Trivy High Vulnerability Six Weeks

Runbook for a high vulnerability that has persisted in an external-facing image for more than 6 weeks — the high-vuln remediation SLO has been breached. This is the escalation tier of 15-trivy-high-vulnerability-1w.

Meaning

Same as 15-trivy-high-vulnerability-1w but with offset 6w — the vulnerability was present 6 weeks ago AND is present now, meaning it has survived a full 6 weeks without remediation. The 6-week window is the high-vuln remediation SLO; this alert means the SLO is breached.

Impact

A known high-severity CVE has been present in an external-facing service for over 6 weeks. The SLO is breached — this is a priority-1 alert despite the vuln being "high" (not critical), because the remediation window has elapsed.

Diagnosis

See 07-kubernetes/13-trivy-critical-vulnerability-1w.md § Diagnosis. To confirm the 6-week age, use offset 6w in the Mimir query.

Mitigation

See 07-kubernetes/13-trivy-critical-vulnerability-1w.md § Mitigation. This is a priority-1 alert — remediate immediately.

Verify

See 07-kubernetes/13-trivy-critical-vulnerability-1w.md § Verify.

Notes

• SLO breach — the high-vuln remediation SLO is 6 weeks. This alert fires when the SLO is breached.
• Escalation of 15-trivy-high-vulnerability-1w (same expr, offset 6w instead of offset 1w).
• See 07-kubernetes/13-trivy-critical-vulnerability-1w.md Notes for scope, scrape interval, and store-gateway dependency details.