Kev Posted March 9, 2023 Report Posted March 9, 2023 Trivy (pronunciation) is a comprehensive and versatile security scanner. Trivy has scanners that look for security issues, and targets where it can find those issues. Targets (what Trivy can scan): Container Image Filesystem Git Repository (remote) Virtual Machine Image Kubernetes AWS Scanners (what Trivy can find there): OS packages and software dependencies in use (SBOM) Known vulnerabilities (CVEs) IaC issues and misconfigurations Sensitive information and secrets Software licenses To learn more, go to the Trivy homepage for feature highlights, or to the Documentation site for detailed information. Quick Start Get Trivy Trivy is available in most common distribution channels. The full list of installation options is available in the Installation page. Here are a few popular examples: brew install trivy docker run aquasec/trivy Download binary from https://github.com/aquasecurity/trivy/releases/latest/ See Installation for more Trivy is integrated with many popular platforms and applications. The complete list of integrations is available in the Ecosystem page. Here are a few popular examples: GitHub Actions Kubernetes operator VS Code plugin See Ecosystem for more General usage trivy <target> [--scanners <scanner1,scanner2>] <subject> Examples: trivy image python:3.4-alpine Result https://user-images.githubusercontent.com/1161307/171013513-95f18734-233d-45d3-aaf5-d6aec687db0e.mov trivy fs --scanners vuln,secret,config myproject/ Result https://user-images.githubusercontent.com/1161307/171013917-b1f37810-f434-465c-b01a-22de036bd9b3.mov trivy k8s --report summary cluster Result FAQ How to pronounce the name "Trivy"? tri is pronounced like trigger, vy is pronounced like envy. Trivy is an Aqua Security open source project. Learn about our open source work and portfolio here. Contact us about any matter by opening a GitHub Discussion here Download: trivy-main.zip or git clone https://github.com/aquasecurity/trivy.git Source: github.com Quote
