Runbook for a critical vulnerability currently present in an external-facing image — the immediate detection tier. This fires as soon as trivy-operator reports the vuln, before the 1-week persistence check (13-trivy-critical-vulnerability-1w) kicks in.

Meaning

Same metric and scope as 07-kubernetes/13-trivy-critical-vulnerability-1w.md but without the offset 1w persistence check — this alert fires the moment a critical vuln appears in an external-facing image. The count by (image_repository, image_tag, k8s_cluster_name, environment, exported_namespace) produces one alert per image per tenant, with {{ $value }} = the number of distinct critical vulnerabilities. The inner max by (... vuln_id ...) deduplicates across containers (main and init).

The DataDog monitor this replaces used max:trivy.trivy_vulnerability_id{...} > 1, a threshold that could never fire (the gauge is 0/1, so the max is 1). The migrated alert uses count by to produce one alert per image per tenant, filtering with > 0 so it actually detects new critical vulns without per-CVE alert noise.

The 5 Trivy alert tiers

Alert	Severity	Priority	`for`	Offset	Runbook
`TrivyCriticalVulnerabilityImmediate`	warning	3	2h	—	this file (18)
`TrivyCriticalVulnerabilityOneWeek`	critical	2	2h	1w	`13-trivy-critical-vulnerability-1w`
`TrivyCriticalVulnerabilityFourWeeks`	critical	1	2h	4w	`14-trivy-critical-vulnerability-4w` (SLO breach)
`TrivyHighVulnerabilityOneWeek`	warning	3	2h	1w	`15-trivy-high-vulnerability-1w`
`TrivyHighVulnerabilitySixWeeks`	critical	1	2h	6w	`16-trivy-high-vulnerability-6w` (SLO breach)

Impact

A known-critical CVE is present in an external-facing service. If the service is internet-reachable, this is an active security exposure. The vuln is new (no persistence yet) — it may be fixed in the next image rollout. This alert is the early-warning triage tier; the 1-week alert (13) is the actionable escalation.

Diagnosis

See 07-kubernetes/13-trivy-critical-vulnerability-1w.md § Diagnosis — same metric, labels, and lookup process.

Mitigation

See 07-kubernetes/13-trivy-critical-vulnerability-1w.md § Mitigation. For this immediate tier, triage the CVE: check exploitability and whether a fixed image is available. If the vuln persists past 1 week, 13 escalates to critical.

Verify

See 07-kubernetes/13-trivy-critical-vulnerability-1w.md § Verify. The alert clears once trivy re-scans a fixed image and the last_over_time(...[1h]) series for the old image_tag/vuln_id disappears.

Notes

Immediate tier — no offset; fires on current presence only. The max by (...) dedups per vuln/image/cluster.
DataDog threshold — the original > 1 could never fire (0/1 gauge). Migrated to > 0 for actual detection.
See 07-kubernetes/13-trivy-critical-vulnerability-1w.md Notes for scope, scrape interval, and store-gateway dependency details.