Managing application vulnerabilities in modern, fast-paced Kubernetes environments can feel like chasing a moving target. Security teams struggle to understand which scan vulnerabilities are actually exposed in production, while SREs want to view security risks without leaving their monitoring dashboards.

The integration between IBM Instana Observability and IBM Concert solves this disconnect. By automatically feeding live application topology and environment details from Instana into Concert, this integration brings critical security context directly to your live system monitoring.

Why Connect Instana and Concert?

When you set up this integration, Concert automatically pulls your Instana application components, Kubernetes clusters, namespaces, container image names, and their operational relationships. By combining Instana's real-time data with Concert's security findings, you gain two major operational advantages:

·       Dynamic Risk Assessment: Concert uses real-time environment configurations to assess CVEs and score them based on their true potential impact on your delivery lifecycle. For instance, a CVE located within a testing tool in your test environment is automatically assigned a lower risk score than one affecting multiple production-level container images. To ensure accuracy, Concert only retrieves applications with live traffic running over a rolling seven-day time frame.

·       Contextual Observability: The Instana CVE sensor polls the Concert API every 6 hours (and updates local findings). This translates Concert's findings into localised CVE detections for each container based on its active image, allowing SREs to spot severe vulnerabilities directly inside their daily monitoring screens.

Note: The integration is designed only for the Kubernetes-based editions of Instana, including Standard, Custom, and SaaS. Docker-based Classic editions of Instana do not support this integration.

The Integration Checklist (How to Set It Up)

Setting up the integration involves a loop to securely bridge your Instana and Concert workspaces. Depending on your deployment model (SaaS vs. Self-Hosted), you can opt for an automatic configuration or a manual configuration.

Path A: Automatic Integration (SaaS Only)

If you run Instana SaaS and have a Concert SaaS instance (or trial) under the exact same account, you can skip manual setup entirely:
1. In the Instana navigation menu, click Instana > Applications.
2. Select any application and go to the Vulnerabilities tab.
3. Click Enable now (this is only available to users with the Instana Owner role).
4. The background process will automatically find your Concert URL, create API keys, set up your Concert environment connection, map ingestion jobs, and deploy the remote agent configuration.

Path B: Manual Integration (SaaS & Self-Hosted)

Step 1: Generate an Instana API Token

From the navigation menu in the Instana UI, click Settings > Security & Access > API Tokens. Click New API Token, provide a unique name (such as Concert), and click Create. Default permissions are sufficient since Concert only requires read-only API access. Copy the token to a secure location.

Step 2: Establish the Connection inside Concert

Log into your Concert UI and navigate to Administration > Integrations > Connections. Click Create connection and select IBM Instana Observability. Enter the Instana API token, and input your host URL in the Endpoint field:
- SaaS: https://<your-tenant-name>-instana.instana.io
- Self-Hosted: https://<unit-name>-<tenant-name>.<instance-url>
Click Validate connection, then click Create.

Step 3: Create a Data Ingestion Job in Concert

Navigate to the Ingestion jobs tab in Concert's Integrations page and click Create ingestion job. Provide a name, set the connection type to Instana, choose the connection created in Step 2, and select your Target environment defined in your Concert inventory. Click Create, then select Run now from the overflow menu.

Step 4: Generate a Concert API Key

To allow Instana to retrieve vulnerability assessments, generate an API key in the Concert UI. Click your Profile > API key, and select Generate API key. Copy this key, along with your instance_id (found inside the key usage example).

Step 5: Configure the Instana CVE Sensor

Open your Instana agent configuration file (<instana-agent-dir>/etc/instana/configuration.yaml) and enable the CVE sensor:

Viewing Vulnerabilities in the Instana UI

Once integrated, security data is democratised across your engineering teams. You can track vulnerabilities through three distinct views in the Instana UI:

The Global Vulnerabilities Page: By selecting Vulnerabilities from Instana's main navigation menu, you can explore security trends environment-wide using the CVEs Tab and the Detections Tab.

Vulnerabilities CVE tab

Vulnerabilities CVE tab details

Vulnerabilities Detections tab

The Application Dashboard: Clicking on Applications, selecting your target application, and clicking the Vulnerabilities tab isolates security risks specifically for the containers running that specific business application.

Application dashboard Vulnerabilities tab

The Container Dashboard: Go to Infrastructure, switch the map view grouping to Container, select any container, and open its dashboard. A dedicated vulnerabilities dropdown menu will list up to 10 of the most severe CVEs affecting that host.

Infrastructure map (Container perspective)

Container dashboard dropdown