https://cybertoolchain.io/tools/phoenix-security New releases and features in Phoenix Security, tracked by The Cyber Toolchain. en Tue, 03 Nov 2026 13:27:42 GMT https://kb.phoenix.security/?ht_kb=container-lineage-base-image-associations-remediation https://kb.phoenix.security/?ht_kb=container-lineage-base-image-associations-remediation Tue, 03 Nov 2026 13:27:42 GMT Phoenix Security adds container lineage to trace inherited vulnerabilities from base images to downstream services and surface fixed base versions⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Group container assets by base image in Assets > Container by selecting 'Base image' next to 'Group by', showing downstream image counts, risk level, risk magnitude and finding counts per severity.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Inspect a lineage graph from any image or image group to view the connected base image, downstream image version, image group, registry and associated running containers as a node cluster. • Separate inherited from self-introduced findings in Vulnerabilities > Remedies > Containers by grouping by 'Image cluster', where Phoenix labels findings 'SELF' or 'BASE IMAGE' to indicate whether a downstream package change or base rebuild is needed. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/phoenix-security https://kb.phoenix.security/?ht_kb=phoenix-dast-scanner-configuration-guide https://kb.phoenix.security/?ht_kb=phoenix-dast-scanner-configuration-guide Tue, 27 Oct 2026 14:22:51 GMT Phoenix adds a native DAST Scanner integration for scheduling authenticated web scans and monitoring target status from the platform.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds a Phoenix DAST Scanner integration under Integrations > Scanners > WEB section, enabling scheduled web application scanning managed from within Phoenix.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Supports bearer and JWT token authentication for scan targets via the 'Auth Token (Bearer)' field — cookie, basic, and client-certificate authentication are not currently supported. • Provides per-target configuration including target URL, start time, time zone, and schedule, with support for multiple targets via '+ Add New Target'. • Exposes target monitoring with status states — Active/Fetched, In Progress, Not Started, Disabled, Missing, and Error — alongside last fetch date and fetch-enabled/paused indicator. • Adds 'Fetch' and 'Fetch/pause all' controls to enable or pause individual or all target processing from the integration page. • Includes an optional control to auto-delete missing targets that have not been reported for a configurable number of days. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/phoenix-security https://kb.phoenix.security/?ht_kb=integration-with-microsoft-azure-connector https://kb.phoenix.security/?ht_kb=integration-with-microsoft-azure-connector Wed, 21 Oct 2026 11:33:36 GMT Phoenix Security adds a Microsoft Azure connector for AKS, Container Apps, Container Registry, and Entra ID team sync.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds a Microsoft Azure connector under Integrations > Connectors that authenticates via a customer-managed Microsoft Entra service principal using Tenant ID, Client ID, and Client Secret.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Supports independently enabled capabilities for Azure Kubernetes Service runtime, Azure Container Apps runtime, and Azure Container Registry image inventory — each validated, enabled, renamed, or removed without deleting the base connection. • Adds optional team synchronisation from Microsoft Entra ID groups using Microsoft Graph application permissions `GroupMember.Read.All` and `User.Read.All` with tenant admin consent. • Container Registry capability imports repository, image digest, and manifest inventory from authorised Azure Container Registries using `Reader` plus data-plane read access. • Kubernetes Service capability imports running-container context for AKS and uses Defender for Cloud security resource data, requiring `Reader` and `Security Reader` roles on each scoped subscription. • Container Apps capability imports Azure Container Apps runtime inventory with `Reader` role on each scoped subscription. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/phoenix-security https://kb.phoenix.security/?ht_kb=integration-with-aws-connector https://kb.phoenix.security/?ht_kb=integration-with-aws-connector Wed, 14 Oct 2026 15:43:22 GMT Phoenix Security adds an AWS connector to ingest ECR images, ECS tasks, and EKS telemetry directly into its risk platform.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds an Amazon Web Services connector (configured via Integrations › Connectors › Amazon Web Services) that authenticates with an IAM `Access Key ID` and `Secret Access Key` to pull container inventory from a specified AWS `Region`.