openshift · agantony · Aug 6, 2026
diff --git a/architecture/acs-architecture.adoc b/architecture/acs-architecture.adoc
@@ -9,26 +9,72 @@ toc::[]
 [role="_abstract"]
 Discover {rh-rhacs-first} architecture and concepts.
 
+//{product-title} architecture overview
 include::modules/acs-architecture-overview.adoc[leveloffset=+1]
 
 [role="_additional-resources"]
 .Additional resources
 * xref:../architecture/acs-architecture.adoc#external-components_acs-architecture[External components]
 * xref:../operating/examine-images-for-vulnerabilities.adoc#scanner-v4-enabling[Enabling Scanner V4]
 
+//Central services
 include::modules/acs-central-services-overview.adoc[leveloffset=+1]
 
+//Vulnerability data sources
 include::modules/con-vuln-sources.adoc[leveloffset=+2]
 
+//Scanner V4 sources
+include::modules/scanner-v4-vuln-sources.adoc[leveloffset=+3]
+
+[role="_additional-resources"]
+.Additional resources
+* link:https://security.access.redhat.com/data/csaf/v2/vex/[Red{nbsp}Hat VEX]
+* link:https://docs.oasis-open.org/csaf/csaf/v2.0/os/csaf-v2.0-os.html#45-profile-5-vex[Vulnerability Exploitability eXchange (VEX)]
+* link:https://access.redhat.com/security/middleware_security_scanning_problem[Accurate security data for Middleware products]
+* link:https://www.redhat.com/en/blog/future-red-hat-security-data[The future of Red{nbsp}Hat security data]
+* link:https://osv.dev/[OSV]
+* link:https://github.com/google/osv.dev/blob/master/LICENSE[Apache License 2.0]
+* link:https://nvd.nist.gov/[NVD]
+* link:https://secdb.alpinelinux.org/[Alpine Security Database]
+* link:https://alas.aws.amazon.com/index.html[Amazon Linux Security Center]
+* link:https://security-tracker.debian.org/tracker/data/json[Debian Security Tracker]
+* link:https://linux.oracle.com/security/oval[Oracle OVAL]
+* link:https://packages.vmware.com/photon/photon_oval_definitions/[Photon OVAL]
+* link:https://support.novell.com/security/oval/[SUSE OVAL]
+* link:https://security-metadata.canonical.com/oval/[Ubuntu OVAL]
+* link:https://github.com/stackrox/stackrox/blob/master/scanner/updater/manual/vulns.go[StackRox vulnerability data]
+* link:https://security.access.redhat.com/data/metrics/repository-to-cpe.json[repository-to-cpe.json]
+* link:https://security.access.redhat.com/data/metrics/container-name-repos-map.json[container-name-repos-map.json]
+
+//StackRox Scanner sources
+include::modules/stackrox-scanner-vuln-sources.adoc[leveloffset=+3]
+
+[role="_additional-resources"]
+.Additional resources
+* link:https://access.redhat.com/security/data/oval/v2/[Red{nbsp}Hat OVAL v2]
+* link:https://secdb.alpinelinux.org/[Alpine Security Database]
+* link:https://alas.aws.amazon.com/index.html[Amazon Linux Security Center]
+* link:https://security-tracker.debian.org/tracker/data/json[Debian Security Tracker]
+* link:https://git.launchpad.net/ubuntu-cve-tracker/[Ubuntu CVE Tracker]
+* link:https://nvd.nist.gov/[NVD]
+* link:https://github.com/stackrox/scanner/blob/master/ext/vulnsrc/manual/manual.go[Linux manual entries]
+* link:https://github.com/stackrox/scanner/blob/master/pkg/vulnloader/nvdloader/manual.go[NVD manual entries]
+* link:https://security.access.redhat.com/data/metrics/repository-to-cpe.json[repository-to-cpe.json]
+
+//Secured cluster services
 include::modules/acs-secured-cluster-services-overview.adoc[leveloffset=+1]
 
+//External components
 include::modules/acs-architecture-external-components.adoc[leveloffset=+1]
 
+//Interaction between the services
 include::modules/acs-architecture-interaction-between-services.adoc[leveloffset=+1]
 
+//{product-title-short} connection protocols and default ports
 include::modules/acs-architecture-connections.adoc[leveloffset=+1]
 
