Build VSS vulnerability scanning configurations for host, port, and container image scans.
Last verified: May 2026
Build VSS vulnerability scanning configurations for host, port, and container image scans.
Required Fields
compartmentIddisplayNamescanRecipe.scanTypescanTargetsOutput will appear here...Build VSS vulnerability scanning configurations for host, port, and container image scans. This tool helps OCI engineers generate valid configurations quickly without consulting documentation, reducing errors and accelerating infrastructure deployment. All processing runs in your browser with no data sent to external servers.
Your security team needs continuous vulnerability detection across the OCI fleet. The builder generates: host scan recipe (CVE detection on installed packages), port scan recipe (TCP+UDP, all common ports), schedule weekly scans on all production compartments, results forward to Cloud Guard. Within the first scan cycle, the team discovers 3 VMs with unpatched OpenSSL vulnerabilities (CVE-XXXX) and 2 VMs with unintentionally exposed databases. Patches deployed within 24 hours; without VSS, these would have been undetected until exploited.
OCI VSS host scanning is FREE for OCI Compute instances — a major cost advantage over AWS Inspector ($0.09/scan). Enable host scanning on every production VM with no cost concern; Vulnerabilities are reported into Cloud Guard for centralized risk management.
Container image scanning catches vulnerabilities BEFORE deployment. Configure scanning on Container Registry repositories so every new image is automatically scanned. Combine with Binary Authorization to prevent deploying images with critical vulnerabilities.
Port scanning identifies unintended exposed services. Run weekly port scans across your VCN; the report surfaces 'this VM has 3306 open to the internet' findings that often slip past security reviews. The cost is negligible; the security value is enormous.
The builder constructs OCI VSS scanning configurations: scan recipes (host scan recipe with vulnerability database, port scan recipe with port range and protocol selection, agent-based vs agentless scanning mode), target compartments (which compartments to scan), scan schedule (recurring or one-time), and report destination (Cloud Guard integration for centralized risk view). Output is generated as oci vulnerability-scanning commands and Terraform oci_vulnerability_scanning_* resources.
Was this tool helpful?
Disclaimer: This tool runs entirely in your browser. No data is sent to our servers. Always verify outputs before using them in production. AWS, Azure, and GCP are trademarks of their respective owners.