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds a `Detect Base Images From Image Layers` option for the ECR capability (also requiring `ecr:BatchGetImage` and `ecr:GetDownloadUrlForLayer`) to identify each image's base image from its layer data. • Adds a `Max New Images To Inspect Per Run` setting for the ECR capability to cap how many new images are inspected on each collection cycle. • Adds an Elastic Container Service (ECS) capability requiring `ecs:ListClusters`, `ecs:ListTasks`, and `ecs:DescribeTasks` permissions to enumerate every running task across all ECS clusters in the connector's region. • Adds an Elastic Kubernetes Service (EKS) Telemetry capability requiring `eks:ListClusters`, `eks:DescribeCluster`, `logs:StartQuery`, and `logs:GetQueryResults` permissions to query each cluster's Container Insights log group for the last 24 hours. • Supports multi-region and multi-account coverage by creating one connector per AWS region or account. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/phoenix-security https://kb.phoenix.security/?ht_kb=rapid7-insightvm-platform-integration https://kb.phoenix.security/?ht_kb=rapid7-insightvm-platform-integration Tue, 15 Sep 2026 15:49:58 GMT Phoenix Security adds native integration with Rapid7 InsightVM SaaS platform for vulnerability ingestion.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds Rapid7 InsightVM (SaaS/cloud) as a new scanner integration, configurable via Integrations > Scanners > 'Add Scanner Integration' with a Server URL in the form `https://{region}.api.insight.rapid7.com/`, API Username, and Password.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ Full history on Cyber Toolchain: https://cybertoolchain.io/tools/phoenix-security https://kb.phoenix.security/?ht_kb=importing-with-rest-api https://kb.phoenix.security/?ht_kb=importing-with-rest-api Thu, 04 Jun 2026 16:15:20 GMT Phoenix adds REST and V5 PUB APIs for importing vulnerability reports from 200+ scanners into assessments. • Adds `POST /v1/import/assets/file/translate` endpoint to upload raw scanner report files directly for translation and import into Phoenix assessments • Introduces the V5 PUB Loading Script toolkit (`phoenix_multi_scanner_enhanced.py`) for client-side translation of 200+ scanner formats including Grype and Trivy before bulk upload via `POST /v1/import/assets` • Adds support for three import modes (`new`, `merge`, `delta`) allowing full baselining, incremental updates, or partial delta imports of assets and findings • Extends asset type detection in V5 translators to map Grype/Trivy outputs to `CONTAINER`, `INFRA`, `CLOUD`, `REPOSITORY`, and `BUILD` categories based on report structure Full history on Cyber Toolchain: https://cybertoolchain.io/tools/phoenix-security https://kb.phoenix.security/?ht_kb=asset-deletion-lifecycle-guidance https://kb.phoenix.security/?ht_kb=asset-deletion-lifecycle-guidance Thu, 28 May 2026 12:53:31 GMT Phoenix Security adds Lifecycle Configurations for automated asset/finding purging and Delta import support via REST API. • Adds `Lifecycle Configurations` section under Settings > Organization Settings to automate garbage collection of scanner findings and assets. • Enables `automated deletion` setting in the Scanner Targets table to purge missing targets after a custom number of days. • Supports `Delta` import type for REST API and Multi-Scanner Import Tool to add/update assets without closing existing ones. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/phoenix-security https://kb.phoenix.security/?ht_kb=integration-with-detectify https://kb.phoenix.security/?ht_kb=integration-with-detectify Fri, 30 Jan 2026 10:37:21 GMT Phoenix Security adds Detectify scanner integration for asset and vulnerability ingestion • Adds a new `Detectify` scanner template under `Integrations > Scanners > WEB scanners` to ingest vulnerabilities and assets from Detectify. • Adds `Finding Status to Fetch` selection during integration setup to filter findings by Accepted Risk, False Positive, or Patched status. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/phoenix-security https://kb.phoenix.security/?ht_kb=integration-with-polaris-platform-saas https://kb.phoenix.security/?ht_kb=integration-with-polaris-platform-saas Fri, 23 Jan 2026 11:45:51 GMT Adds Polaris Platform SAST integration via new 'Polaris Platform' scanner template and API secret configuration in Phoenix Security • Adds a new 'Polaris Platform' scanner template under Integrations > Scanners > SAST scanners for importing assets and vulnerabilities from Polaris Platform. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/phoenix-security https://kb.phoenix.security/?ht_kb=integration-with-orca https://kb.phoenix.security/?ht_kb=integration-with-orca Thu, 22 Jan 2026 10:52:22 GMT Phoenix Security adds native integration with Orca Security scanners for asset and vulnerability data ingestion. • Adds `Orca` scanner template under Integrations > Scanners to ingest assets and vulnerabilities from Orca Security accounts. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/phoenix-security