Top Work Items

Overview

The Top work items page helps you quickly understand the work items that reduce the greatest risk to your cloud environment. The page divides your risks into these categories:

Top risky hosts - Hosts that have critical vulnerabilities and are exposed to the internet directly or through another internet-exposed host that has critical vulnerabilities. The difference between the top risky hosts and the hosts listed on the Host vulnerabilities page is that Lacework has determined that there is an attack path from the internet to the top risky hosts.
Top risky container images - Container images that have critical vulnerabilities and are exposed to the internet directly or through another internet-exposed host that has critical vulnerabilities. The difference between the top risky container images and the images listed on the Container vulnerabilities page is that Lacework has determined that there is an attack path from the internet to the top risky container images.
Top risky paths with exposed secrets - Secrets detected on hosts that have critical vulnerabilities and are exposed to the internet directly or through another internet-exposed host that has critical vulnerabilities.
To detect secrets, you must enable Agentless workload scanning. See Attack Path Secrets Detection for information on the types of secrets that are detected by Agentless workload scanning.
Top risky data assets - Data assets that are exposed to the internet directly or are accessible by hosts that are exposed to the internet and have critical vulnerabilities.
Top risky paths with admin privilege role - Admin privilege roles exposed via hosts with critical vulnerabilities.

Lacework generates an attack path if critical vulnerabilities are associated with a host instance or container image.

View Attack Paths

Visit the Top work items page when you want to see the highest priority risks to address.

Use the filters if you want to display a specific set of attack paths. By default, the top risky tables display all attack paths sorted by path severity in descending order.
Browse the tables and locate any attack paths that you want to investigate, such as those with critical path severity.
For risky hosts and container images, the tables include the following additional information:
- The number of vulnerabilities detected on the attack path. Expand the value to see the list of detected vulnerabilities and their details.
- The attack path's vulnerability details in a vulnerabilities context. Click the view vulnerability details icon to open the Host vulnerabilities or Container vulnerabilities page filtered to specific asset.
Click the attack path icon to () to view the Path investigation page filtered to the specific asset identifier. The Path investigation page contains the Exposure Polygraph and contextualized information about individual nodes in the attack path.

When the page displays your desired work items, click Save or Create view in the top right corner. This allows you to access the saved view later. You can also copy the link to a saved view by opening the list of saved views and clicking the Share view icon of the view you want to share. You can then send that link to others so they can see the same view. For more details about saved views, refer to Views Management.