Skip to main content

ASPM v1.6.2

I. Highlights​

FPT Smart Cloud expands the SBOM Inventory module in AppSec v1.6.2 as part of the FPT Security Platform (FSP).

This release extends SBOM data collection to 3 asset types — Source Code, Container Image, and VM (Virtual Machine) — with VM data collected via Agentless Scan without requiring an agent on the virtual machine. A new Vulnerabilities tab on SBOM Inventory aggregates all CVEs across the full SBOM for CVE-first risk analysis, with drill-down into a new CVE Detail screen showing affected components and assets. The Affected Assets tab in Component Detail is also updated with Context and Asset Type columns and full VM support via Agentless Scan.

II. Released Features​

1. SBOM Inventory — Tab Vulnerabilities (New)​

a. Description​

The SBOM Inventory screen now shows two parallel tabs: Components (from v1.5.1, unchanged) and Vulnerabilities (new). The Vulnerabilities tab aggregates all CVEs detected across the team's full SBOM — allowing AppSec teams to approach risk from a CVE-first perspective without navigating each component individually.

b. Features​

  • Displays all CVEs with: Severity (CVSS score), CVE ID, Description (Reference link), Fixed In, Exploited In The Wild, Public PoC, Affected Components count, Affected Assets count
  • Filters by Severity, Exploitation status, Public PoC
  • Search by CVE ID or description
  • Sort by Severity Score (default DESC), Affected Components, Affected Assets
  • Click CVE ID → navigate to new CVE Detail screen

c. Capacity​

  • Aggregates CVEs from the entire SBOM scan for the selected team
  • Covers all 3 asset types: Source Code, Container Image, VM (Agentless Scan)
  • Filters and search apply with AND logic; pagination: 10 / 25 / 50 / 100 per page

2. CVE Detail — Affected Components & Affected Assets (New)​

a. Description​

Clicking a CVE ID in the Vulnerabilities tab navigates to the new CVE Detail screen: which components are affected, whether a fix is available, and which assets (including VMs) contain those components. Two tabs: Affected Components (default) and Affected Assets.

b. Features​

CVE Detail header:

  • CVE ID + Severity badge with score
  • Team dropdown: read-only, inherited from SBOM Inventory, preserved when switching tabs
  • ← Back button: returns to SBOM Inventory (Vulnerabilities tab)
  • Tab badge counts: total records — not affected by filters or search

Tab Affected Components (default):

  • Component (Name@Version), Ecosystem, Asset Type, Fixed In
  • Filter by Asset Type (Source Code / Container Image / VM) and Ecosystem
  • Search by component name; sort by Component name ascending (default)

Tab Affected Assets:

  • Asset Name, Context, Asset Type, Integration Type, Last Scanned At
  • Filter by Asset Type and Integration Type; search by asset name
  • Sort by Last Scanned At descending (default)

c. Capacity​

  • Supports 3 asset types: Source Code, Container Image, VM
  • Supports 6 integration types: GitHub / GitLab / GitLab Server / Harbor / FPT Container Registry / Agentless Scan
  • Filters and search apply with AND logic; pagination: 10 / 25 / 50 / 100 per page

3. Component Detail — Updated Affected Assets Tab​

a. Description​

The Affected Assets tab in Component Detail is updated with two new columns — Context and Asset Type — and now includes VMs via Agentless Scan, enabling visibility into component usage across repositories, container images, and virtual machines in one view.

b. Features​

New columns:

ColumnDescription
ContextScan context: branch name (Source Code), image version/tag (Container Image), VPC name (VM)
Asset TypeSource Code / Container Image / VM

New filter: Asset Type (Source Code / Container Image / VM)

Extended support: asset type VM via Agentless Scan + Integration Type Agentless Scan added to filter list

c. Capacity​

  • Supports 3 asset types: Source Code, Container Image, VM
  • Supports 6 integration types: GitHub / GitLab / GitLab Server / Harbor / FPT Container Registry / Agentless Scan
  • Filters and search apply with AND logic