Tasmanian Cloud documentation

Patch reporting

Package findings, remediation state, and delivery paths

Patch reporting turns observed package state into useful customer state. A report SHOULD show the asset, package, severity, scan time, first-seen time, last-seen time, and remediation state.

Host package state flowing through a scan into a patch report and notificationsTasmanian Cloud host package state flowing through a scan into a patch report and notifications.[PATCH REPORTING]HOSTpackage stateSCANfinding and ageREPORTwebhook or emailKeep the boundary explicit. Let each system do the work it is good at.

Host and image findings

Host package scanning describes the operating system packages on a VM or node. Image scanning describes the packages that enter a container when an image runs. One scan MUST NOT be presented as proof of the other.

Act on a finding

A finding can remain open, be acknowledged, or be connected to a reconfigure run. The API keeps the finding available for a trust-centre view, an internal dashboard, or a reconciliation service.

Delivery

Use webhooks for remediation automation, email for scheduled reports, and an ntfy-compatible provider for urgent operational signals. A delivery failure MUST NOT change the health state of the workload.

Scope

A report describes observed state at a scan time. It is not an SLA, certification, or claim that every dependency is safe. The customer can use the evidence to choose the remediation path that fits the workload.

Related