Artifact Analysis は、ソフトウェア構成分析、メタデータの保存、取得を提供するサービス ファミリーです。検出ポイントは、Artifact Registry や Google Kubernetes Engine（GKE）などの多数の Google Cloud プロダクトに組み込まれており、迅速に有効化できます。このサービスは、 Google Cloudのファーストパーティ プロダクトと連携し、サードパーティのソースからの情報を保存することもできます。スキャンサービスは一般的な脆弱性ストアを利用してファイルを既知の脆弱性と照合します
このサービスは以前、Container Analysis と呼ばれていました。新しい名前は既存のプロダクトや API を変更するものではありませんが、コンテナ以外にも拡張されたプロダクトの機能範囲を反映したものです。
Artifact Analysis は、 Google Cloudリソースの構造化メタデータの保存と取得ができる Google Cloud インフラストラクチャ コンポーネントです。リリース プロセスのさまざまな段階で、アクティビティの結果を記述するメタデータを人の手や自動システムによって追加できます。たとえば、統合テストスイートまたは脆弱性スキャンに合格したことを示すメタデータをイメージに追加できます。
Artifact Analysis を CI / CD パイプラインに統合すると、そのメタデータに基づいて意思決定を行うことができます。たとえば、Binary Authorization を使用して、信頼できるレジストリからの準拠イメージに対してのみデプロイを許可するデプロイ ポリシーを作成できます。
[[["わかりやすい","easyToUnderstand","thumb-up"],["問題の解決に役立った","solvedMyProblem","thumb-up"],["その他","otherUp","thumb-up"]],[["わかりにくい","hardToUnderstand","thumb-down"],["情報またはサンプルコードが不正確","incorrectInformationOrSampleCode","thumb-down"],["必要な情報 / サンプルがない","missingTheInformationSamplesINeed","thumb-down"],["翻訳に関する問題","translationIssue","thumb-down"],["その他","otherDown","thumb-down"]],["最終更新日 2025-03-10 UTC。"],[[["\u003cp\u003eArtifact Analysis provides software composition analysis, metadata storage, and retrieval, extending beyond containers to various software artifacts.\u003c/p\u003e\n"],["\u003cp\u003eAutomatic scanning is triggered upon pushing new images to Artifact Registry, with continuous updates for newly discovered vulnerabilities and support for application language package scanning.\u003c/p\u003e\n"],["\u003cp\u003eGKE offers both standard and advanced vulnerability scanning tiers, with the latter including continual language package vulnerability detection, which can be manually enabled per cluster.\u003c/p\u003e\n"],["\u003cp\u003eOn-demand scanning allows for manual scans of images without needing to push them to a registry, but results are not continually updated and are available only up to 48 hours after the scan.\u003c/p\u003e\n"],["\u003cp\u003eMetadata, such as test results or vulnerability scan outcomes, can be stored and retrieved through Artifact Analysis to make informed decisions during the CI/CD pipeline, including defining deployment policies with Binary Authorization.\u003c/p\u003e\n"]]],[],null,["# Artifact analysis and vulnerability scanning\n\nArtifact Analysis is a family of services that provide software\ncomposition analysis, metadata storage and retrieval. Its detection points are\nbuilt into a number of Google Cloud products such as Artifact Registry and\nGoogle Kubernetes Engine (GKE) for quick enablement. The service works with\nboth Google Cloud's first-party products and also lets you store\ninformation from third-party sources. The scanning services use a common\nvulnerability store for matching files against known vulnerabilities.\n\nThis service was formerly known as Container Analysis. The new name does not\nchange existing products or APIs, but reflects the product's expanding range of\nfeatures beyond containers.\n\n**Figure 1.** Diagram that shows Artifact Analysis creating and interacting\nwith metadata across source, build, storage, deployment and runtime\nenvironments.\n\nRegistry scanning\n-----------------\n\nThis section outlines Artifact Analysis vulnerability scanning\nfeatures based in Artifact Registry, and lists related Google Cloud\nproducts where you can enable complementary capabilities to support your\nsecurity posture.\n\n### Automatic scanning in Artifact Registry\n\n- The scanning process is triggered automatically every time you push a new image to Artifact Registry. The vulnerability information is continuously updated when new vulnerabilities are discovered. Artifact Registry includes application language package scanning. To get started, enable [automatic scanning](/artifact-analysis/docs/os-overview).\n\n### Centralized risk management with Security Command Center\n\n|\n| **Preview**\n|\n|\n| This product or feature is subject to the \"Pre-GA Offerings Terms\" in the General Service Terms section\n| of the [Service Specific Terms](/terms/service-terms#1).