Creating a List of Vulnerabilities

You can create a static or dynamic list of vulnerabilities and use it while defining exceptions. When the list is specified in an exception, the vulnerabilities included in the list are flagged as the exception.

Go to Exceptions > Lists, and click Create List.
Provide a name to the list and select the list type.
- Static: You can select the specific QIDs from the QIDs listed in the KnowledgeBase.
- Dynamic: The list gets updated automatically as per the latest KnowledgeBase. All newly created or updated QIDs get synced with all Dynamic lists depending on the Criteria of the lists.
Specify the scope for the exception. Currently, only Vulnerability is available as the scope value.
Under Criteria,
- For the Static list, click to add QIDs to the list from the KnowledgeBase. Click Save.
- For the Dynamic list, search the QIDs you want to add to the new list using the supported QQL tokens. Click Validate to validate the selected QID tokens against the KnowlegeBase.
  - Supported QQL Tokens:
    cveIds, cvssInfo.baseScore, cvssInfo.temporalScore, cvssInfo.accessVector, cvss3Info.baseScore, cvss3Info.temporalScore, qid, severity. To know about these tokens, see Search Tokens for Container Security.
  A newly created Dynamic List may take time to populate the QIDs on the QIDs page for the list based on the Criteria passed.
  Do not modify the Criteria until Associated QIDs listed under the List Details page match the QID count on the QIDs page.
Click Save.

The list is saved and added to the Lists tab. If the count of QIDs is high, it might take some time to associate the QIDs with the list.