports bearer and JWTJWTAn open standard (RFC 7519) for encoding claims as a signed, optionally encrypted JSON object passed between parties. Cyber tools use it to verify identity and permissions without querying a central session store. token authentication for scan targets via the Auth Token (Bearer) field — cookie, basic, and client-certificate authentication are not currently supported.
   • Provides per-target configuration including target URL, start time, time zone, and schedule, with support for multiple targets via + Add New Target.
   • Exposes target monitoring with status states — Active/Fetched, In Progress, Not Started, Disabled, Missing, and Error — alongside last fetch date and fetch-enabled/paused indicator.
   • Adds Fetch and Fetch/pause all controls to enable or pause individual or all target processing from the integration page.

   +1 more show less

   • Includes an optional control to auto-delete missing targets that have not been reported for a configurable number of days.

   6 details in Everything

3. Integration with Microsoft Azure Connector (2026-10-21) Oct 21, 2026 · issue 116

   Phoenix Security adds a Microsoft Azure connector for AKSAKSAzure Kubernetes Service, Microsoft's managed Kubernetes offering, which lets cyber tools offload cluster provisioning and scaling to Azure so engineers focus on workload logic instead of control-plane operations., Container Apps, Container Registry, and Entra IDEntra IDMicrosoft's cloud-based identity and access management service, formerly Azure Active Directory, used by cyber tools to authenticate users and enforce access policies in Microsoft 365 and Azure environments. team sync.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   ⤢ ⤢ ⤢
   └──▷ HOW TO FIND IT
   Set up the base Azure connection and enable AKS runtime discovery so Phoenix Security can pull running-container context from your Kubernetes clusters.
   📍In Phoenix Security, go to Integrations › Connectors and select Microsoft Azure. Enter a connector name, your Tenant ID, Client ID, and Client Secret, then select Create. Once created, open the connector from the Connected connectors list, select the Kubernetes Service capability, keep Enabled on, and select Save.
   Enable Entra ID team synchronisation so Phoenix team membership stays current from Microsoft Entra ID groups, using least-privilege Graph permissions.
   📍In the Microsoft Entra admin centre, add application permissions GroupMember.Read.All and User.Read.All to the Phoenix Security Azure Connector app registration and grant tenant admin consent. Then in Phoenix Security under Integrations › Connectors, open the Azure connector, select the Team sync from Entra ID groups capability, keep Enabled on, and select Save.
   • Adds a Microsoft Azure connector under Integrations > Connectors that authenticates via a customer-managed Microsoft Entra service principal using Tenant ID, Client ID, and Client Secret.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Supports independently enabled capabilities for Azure Kubernetes Service runtime, Azure Container Apps runtime, and Azure Container Registry image inventory — each validated, enabled, renamed, or removed without deleting the base connection.
   • Adds optional team synchronisation from Microsoft Entra ID groups using Microsoft GraphMicrosoft GraphMicrosoft's unified REST API for accessing data and services across Microsoft 365, Azure AD, and related cloud products, giving cyber tools a single authenticated endpoint to query users, emails, files, and sign-in logs. application permissions GroupMember.Read.All and User.Read.All with tenant admin consent.
   • Container Registry capability imports repository, image digest, and manifest inventory from authorised Azure Container Registries using Reader plus data-plane read access.
   • Kubernetes Service capability imports running-container context for AKS and uses Defender for Cloud security resource data, requiring Reader and Security Reader roles on each scoped subscription.

   +1 more show less

   • Container Apps capability imports Azure Container Apps runtime inventory with Reader role on each scoped subscription.

   6 details in Everything

4. Integration with AWS Connector (2026-10-14) Oct 14, 2026 · issue 109

   Phoenix Security adds an AWS connector to ingest ECRECRAmazon Elastic Container Registry, AWS's managed service for storing and distributing Docker and OCI container images, giving cyber tools a private, IAM-gated registry without self-hosting infrastructure. images, ECSECSElastic Common Schema, an open specification maintained by Elastic that defines a standard field naming convention for log and event data, letting cyber tools share and correlate records without per-source field mapping. tasks, and EKSEKSAmazon's managed Kubernetes service, run by AWS, that handles control-plane provisioning so teams can deploy containerized workloads without operating the underlying cluster infrastructure themselves. telemetry directly into its risk platform.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   ⤢ ⤢ ⤢ ⤢
   └──▷ USE IT
   Create a minimal IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. policy for the Phoenix ECR capability with base-image detection enabled, so Phoenix can map every image in eu-west-2 back to its base layer.
   json copy

   {
     "Version": "2012-10-17",
     "Statement": [
       {
         "Effect": "Allow",
         "Action": [
           "ecr:DescribeRepositories",
           "ecr:DescribeImages",
           "ecr:BatchGetImage",
           "ecr:GetDownloadUrlForLayer"
         ],
         "Resource": "*"
       }
     ]
   }

   Create a minimal IAM policy for the EKS Telemetry capability so Phoenix can query Container Insights log groups for running workloads.
   json copy

