JFrog Xray Scan Results

Course Level: Intermediate

Requirements: Working knowledge of JFrog Xray and familiarity with how your organization's security policies and CI/CD pipelines are configured.

Prerequisites: None. Completion of JFrog Xray Overview, JFrog Xray Policies and Watches and JFrog Xray Indexing or equivalent hands-on experience with Xray is helpful but not required.

Course Description:
Most teams open a scan result and head straight for the Vulnerabilities tab and that's the wrong place to start. This course gives you a complete, repeatable framework for working with JFrog Xray scan results: how to read the signal Xray has already filtered for you, how to triage efficiently every time, and how to close the loop from scan to fix to evidence.

Topics Covered:

• Understanding Scan Output: How Xray produces three distinct layers such as SBOM, Vulnerabilities, and Policy Violations and why only one of them is your daily action list.
• Triage Workflow: A consistent, step-by-step process for navigating any scan result across any resource type, starting with malicious packages and working through to policy violations.
• Reading Violations & Ignore Rules: Interpreting violation details, applying scoped and time-limited Ignore Rules with justification, and knowing when suppression is the right call.
• Version Comparisons: Using Versions Diff and the Builds Security Overview to confirm fixes landed, catch newly introduced risk, and track improvement over time.
• Exporting & Reporting: Choosing the right export format such as PDF, CSV, JSON, SPDX, or CycloneDX, for the right audience: legal, security, developers, and management.
• Zero-Day Response: Using Impact Search to map your full exposure across all indexed resources in minutes, prioritize by policy violations, and communicate a decision-ready summary to stakeholders.