 [role="_additional-resources"]
-.Additional resources
-* xref:../installing/installing_ocp/install-central-ocp.html#install-central-operator-external-db_install-central-ocp[Installing Central with an external database using the Operator method]
+[id="additional-resources_acs-architecture"]
+== Additional resources
+* xref:../installing/installing_ocp/install-central-ocp.adoc#install-central-operator-external-db_install-central-ocp[Installing Central with an external database using the Operator method]
 * xref:../cli/command-reference/roxctl.adoc#roxctl-command-options_roxctl[roxctl command options]
diff --git a/cloud_service/acscs-architecture.adoc b/cloud_service/acscs-architecture.adoc
@@ -16,8 +16,47 @@ include::modules/acscs-architecture-overview.adoc[leveloffset=+1]
 
 include::modules/acscs-central-overview.adoc[leveloffset=+1]
 
+//Vulnerability data sources
 include::modules/con-vuln-sources.adoc[leveloffset=+2]
 
+//Scanner V4 sources
+include::modules/scanner-v4-vuln-sources.adoc[leveloffset=+3]
+
+[role="_additional-resources"]
+.Additional resources
+* link:https://security.access.redhat.com/data/csaf/v2/vex/[Red{nbsp}Hat VEX]
+* link:https://docs.oasis-open.org/csaf/csaf/v2.0/os/csaf-v2.0-os.html#45-profile-5-vex[Vulnerability Exploitability eXchange (VEX)]
+* link:https://access.redhat.com/security/middleware_security_scanning_problem[Accurate security data for Middleware products]
+* link:https://www.redhat.com/en/blog/future-red-hat-security-data[The future of Red{nbsp}Hat security data]
+* link:https://osv.dev/[OSV]
+* link:https://github.com/google/osv.dev/blob/master/LICENSE[Apache License 2.0]
+* link:https://nvd.nist.gov/[NVD]
+* link:https://secdb.alpinelinux.org/[Alpine Security Database]
+* link:https://alas.aws.amazon.com/index.html[Amazon Linux Security Center]
+* link:https://security-tracker.debian.org/tracker/data/json[Debian Security Tracker]
+* link:https://linux.oracle.com/security/oval[Oracle OVAL]
+* link:https://packages.vmware.com/photon/photon_oval_definitions/[Photon OVAL]
+* link:https://support.novell.com/security/oval/[SUSE OVAL]
+* link:https://security-metadata.canonical.com/oval/[Ubuntu OVAL]
+* link:https://github.com/stackrox/stackrox/blob/master/scanner/updater/manual/vulns.go[StackRox vulnerability data]
+* link:https://security.access.redhat.com/data/metrics/repository-to-cpe.json[repository-to-cpe.json]
+* link:https://security.access.redhat.com/data/metrics/container-name-repos-map.json[container-name-repos-map.json]
+
+//StackRox Scanner sources
+include::modules/stackrox-scanner-vuln-sources.adoc[leveloffset=+3]
+
+[role="_additional-resources"]
+.Additional resources
+* link:https://access.redhat.com/security/data/oval/v2/[Red{nbsp}Hat OVAL v2]
+* link:https://secdb.alpinelinux.org/[Alpine Security Database]
+* link:https://alas.aws.amazon.com/index.html[Amazon Linux Security Center]
+* link:https://security-tracker.debian.org/tracker/data/json[Debian Security Tracker]
+* link:https://git.launchpad.net/ubuntu-cve-tracker/[Ubuntu CVE Tracker]
+* link:https://nvd.nist.gov/[NVD]
+* link:https://github.com/stackrox/scanner/blob/master/ext/vulnsrc/manual/manual.go[Linux manual entries]
+* link:https://github.com/stackrox/scanner/blob/master/pkg/vulnloader/nvdloader/manual.go[NVD manual entries]
+* link:https://security.access.redhat.com/data/metrics/repository-to-cpe.json[repository-to-cpe.json]
+
 include::modules/acs-secured-cluster-services-overview.adoc[leveloffset=+1]
 
 [role="_additional-resources"]

diff --git a/modules/acs-architecture-external-components.adoc b/modules/acs-architecture-external-components.adoc
@@ -6,7 +6,7 @@
 = External components
 
 [role="_abstract"]
-{product-title} ({product-title-short}) interacts with different external components to provide additional features and functionality, such as CLI access to the system, access to image registries, data from vulnerability feeds, and integrations with third-party systems. 
+{product-title} ({product-title-short}) interacts with different external components to provide additional features and functionality, such as CLI access to the system, access to image registries, data from vulnerability feeds, and integrations with third-party systems.
 
