Artifact Analysis is a family of services that provide software
composition analysis, metadata storage and retrieval. Its detection points are
built into a number of Google Cloud products such as Artifact Registry and
Google Kubernetes Engine (GKE) for quick enablement. The service works with
both Google Cloud's first-party products and also lets you store
information from third-party sources. The scanning services use a common
vulnerability store for matching files against known vulnerabilities.

This service was formerly known as Container Analysis. The new name does not
change existing products or APIs, but reflects the product's expanding range of
features beyond containers.

![Artifact Analysis in CI/CD](https://docs.cloud.google.com/static/artifact-analysis/images/aa-diagram.png)

**Figure 1.** Diagram that shows Artifact Analysis creating and interacting
with metadata across source, build, storage, deployment and runtime
environments.

## Registry scanning

This section outlines Artifact Analysis vulnerability scanning
features based in Artifact Registry, and lists related Google Cloud
products where you can enable complementary capabilities to support your
security posture.

### Automatic scanning in Artifact Registry

- The scanning process is triggered automatically every time you push a new image to Artifact Registry. The vulnerability information is continuously updated when new vulnerabilities are discovered. Artifact Registry includes application language package scanning. To get started, enable [automatic scanning](https://docs.cloud.google.com/artifact-analysis/docs/os-overview).

### Centralized risk management with Security Command Center

- Security Command Center centralizes your cloud security, offering vulnerability scanning, threat detection, posture monitoring, and data management. Security Command Center aggregates vulnerability findings from Artifact Registry scans, allowing you to view container image vulnerabilities within your running workloads, across all projects alongside your other security risks in Security Command Center. You can also export these findings to BigQuery for in-depth analysis and long-term storage. For more information, see [Artifact Registry vulnerability assessment](https://docs.cloud.google.com/security-command-center/docs/concepts-security-sources#ar-vuln-assessment).

## On-Demand scanning

- This service is not continual; you must run a command to manually initiate the scan. Scan results are available up to 48 hours after the scan is completed. The vulnerability information is not updated after the scan is finished. You can scan images stored locally, without having to push them to Artifact Registry or GKE runtimes first. To learn more, see [on-demand scanning](https://docs.cloud.google.com/artifact-analysis/docs/os-scanning-on-demand).

## Access metadata

- Artifact Analysis is a Google Cloud infrastructure
  component that lets you
  [store and retrieve structured metadata](https://docs.cloud.google.com/artifact-analysis/docs/metadata-management-overview) for Google Cloud
  resources. At various phases of your release process, people or automated
  systems can add metadata that describes the result of an activity. For
  example, you can add metadata to your image indicating that the image has
  passed an integration test suite or a vulnerability scan.

- With Artifact Analysis integrated into your CI/CD pipeline, you
  can make decisions based on metadata. For example, you can use
  [Binary Authorization](https://docs.cloud.google.com/binary-authorization/docs) to create deployment policies
  that only allow deployments for compliant images from trusted registries.

- Artifact Analysis associates metadata with images through **notes** and
  **occurrences** . To learn more about these concepts, see the
  [metadata management page](https://docs.cloud.google.com/artifact-analysis/docs/metadata-management-overview).

To learn about using Artifact Analysis for metadata management, and
costs for the optional vulnerability scanning service, see the
[Artifact Analysis documentation](https://docs.cloud.google.com/artifact-analysis/docs).