Skip to main content
Ankra can email a recurring security report for a cluster - a snapshot of its vulnerability posture drawn from the Security Center. Reports run on a weekly or monthly schedule, go to a recipient list you control, and can also be sent immediately.

​
What the report contains

The report reflects the same data as the cluster’s Security view: actionable findings by severity, and how the posture has moved since the previous report. Findings on the CISA Known Exploited Vulnerabilities catalog get their own banner and a KEV marker in the top-CVE table, with the FIRST EPSS exploitation probability where the platform holds one; package upgrades that clear a known-exploited CVE are listed first under Fix these first. Accepted risk is excluded from actionable counts - the report is built for the people who need to know what still requires attention, not for restating everything Trivy has ever observed.

​
Prerequisites

  • The cluster has the Trivy Operator integration installed and producing reports. If the scanner state is not_installed or installed_no_reports, there is no data to report on.
  • Access to the cluster’s settings.

​
Schedule a report

1

Open the cluster's settings

Open the cluster in Ankra, go to its settings, and choose Integrations.
2

Schedule the security report

Open the security report scheduling options and choose a weekly or monthly cadence.
3

Add recipients

Enter the email addresses that should receive the report. Recipients do not need to be Ankra users.
4

Save

Save the schedule. The report is generated and emailed on the chosen cadence from now on.
Report scheduling is also offered from the cluster’s Security view, as a secondary action next to the scanner status.

​
Send a report now

Next to the schedule there is a send-now action that emails the current report to the configured recipients immediately. Use it to verify delivery after setting up a schedule, or to share the current posture ahead of a review without waiting for the next scheduled run. From the CLI and MCP. ankra security report-schedule --cluster <cluster> shows the stored schedule (or “not configured”), ankra security report-schedule set --cluster <cluster> --frequency weekly|monthly --recipient [email protected] --recipient [email protected] [--disabled] creates or replaces it after asking (--yes skips the prompt; --disabled stores it paused), and ankra security report-schedule send --cluster <cluster> queues one report now. From chat or the MCP server the same three are get_cluster_security_report_schedule, set_cluster_security_report_schedule and send_cluster_security_report_now; the two writes are confirmed before they run and need clusters.write. With an API token the routes are GET/PUT /api/v1/org/clusters/imported/{cluster_id}/security/report-schedule and POST .../report-schedule/send-now.

​
Troubleshooting

Cluster Security

The Security Center the report draws from.

Alerts

Threshold-based notifications instead of a scheduled summary.