 {product-title-short} interacts with the following external components:
 

diff --git a/modules/acs-architecture-interaction-between-services.adoc b/modules/acs-architecture-interaction-between-services.adoc
@@ -60,7 +60,7 @@ Central communicates with Sensor to force reprocessing of all deployments agains
 |Collector
 |⮂
 |Sensor
-|Collector communicates with Sensor and sends all of the events to the respective Sensor for the cluster.
+|Collector communicates with Sensor and sends all of the events to Sensor for the cluster.
 On supported {ocp} clusters, Collector analyzes the software packages installed on the nodes and sends them to Sensor so that Scanner can later scan them for vulnerabilities.
 Collector also requests missing drivers from Sensor.
 Sensor requests compliance scan results from Collector. Additionally, Sensor receives external Classless Inter-Domain Routing information from Central and pushes it to Collector.
@@ -128,7 +128,7 @@ Central communicates with Sensor to force reprocessing of all deployments agains
 |Collector
 |⮂
 |Sensor
-|Collector communicates with Sensor and sends all of the events to the respective Sensor for the cluster.
+|Collector communicates with Sensor and sends all of the events to Sensor for the cluster.
 On supported {ocp} clusters, Collector analyzes the software packages installed on the nodes and sends them to Sensor so that Scanner can later scan them for vulnerabilities.
 Collector also requests missing drivers from Sensor.
 Sensor requests compliance scan results from Collector. Additionally, Sensor receives external Classless Inter-Domain Routing information from Central and pushes it to Collector.

diff --git a/modules/acs-secured-cluster-services-overview.adoc b/modules/acs-secured-cluster-services-overview.adoc
@@ -1,9 +1,7 @@
 // Module included in the following assemblies:
 //
 // * architecture/acs-architecture.adoc
-:_mod-docs-content-type: CONCEPT
-[id="acs-secured-cluster-services_{context}"]
-= Secured cluster services
+// * cloud_service/acscs-architecture.adoc
 
 ifeval::["{context}" == "acscs-architecture"]
 :title: Red Hat Advanced Cluster Security Cloud Service
@@ -15,6 +13,10 @@ ifeval::["{context}" == "acs-architecture"]
 :short-title: RHACS
 endif::[]
 
+:_mod-docs-content-type: CONCEPT
+[id="acs-secured-cluster-services_{context}"]
+= Secured cluster services
+
 [role="_abstract"]
 Install the secured cluster services on each cluster that you want to secure by using {title}.
 

diff --git a/modules/con-vuln-sources.adoc b/modules/con-vuln-sources.adoc
@@ -6,70 +6,10 @@
 [id="con-vuln-sources_{context}"]
 = Vulnerability data sources
 