\n|\n| Pre-GA products and features are available \"as is\" and might have limited support.\n|\n| For more information, see the\n| [launch stage descriptions](/products#product-launch-stages).\n\n- Security Command Center centralizes your cloud security, offering vulnerability scanning, threat detection, posture monitoring, and data management. Security Command Center aggregates vulnerability findings from Artifact Registry scans, allowing you to view container image vulnerabilities within your running workloads, across all projects alongside your other security risks in Security Command Center. You can also export these findings to BigQuery for in-depth analysis and long-term storage. For more information, see [Artifact Registry vulnerability assessment](/security-command-center/docs/concepts-security-sources#ar-vuln-assessment).\n\n### GKE workload vulnerability scanning - standard tier\n\n| **Caution:** Starting on July 23, 2024, standard tier/container OS vulnerability scanning is deprecated and is scheduled for shutdown on July 31, 2025. For more information about deprecation and shutdown dates, see [Vulnerability scanning removal from GKE](/kubernetes-engine/docs/deprecations/vulnerability-scanning-gkee).\n\n- As part of GKE security posture dashboard, workload vulnerability scanning provides detection of container image OS vulnerabilities. Scanning is free and can be enabled per cluster. Results are available to view in the [security posture dashboard](/kubernetes-engine/docs/concepts/about-security-posture-dashboard).\n\n### GKE workload vulnerability scanning - advanced vulnerability insights\n\n| **Caution:** Starting on June 16, 2025 Advanced Vulnerability Insights is deprecated and is scheduled for shutdown on June 16, 2026 as part of the deprecation of various GKE security posture dashboard features. For more information about deprecation and shutdown dates, see [Vulnerability\n| scanning removal from GKE](/kubernetes-engine/docs/deprecations/vulnerability-scanning-gkee).\n\n- In addition to basic container OS scanning, GKE users can upgrade to *advanced vulnerability insights* to take advantage of continual language package vulnerability detection. You must manually enable this feature on your clusters, after which you'll receive OS and language package vulnerability results. Learn more about [vulnerability scanning in GKE workloads](/kubernetes-engine/docs/how-to/security-posture-vulnerability-scanning).\n\nOn-Demand scanning\n------------------\n\n- This service is not continual; you must run a command to manually initiate the scan. Scan results are available up to 48 hours after the scan is completed. The vulnerability information is not updated after the scan is finished. You can scan images stored locally, without having to push them to Artifact Registry or GKE runtimes first. To learn more, see [on-demand scanning](/artifact-analysis/docs/os-scanning-on-demand).\n\nAccess metadata\n---------------\n\n- Artifact Analysis is a Google Cloud infrastructure\n component that lets you\n [store and retrieve structured metadata](/artifact-analysis/docs/metadata-management-overview) for Google Cloud\n resources. At various phases of your release process, people or automated\n systems can add metadata that describes the result of an activity. For\n example, you can add metadata to your image indicating that the image has\n passed an integration test suite or a vulnerability scan.\n\n- With Artifact Analysis integrated into your CI/CD pipeline, you\n can make decisions based on metadata. For example, you can use\n [Binary Authorization](/binary-authorization/docs) to create deployment policies\n that only allow deployments for compliant images from trusted registries.\n\n- Artifact Analysis associates metadata with images through **notes** and\n **occurrences** . To learn more about these concepts, see the\n [metadata management page](/artifact-analysis/docs/metadata-management-overview).\n\nTo learn about using Artifact Analysis for metadata management, and\ncosts for the optional vulnerability scanning service, see the\n[Artifact Analysis documentation](/artifact-analysis/docs)."]]
