mirror of
https://github.com/BagelHole/DevOps-Security-Agent-Skills.git
synced 2026-08-22 12:49:53 +02:00
94 lines
2.2 KiB
Markdown
94 lines
2.2 KiB
Markdown
# Vulnerability Scanner Comparison
|
|
|
|
## Container Image Scanners
|
|
|
|
| Tool | License | Speed | Database | CI Integration |
|
|
|------|---------|-------|----------|----------------|
|
|
| **Trivy** | Apache 2.0 | Fast | NVD, Red Hat, etc. | Excellent |
|
|
| **Grype** | Apache 2.0 | Fast | Anchore DB | Good |
|
|
| **Clair** | Apache 2.0 | Medium | NVD, Alpine, etc. | Good |
|
|
| **Snyk** | Commercial | Fast | Snyk DB | Excellent |
|
|
| **Docker Scout** | Commercial | Fast | Docker DB | Native |
|
|
|
|
## Recommended: Trivy
|
|
|
|
### Installation
|
|
```bash
|
|
# Homebrew
|
|
brew install trivy
|
|
|
|
# APT
|
|
apt-get install trivy
|
|
|
|
# Docker
|
|
docker run aquasec/trivy image nginx:latest
|
|
```
|
|
|
|
### Basic Usage
|
|
```bash
|
|
# Scan image
|
|
trivy image nginx:latest
|
|
|
|
# Scan with severity filter
|
|
trivy image --severity HIGH,CRITICAL nginx:latest
|
|
|
|
# Scan and fail on vulnerabilities
|
|
trivy image --exit-code 1 --severity CRITICAL nginx:latest
|
|
|
|
# JSON output
|
|
trivy image -f json -o results.json nginx:latest
|
|
|
|
# Scan filesystem
|
|
trivy fs /path/to/project
|
|
|
|
# Scan Kubernetes
|
|
trivy k8s --report summary cluster
|
|
```
|
|
|
|
### GitHub Actions
|
|
```yaml
|
|
- name: Run Trivy vulnerability scanner
|
|
uses: aquasecurity/trivy-action@master
|
|
with:
|
|
image-ref: 'myapp:${{ github.sha }}'
|
|
format: 'sarif'
|
|
output: 'trivy-results.sarif'
|
|
severity: 'CRITICAL,HIGH'
|
|
|
|
- name: Upload Trivy scan results
|
|
uses: github/codeql-action/upload-sarif@v2
|
|
with:
|
|
sarif_file: 'trivy-results.sarif'
|
|
```
|
|
|
|
## Dependency Scanners
|
|
|
|
| Tool | Languages | License |
|
|
|------|-----------|---------|
|
|
| **npm audit** | JavaScript | Free |
|
|
| **pip-audit** | Python | Free |
|
|
| **bundle audit** | Ruby | Free |
|
|
| **cargo audit** | Rust | Free |
|
|
| **Snyk** | Multi | Commercial |
|
|
| **Dependabot** | Multi | Free (GitHub) |
|
|
| **OWASP Dependency-Check** | Multi | Apache 2.0 |
|
|
|
|
## Infrastructure as Code Scanners
|
|
|
|
| Tool | Targets | License |
|
|
|------|---------|---------|
|
|
| **tfsec** | Terraform | MIT |
|
|
| **checkov** | TF, CloudFormation, K8s | Apache 2.0 |
|
|
| **kics** | Multi IaC | Apache 2.0 |
|
|
| **kubesec** | Kubernetes | Apache 2.0 |
|
|
|
|
## CVSS Score Reference
|
|
|
|
| Score | Severity |
|
|
|-------|----------|
|
|
| 0.0 | None |
|
|
| 0.1-3.9 | Low |
|
|
| 4.0-6.9 | Medium |
|
|
| 7.0-8.9 | High |
|
|
| 9.0-10.0 | Critical |
|