+[role="_abstract"]
 Sources for vulnerabilities depend on the scanner that is used in your system. {product-title-short} contains two scanners: StackRox Scanner and Scanner V4. The StackRox Scanner is deprecated. Scanner V4 is the default image scanner.
-+
-[NOTE]
-====
-Although the StackRox Scanner is deprecated, it still must be enabled on the cluster where Central is installed due to software dependencies.
-====
-
-[id="scanner-v4-vuln-sources"]
-== Scanner V4 sources
-
-Scanner V4 uses the following vulnerability sources:
-
-link:https://security.access.redhat.com/data/csaf/v2/vex/[Red{nbsp}Hat VEX]:: This source is used with release 4.6 and later. This source provides vulnerability data in link:https://docs.oasis-open.org/csaf/csaf/v2.0/os/csaf-v2.0-os.html#45-profile-5-vex[Vulnerability Exploitability eXchange(VEX)] format. {product-title-short} takes advantage of VEX benefits to significantly decrease the time needed for the initial loading of vulnerability data, and the space needed to store vulnerability data. VEX also provides improved accuracy over OVAL.
-+
-{product-title-short} might list a different number of vulnerabilities when you are scanning with a {product-title-short} version that uses OVAL, such as {product-title-short} version 4.5, and a version that uses VEX, such as version 4.6. For example, {product-title-short} no longer displays vulnerabilities with a status of "under investigation," while these vulnerabilities were included with previous versions that used OVAL data.
-+
-For containers from or built on top of containers from the Red{nbsp}Hat Ecosystem Catalog, {product-title-short} provides an option to show only vulnerabilities from Red{nbsp}Hat's VEX data. VEX data for Red{nbsp}Hat images is the most accurate because the Red{nbsp}Hat security team vets the vulnerabilities in those images and reports the results in VEX. Other vulnerability sources such as OSV can report vulnerabilities that Red{nbsp}Hat has determined are not applicable to the image. This can cause false positives in vulnerability results. Enabling the setting to use only VEX data for Red{nbsp}Hat images minimizes these false positives.
-+
-The option to use VEX data for Red{nbsp}Hat containers is disabled by default. To enable this option, in Scanner V4 Matcher, set the environment variable `ROX_SCANNER_V4_RED_HAT_LAYERS_RED_HAT_VULNS_ONLY` to `true`. Be aware that in rare instances, using this option can cause valid vulnerabilities to not appear in scan results, or false negatives. For example, Red{nbsp}Hat does not track vulnerabilities for products that have reached end of life. Also be aware that Red{nbsp}Hat's VEX data is missing link:https://access.redhat.com/security/middleware_security_scanning_problem[accurate security data for many Middleware products].
-+
-For more information about Red{nbsp}Hat security data, including information about the use of OVAL, Common Security Advisory Framework Version 2.0 (CSAF), and VEX, see link:https://www.redhat.com/en/blog/future-red-hat-security-data[The future of Red{nbsp}Hat security data].
-link:https://osv.dev/[OSV]:: This is used for language-related vulnerabilities, such as Go, Java, JavaScript, Python, and Ruby. This source might provide
-vulnerability IDs other than CVE IDs for vulnerabilities, such as a GitHub Security Advisory (GHSA) ID.
-+
-[NOTE]
-====
-{product-title-short} uses the OSV database available at link:https://osv.dev/[OSV.dev] under link:https://github.com/google/osv.dev/blob/master/LICENSE[Apache License 2.0].
-====
-link:https://nvd.nist.gov/[NVD]:: This is used for various purposes such as filling in information gaps when vendors do not provide information. For example, Alpine does not provide a description, CVSS score, severity, or published date.
-+
-[NOTE]
-====
-This product uses the NVD API but is not endorsed or certified by the NVD.
-====
-Additional vulnerability sources::
-* link:https://secdb.alpinelinux.org/[Alpine Security Database]
-* Data tracked in link:https://alas.aws.amazon.com/index.html[Amazon Linux Security Center]
-* link:https://security-tracker.debian.org/tracker/data/json[Debian Security Tracker]
-* link:https://linux.oracle.com/security/oval[Oracle OVAL]
-* link:https://packages.vmware.com/photon/photon_oval_definitions/[Photon OVAL]
-* link:https://support.novell.com/security/oval/[SUSE OVAL]
-* link:https://security-metadata.canonical.com/oval/[Ubuntu OVAL]
-* link:https://github.com/stackrox/stackrox/blob/master/scanner/updater/manual/vulns.go[StackRox]: The upstream StackRox project maintains a set of vulnerabilities that might not be discovered due to data formatting from other sources or absence of data.
-
-Scanner V4 Indexer sources:: Scanner V4 indexer uses the following files to index Red{nbsp}Hat containers:
 
-* link:https://security.access.redhat.com/data/metrics/repository-to-cpe.json[repository-to-cpe.json]: Maps RPM repositories to their related CPEs, which is required for matching vulnerabilities for RHEL-based images.
-* link:https://security.access.redhat.com/data/metrics/container-name-repos-map.json[container-name-repos-map.json]: This matches container names to their respective repositories.
-
-[id="stackrox-scanner-vuln-sources"]
-== StackRox Scanner sources
-
-StackRox Scanner uses the following vulnerability sources:
-
-* link:https://access.redhat.com/security/data/oval/v2/[Red{nbsp}Hat OVAL] v2
-* link:https://secdb.alpinelinux.org/[Alpine Security Database]
-* Data tracked in link:https://alas.aws.amazon.com/index.html[Amazon Linux Security Center]
-* link:https://security-tracker.debian.org/tracker/data/json[Debian Security Tracker]
-* link:https://git.launchpad.net/ubuntu-cve-tracker/[Ubuntu CVE Tracker]
-* link:https://nvd.nist.gov/[NVD]: This is used for various purposes such as filling in information gaps when vendors do not provide information. For example, Alpine does not provide a description, CVSS score, severity, or published date.
-+
 [NOTE]
 ====
-This product uses the NVD API but is not endorsed or certified by the NVD.
+Although the StackRox Scanner is deprecated, it still must be enabled on the cluster where Central is installed due to software dependencies.
 ====
-* link:https://github.com/stackrox/scanner/blob/master/ext/vulnsrc/manual/manual.go[Linux manual entries] and link:https://github.com/stackrox/scanner/blob/master/pkg/vulnloader/nvdloader/manual.go[NVD manual entries]: The upstream StackRox project maintains a set of vulnerabilities that might not be discovered due to data formatting from other sources or absence of data.
-* link:https://security.access.redhat.com/data/metrics/repository-to-cpe.json[repository-to-cpe.json]: Maps RPM repositories to their related CPEs, which is required for matching vulnerabilities for RHEL-based images.