Arena view

Edit online

The Arena view provides an interactive, topological representation of your applications and associated components, including source code repositories, images, environments, and access points. Using the toggles, you can overlay various dimensional data — such as prioritized common vulnerabilities and exposures (CVEs), compliance assessments, and certificates — to understand their impact across your application lifecycle.

Screen shot of Arena view with all dimension toggles enabled to show all data. Data is represented as a colorful, topological view of your application and environment components, overlay with dimensional data, including: prioritized CVEs, prioritized exposures, low compliance assessments, and certificates which can be toggled on an off.

The ability to view and interact with your application topology this way helps application owners and site reliability engineers (SREs) to understand dependencies across the application lifecycle and assess the impact and priority of identified risks and operational issues.

Populating the Arena view

After uploading application and environment data through a software bill of materials (SBOM) upload or direct connection with external tools and services, you can see a topological view of your application and environment components in the Arena view. This foundational view includes the following objects from your inventory:

Repositories (source code)
Images
Applications
Environments
Public access points
Private access points

Screen shot of the Arena view with no dimensional toggles enabled, showing a topological view of ingested application and environment components.

You can use any of the following methods to populate the Arena view with your application and environment data:

Use the Concert toolkit to generate, validate, and import data automatically through your CI/CD pipeline. (Recommended)
Configure data ingestion jobs to import components from your third-party tools and services that you can use to define your applications and environments.
Upload application, build, and deploy SBOM files in Concert-defined (ConcertDef) format using the Concert UI or API.

Note: You must upload all three (application, build, and deploy) Concert-defined SBOM types to populate a complete view of your application and environment topology in the Arena view.

After importing your inventory data, you can import data related to the various dimensions using the same methods as importing application and environment data. The following table explains each type and source of dimensional data that appears in the Arena view.

Table 1. Dimensional data toggles in the Arena view
Toggle	Description
Priority 1 CVEs	Toggle on to display high priority CVEs impacting your application images and repositories. Concert ingests uploaded vulnerability (CVE) scans of your images, repositories, or runtimes and prioritizes CVEs based on the assessed risk score.
Priority 1 exposures	Toggle on to display high priority static or dynamic non-CVE exposures impacting your application and environment components. Concert ingests uploaded vulnerability (DAST or SAST) scans and prioritizes these vulnerabilities based on their scope of impact.
Low compliance assessments	Toggle on to display compliance assessments with which the assessed environment received a low compliance score, indicating a higher compliance-related risk. After you create a compliance profile using controls from one or more catalogs, Concert ingests uploaded compliance scans and assesses the compliance level of each environment.
Expired certificates	Toggle on to display the access points associated with your expired digital certificates. Concert ingests uploaded certificate data and helps you track and address expiring certificates before they impact the availability of your applications.

Upload a CVE vulnerability scan in one of the supported formats to assess prioritized CVEs impacting your application components.

Screenshot of Arena view with Priority 1 CVEs toggle enabled, showing the impact of CVEs against on application and environment components

Upload a static (SAST) or dynamic (DAST) vulnerability scan to highlight exposures to your source code or environment access points.

Screenshot of Arena view with Priority 1 exposures toggle enabled, showing the impact of static and dynamic exposures against on application and environment components.

Upload a compliance scan to highlight the compliance level of the assessed environments.

Screenshot of the Arena view, with Low compliance assessments toggled on to show the environments associated with each compliance assessment

Upload your digital certificate data to understand the impact on your environment access points.

Screenshot of Arena view with Expired certificates toggled on to show the environments associated with each expired certificates

Interacting with the Arena view

Each node in the Arena view represents an individual object or component. For example, the following image shows seven node representing the seven applications defined in the Concert instance.

Screenshot of Arena view showing a close-up of the application topology view, focusing on the blue nodes representing application definitions in your Concert inventory.

Each node represents the relative number of associated or impacted components. Hovering over a node provides more details about that object and highlights the specific associations across the topology.

Clipped screen shot of the Arena view, focusing on a node representing an application definition. The cursor is hovering over a node, displaying the application name and version.

Clicking a node has varying behavior depending on the type of node you select:

Clicking an image or repository displays additional details, including associated applications, packages, and prioritized CVE findings.
Clicking an application or environment redirects you to the relevant details page in your Inventory .
Clicking a CVE or exposure redirects you to the Vulnerability dimension, providing details for the selected CVE, including an Impact view with a more granular view of the components impacted by this CVE.
Clicking a certificate displays a more granular Impact view for the selected certificate.
Clicking a compliance assessment displays more detailed scan results, including the assessed environment, relevant compliance profile and controls, and the calculated compliance level and score based on the number of passed versus total controls.