   {
     "Version": "2012-10-17",
     "Statement": [
       {
         "Effect": "Allow",
         "Action": [
           "eks:ListClusters",
           "eks:DescribeCluster",
           "logs:StartQuery",
           "logs:GetQueryResults"
         ],
         "Resource": "*"
       }
     ]
   }

   Add the AWS connector in Phoenix UI after creating the IAM user, to start ingesting ECR, ECS, and EKS inventory for a single region.
   📍1. In Phoenix, go to Integrations › Connectors. 2. Under Connectors, select Amazon Web Services. 3. Enter Name, Access Key ID, Secret Access Key, and Region (e.g. eu-west-2). 4. Click Save — Phoenix validates the credentials before creating the connector. 5. On the connector page, click + Add New under Capabilities and enable Elastic Container Registry, Elastic Container Service, or Elastic Kubernetes Service (Telemetry) as needed.
   • Adds an Amazon Web Services connector (configured via Integrations › Connectors › Amazon Web Services) that authenticates with an IAM Access Key ID and Secret Access Key to pull container inventory from a specified AWS Region.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds a Detect Base Images From Image Layers option for the ECR capability (also requiring ecr:BatchGetImage and ecr:GetDownloadUrlForLayer) to identify each image's base image from its layer data.
   • Adds a Max New Images To Inspect Per Run setting for the ECR capability to cap how many new images are inspected on each collection cycle.
   • Adds an Elastic Container Service (ECS) capability requiring ecs:ListClusters, ecs:ListTasks, and ecs:DescribeTasks permissions to enumerate every running task across all ECS clusters in the connector's region.
   • Adds an Elastic Kubernetes Service (EKS) Telemetry capability requiring eks:ListClusters, eks:DescribeCluster, logs:StartQuery, and logs:GetQueryResults permissions to query each cluster's Container Insights log group for the last 24 hours.

   +1 more show less

   • Supports multi-region and multi-account coverage by creating one connector per AWS region or account.

   6 details in Everything

5. Rapid7 InsightVM Platform Integration (2026-09-15) Sep 15, 2026 · issue 076

   Phoenix Security adds native integration with Rapid7 InsightVM SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. platform for vulnerability ingestion.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   ⤢ ⤢ ⤢
   └──▷ HOW TO FIND IT
   Connect Phoenix Security to a Rapid7 InsightVM SaaS account so vulnerability findings from monitored Sites flow into Phoenix environments.
   📍1. In the sidebar, go to Integrations › Scanners. 2. Click Add Scanner Integration. 3. Select Rapid7 Platform from the integration list and enter a name. 4. Enter your Server URL (e.g. https://us.api.insight.rapid7.com/ — replace us with your region code: us2, us3, eu, ca, au, ap, aps2, or me1). 5. Enter the API Username and Password for a dedicated API user (MFA disabled). 6. Click Create Scanner.
   • Adds Rapid7 InsightVM (SaaS/cloud) as a new scanner integration, configurable via Integrations > Scanners > Add Scanner Integration with a Server URL in the form https://{region}.api.insight.rapid7.com/, API Username, and Password.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   1 detail in Everything

6. SLA Override – Configuration & Usage Guide (2026-08-17) Aug 17, 2026 · release notes

   Phoenix Security introduces SLASLAA formal agreement between a service provider and customer that defines expected uptime, response times, and remedies for failures, giving cyber tools a contractual baseline for availability and support commitments. Override workflow with reset and addition modes for managing remediation deadlines

   └──▷ HOW TO FIND IT
   Use the automated Exception Engine to automatically reset SLAs for high-risk findings matching specific asset tags.
   📍Automation › Exception Engine › Add New Exception Rule IF: Asset Tags = [High Value] THEN Action: Risk Recasting -> Toggle Reset Findings SLA: on
   Manually override an SLA breach for a specific finding using the Triage screen.
   📍Vulnerabilities › Findings › Select Finding › Risk Exception Column Turn on Reset Findings SLA Enter SLA Target Days
   • Adds Reset Findings SLA toggle to force countdown from day 0 at approval timestamp in both Manual Flow (Triage/Findings Screen) and Automated Flow (Exception Engine)
   • Supports SLA Addition mode via SLA Target Days field to append extra days instead of resetting

   2 details in Everything

7. Orange MCP – Installation & Usage Guide (2026-07-08) Jul 8, 2026 · release notes

   Orange MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. server adds conversational ASPMASPMApplication security posture management, combining findings about applications from multiple tools and relating them to business context. It helps teams decide which fixes matter most. access via Model Context ProtocolModel Context ProtocolModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. with 35 tools.

   └──▷ TRY IT
   Register the MCP server with Claude Code using environment variables for credentials and a read-only default.
   copy

   $ claude mcp add orange-mcp --scope user -e PHOENIX_CLIENT_ID="your-client-id" -e PHOENIX_CLIENT_SECRET="your-client-secret" -e PHOENIX_API_BASE_URL="https://api.phoenix.security/v1" -e PHOENIX_MCP_READ_ONLY=true -- "$(pwd)/.venv/bin/phoenix-mcp"

   Configure the MCP server environment variables to control read/write access and list result caps.
   copy

   $ export PHOENIX_CLIENT_ID="<client-id>"
   export PHOENIX_CLIENT_SECRET="<client-secret>"
   export PHOENIX_API_BASE_URL="https://<tenant>.phoenix.security/v1"
   export PHOENIX_MCP_READ_ONLY="true"
   export PHOENIX_MCP_MAX_ITEMS="100"

8. Importing Scanner Vulnerability Reports (2026-06-04) Jun 4, 2026 · release notes

   Phoenix adds REST and V5 PUB APIs for importing vulnerability reports from 200+ scanners into assessments.

