[Yandex Cloud documentation](../../../index.md) > [Yandex Cloud Registry](../../index.md) > [Step-by-step guides](../index.md) > Managing a registry > Scanning a registry

# Scanning a Cloud Registry

Registries are scanned using our [Vulnerability Management (VM)](../../../security-deck/concepts/vulnerability-management.md). You can configure scanning:
* In the Yandex Security Deck interface. To do this, click **Open Security Deck** and follow [this guide](../../../security-deck/operations/vulnerability-management/enable-vulnerability-management.md).
* In the Cloud Registry interface by following this guide.

{% note info %}

You can only configure scanning for local and remote Docker registries. Only Docker images stored in the Cloud Registry cache are scanned in remote registries.

{% endnote %}

{% note warning %}

Scanning is not free of charge. For more information, see the [Yandex Security Deck pricing policy](../../../security-deck/pricing.md#prices).

{% endnote %}

## Automatic scanning {#auto}

You can configure settings for automatically scanning artifacts in the registry. You can also set up automatic scanning when [creating a registry](create.md).

{% list tabs group=instructions %}

- Management console {#console}

    1. In the [management console](https://console.yandex.cloud), select the [folder](../../../resource-manager/concepts/resources-hierarchy.md#folder) where the registry is located.
    1. Navigate to **Cloud Registry**.
    1. In the left-hand panel, select ![shapes-4](../../../_assets/console-icons/shapes-4.svg) **Registries**.
    1. Select the registry.
    1. Navigate to the **Vulnerability scanner** tab.
    1. Click **Configure scanner**.
    1. Optionally, enable **Scan language packages** under **Language package scanning**.
    1. Optionally, expand **Scanning artifacts when adding to the registry** and select:

        * `All artifacts` to scan all artifacts when pushing to the registry.
        * `Only selected` to specify the artifacts to scan when pushing to the registry. Click **Add artifacts**, select artifacts, and click **Add**.

    1. Optionally, expand **Periodic artifact scanning** and select:

        * `All artifacts` to scan all artifacts in the registry at specified intervals.
        * `Only selected` to specify which artifacts to scan at specified intervals. Click **Add artifacts**, select artifacts, and click **Add**.

        Specify the artifact scan interval.

    1. Click **Save**.

- CLI {#cli}

    If you do not have the Yandex Cloud CLI yet, [install and initialize it](../../../cli/quickstart.md#install).

    The folder used by default is the one specified when [creating](../../../cli/operations/profile/profile-create.md) the CLI profile. To change the default folder, use the `yc config set folder-id <folder_ID>` command. You can also specify a different folder for any command using `--folder-name` or `--folder-id`.
    
    If you access a resource by its name, the search will be limited to the default folder. If you access a resource by its ID, the search will be global, i.e., through all folders based on access permissions.

    1. See the description of the CLI command for creating an automatic scan policy:

        ```bash
        yc cloud-registry registry scan-policy create --help
        ```

    1. Create a JSON file with scan rules, e.g., `scan-rules.json`:

        ```json
        {
          "pushRule": {
            "paths": ["*"],
            "disabled": false
          },
          "scheduleRules": [
            {
              "amount": "7",
              "intervalUnit": "DAYS",
              "paths": ["*"],
              "disabled": false
            }
          ]
        }
        ```

        Where:

        * `pushRule`: Scan artifacts when pushing to the registry:

            * `paths`: List of paths to the artifacts to scan. To scan all artifacts in the registry, specify `*`.
            * `disabled`: Disable scanning.

        * `scheduleRules`: Scan artifacts in the registry at regular intervals:

            * `amount`: Number of time units in the scan interval.
            * `intervalUnit`: Time unit. The available value is `DAYS`.
            * `paths`: List of paths to the artifacts to scan. To scan all artifacts in the registry, specify `*`.
            * `disabled`: Disable scanning.

    1. Create an automatic scan policy:

        ```bash
        yc cloud-registry registry scan-policy create <policy_name> \
          --registry-id <registry_ID> \
          --description <policy_description> \
          --scan-lang-packages \
          --rules <path_to_file_with_rules>
        ```

        Where:

        * `<policy_name>`: Automatic scan policy name.
        * `--registry-id`: ID of the registry for which you are creating the policy.
        * `--description`: Policy description. This is an optional parameter.
        * `--scan-lang-packages`: Enable language package scanning. This is an optional parameter.
        * `--rules`: Path to the JSON file with scan rules. This is an optional parameter.

- API {#api}

    To create an automatic registry scan policy, use the [create](../../api-ref/ScanPolicy/create.md) REST API method for the [ScanPolicy](../../api-ref/ScanPolicy/index.md) or the [ScanPolicyService/Create](../../api-ref/grpc/ScanPolicy/create.md) gRPC API call.

{% endlist %}

## Scanning manually {#manual}

You can manually start a scan of the selected artifacts in the registry.

{% list tabs group=instructions %}

- Management console {#console}

    1. In the [management console](https://console.yandex.cloud), select the [folder](../../../resource-manager/concepts/resources-hierarchy.md#folder) where the registry is located.
    1. Navigate to **Cloud Registry**.
    1. In the left-hand panel, select ![shapes-4](../../../_assets/console-icons/shapes-4.svg) **Registries**.
    1. Select the registry.
    1. Navigate to the **Vulnerability scanner** tab.
    1. Click **New scan**.
    1. Select the artifacts you want to scan and click **Add**.

- CLI {#cli}

    If you do not have the Yandex Cloud CLI yet, [install and initialize it](../../../cli/quickstart.md#install).

    The folder used by default is the one specified when [creating](../../../cli/operations/profile/profile-create.md) the CLI profile. To change the default folder, use the `yc config set folder-id <folder_ID>` command. You can also specify a different folder for any command using `--folder-name` or `--folder-id`.
    
    If you access a resource by its name, the search will be limited to the default folder. If you access a resource by its ID, the search will be global, i.e., through all folders based on access permissions.

    1. See the description of the CLI command for scanning an artifact:

        ```bash
        yc cloud-registry artifact scanner scan --help
        ```

    1. Get a list of artifacts in the registry:

        ```bash
        yc cloud-registry registry list-artifacts <registry_name_or_ID>
        ```

    1. Start an artifact scan:

        ```bash
        yc cloud-registry artifact scanner scan <artifact_ID>
        ```

- API {#api}

    To start an artifact scan, use the [ScannerService/Scan](../../api-ref/grpc/Scanner/scan.md) gRPC API call.

{% endlist %}