question: the purpose of audit vs ignore rules, and what is the purpose of the two different config files about vulnerability-operator

[ckotzbauer]

The grype-config-file is the older one with only the basic set of options for grype. The filter-config-file offers a more fine-grained filter-mechanism.
There's a different between ignoring vulns (e.g. they do not apply to your setup) or you audit them because they do apply to your infra but it is not critical or you want to mark them as "seen and acknowleged"

[samcornwell]

Overdue to be closed, got my answer, thanks.