What Radar Shows
VulnerabilityReport Detail View: Severity breakdown (Critical/High/Medium/Low), affected images, and CVE counts. ConfigAuditReport Detail View: Pass/fail checks with severity levels. Resource Browser: Smart columns show severity counts and scan status at a glance. Search (UI, REST/api/search, MCP search): reports are searchable by CVE ID, SBOM component name and version, failed check ID and the scanned image, so CVE-2026-109618 or image:php kind:VulnerabilityReport finds every report that lists it. Severity words and titles are not indexed, and a secret finding’s matched text is never indexed, never exposed to the CEL filter, and redacted from what AI agents receive (MCP get_resource, search with include=raw). The filter binds report to the findings (vulnerabilities, components, checks, secrets without their match) for single-finding predicates such as report.vulnerabilities.exists(v, v.vulnerabilityID == "CVE-2026-109618" && v.resource.contains("php")). The global search UI identifies the matching report; it does not display package versions or workload attribution in the result row. REST and MCP search summaries include the matched finding, package and installed/fixed versions when available, and the workload behind the scanned object; ReplicaSet summaries also include replica count. With Trivy Operator’s default operator.vulnerabilityScannerScanOnlyCurrentRevisions: true, an old ReplicaSet’s reports are deleted after a rollout. With it set to false they stay, and a replica count of 0 usually marks one, though a Deployment scaled to zero also reads 0. A report is evidence about the scanned image at scan time: a CVE published after the last scan is absent until Trivy rescans with an updated database, and runtimes built from source (such as the official php images) are not detected by Trivy at all. With auth enabled, search returns a report only where the user may list that report kind, not wherever they may list Pods. When a search could not cover every report, the results say why: access to some namespaces’ reports couldn’t be confirmed in this search, because its limit on access checks was reached or a check failed (searching again checks more), or the search ran out of time before reading every report’s findings (narrow with ns:).
Resources table: on a report kind’s table, the search box also matches findings: CVE ID with package and versions, SBOM component, failed check ID, secret rule ID and target, and the scanned image. A row that matched only through its findings is tagged in findings, with the finding on hover. Regex mode matches names and namespaces only, and a very large list stops after 200,000 findings and says some weren’t searched.