   └──▷ TRY IT
   Upload a raw Grype JSON report directly to Phoenix for automatic translation and import into an assessment.
   copy

   $ curl -X POST https://api.securityphoenix.cloud/v1/import/assets/file/translate \
     -H "Authorization: Bearer <token>" \
     -F "file=@report.json" \
     -F "scanType=Anchore Grype Scan" \
     -F "assessmentName=MyProdScan" \
     -F "importType=new"

   • Adds POST /v1/import/assets/file/translate endpoint to upload raw scanner report files directly for translation and import into Phoenix assessments
   • Introduces the V5 PUB Loading Script toolkit (phoenix_multi_scanner_enhanced.py) for client-side translation of 200+ scanner formats including Grype and Trivy before bulk upload via POST /v1/import/assets
   • Adds support for three import modes (new, merge, delta) allowing full baselining, incremental updates, or partial delta imports of assets and findings
   • Extends asset type detection in V5 translators to map Grype/Trivy outputs to CONTAINER, INFRA, CLOUD, REPOSITORY, and BUILD categories based on report structure

   4 details in Everything

9. Asset Deletion & Lifecycle Guidance (2026-05-28) May 28, 2026 · release notes

   Phoenix Security adds Lifecycle Configurations for automated asset/finding purging and Delta import support via REST APIREST APIA web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services..

   └──▷ HOW TO FIND IT
   Configure asset lifecycle grace periods via the web UI.
   📍Navigate to Settings › Organization Settings › Configuration › Lifecycle Configurations
   Import assets using Delta mode to preserve existing records.
   copy

   $ POST /api/v1/assets/import?import_type=Delta
   Content-Type: application/json
   
   {
     "assets": [...]
   }

   Enable automatic removal of unreachable scanner targets.
   📍In the Scanner Targets table, enable the automated deletion setting and specify the number of days for purging missing targets.
   • Adds Lifecycle Configurations section under Settings > Organization Settings to automate garbage collection of scanner findings and assets.
   • Enables automated deletion setting in the Scanner Targets table to purge missing targets after a custom number of days.
   • Supports Delta import type for REST API and Multi-Scanner Import Tool to add/update assets without closing existing ones.

   3 details in Everything

10. Integration with Detectify (2026-01-30) Jan 30, 2026 · release notes

    Phoenix Security adds Detectify scanner integration for asset and vulnerability ingestion

    └──▷ HOW TO FIND IT
    Configure a new Detectify integration by creating an API key in Detectify and inputting it into the Phoenix Security web UI under Integrations.
    📍Navigate to Integrations › Scanners, select the Detectify template under WEB scanners, enter your Server URL and API key, then click Create.
    • Adds a new Detectify scanner template under Integrations > Scanners > WEB scanners to ingest vulnerabilities and assets from Detectify.
    • Adds Finding Status to Fetch selection during integration setup to filter findings by Accepted Risk, False Positive, or Patched status.

    2 details in Everything

11. Integration with Polaris Platform (SaaS) (2026-01-23) Jan 23, 2026 · release notes

    Adds Polaris Platform SASTSASTStatic application security testing, analyzing source code or compiled code for vulnerabilities without running the application. It helps developers find problems before deployment. integration via new Polaris Platform scanner template and API secret configuration in Phoenix Security

    └──▷ HOW TO FIND IT
    Configure a new SAST integration by selecting the specific template and entering credentials.
    📍In the Phoenix Security console, go to Integrations › Scanners, hover over SAST scanners, click the Polaris Platform template, and enter your API Secret in the Client Secret field.
    • Adds a new Polaris Platform scanner template under Integrations > Scanners > SAST scanners for importing assets and vulnerabilities from Polaris Platform.

    1 detail in Everything

12. Integration with Orca (2026-01-22) Jan 22, 2026 · release notes

    Phoenix Security adds native integration with Orca Security scanners for asset and vulnerability data ingestion.

    └──▷ HOW TO FIND IT
    Ingest cloud security posture and vulnerability data from an existing Orca tenant into Phoenix Security without manual CSV imports.
    📍1. Log in to Orca as Org Admin. 2. Go to Settings › Users and Permissions › API, then create a Service Token with Viewer role. 3. In Phoenix, navigate to Integrations › Scanners. 4. Hover over Cloud scanners, click the Orca template. 5. Enter Scanner Name, Server URL, and the Orca API key. 6. Choose target accounts and save.
    • Adds Orca scanner template under Integrations > Scanners to ingest assets and vulnerabilities from Orca Security accounts.

    1 detail in Everything