Trivy Alternatives

Reviews and mentions

• trivy: Scanner for vulnerabilities in container images, file systems, and Git repositories, as well as for configuration issues
  1 project | reddit.com/r/CKsTechNews | 10 Nov 2021
• Trivy: A scanner for vulnerabilities in containers, file systems, and Git repos
  1 project | news.ycombinator.com | 10 Nov 2021
• Show HN: Easy to use vulnerability exploitation data
  3 projects | news.ycombinator.com | 7 Nov 2021
• Continuous Container Vulnerability Testing With Trivy
  5 projects | dev.to | 4 Nov 2021

  wget https://github.com/aquasecurity/trivy/releases/download/v0.20.1/trivy_0.20.1_Linux-64bit.deb sudo dpkg -i trivy_0.20.1_Linux-64bit.deb checkout docker pull "${DOCKER_USERNAME}"/semaphore-demo-ruby-kubernetes:$SEMAPHORE_WORKFLOW_ID trivy image --severity HIGH,CRITICAL "${DOCKER_USERNAME}"/semaphore-demo-ruby-kubernetes:$SEMAPHORE_WORKFLOW_ID

• Ask HN: How do you (security) audit external software using NPM packages?
  6 projects | news.ycombinator.com | 4 Nov 2021

  We've been using trivy [1] to audit the container builds we've been producing for a relatively security focussed project. As well as scanning for OS package level vulnerabilities it also scans for reported vulnerabilities in NPM packages. Works well for us.

  But the other complementary approach is to lock down other things - so for example, if you're running in a container, make sure that container can only talk to the proxy in front of it. That way, even if there was some kind of malicious code running in one of the modules, there's no way for any data to get in or out (unless it finds a way of injecting into any web input/output, but then you need to be scanning for that too)

  [1] https://github.com/aquasecurity/trivy

• Kubernetes Security Checklist 2021
  28 projects | dev.to | 18 Oct 2021

  All images should be checked in the application lifecycle by automated scanners (Trivy, Clair, Grype)

• Terraform IaC Scanning with Trivy
  3 projects | dev.to | 16 Oct 2021

  #// code/task_groups/build.yml#L16-L89 jobs: - job: build pool: vmImage: ${{ parameters.pool }} workspace: clean: all steps: - checkout: self path: src - task: [email protected] inputs: terraformVersion: ${{ parameters.terraformVersion }} - task: [email protected] displayName: 'Download and Install Trivy vulnerability scanner' inputs: script: | sudo apt-get install rpm wget https://github.com/aquasecurity/trivy/releases/download/v${{ parameters.trivyVersion }}/trivy_${{ parameters.trivyVersion }}_Linux-64bit.deb sudo dpkg -i trivy_${{ parameters.trivyVersion }}_Linux-64bit.deb trivy -v - task: [email protected] displayName: Terraform Init inputs: provider: 'azurerm' command: 'init' workingDirectory: '$(Agent.BuildDirectory)/src/${{ parameters.root_directory }}' backendServiceArm: ${{ parameters.backend_service_connection_name }} backendAzureRmResourceGroupName: ${{ parameters.backend_resource_group }} backendAzureRmStorageAccountName: ${{ parameters.backend_storage_accountname }} backendAzureRmContainerName: ${{ parameters.container_name }} backendAzureRmKey: ${{ parameters.container_key }} - task: [email protected] displayName: 'LOW/MED - Trivy vulnerability scanner in IaC mode' inputs: script: | trivy config --severity LOW,MEDIUM --exit-code 0 $(Agent.BuildDirectory)/src/${{ parameters.root_directory }} - task: [email protected] displayName: 'HIGH/CRIT - Trivy vulnerability scanner in IaC mode' inputs: script: | trivy config --severity HIGH,CRITICAL --exit-code 1 $(Agent.BuildDirectory)/src/${{ parameters.root_directory }} - task: [email protected] displayName: Terraform Plan inputs: provider: 'azurerm' command: 'plan' workingDirectory: '$(Agent.BuildDirectory)/src/${{ parameters.root_directory }}' commandOptions: '--var-file=$(Agent.BuildDirectory)/src/${{ parameters.root_directory }}${{ parameters.tfvarFile }} --out=$(Agent.BuildDirectory)/src/${{ parameters.root_directory }}plan.tfplan' environmentServiceNameAzureRM: ${{ parameters.deployment_service_connection_name }} - task: [email protected] displayName: 'Copy Files to Staging' inputs: SourceFolder: '$(Agent.BuildDirectory)/src' Contents: 'Terraform/**' TargetFolder: '$(Build.ArtifactStagingDirectory)' - task: [email protected] inputs: rootFolderOrFile: '$(Build.ArtifactStagingDirectory)' archiveFile: '$(Build.ArtifactStagingDirectory)/$(Build.BuildId).zip' replaceExistingArchive: true includeRootFolder: false displayName: Archive Terraform Artifact - publish: '$(Build.ArtifactStagingDirectory)/$(Build.BuildId).zip' artifact: '$(Build.BuildId)-trivy' displayName: Publish Pipeline Artifact

• Debut to Bug-Hunting Cybersecurity and writing Quality Code
  4 projects | dev.to | 9 Oct 2021

  Use of tools like Trivy and Dependabot Alerts can be used in combination with Automation Scripts and Version Control to avoid influx of vulnerabilities in peer dependencies of the application.

• Suggestions Needed - Vulnerability Scanner
  1 project | reddit.com/r/msp | 3 Sep 2021
• CONTAINER SECURITY
  3 projects | reddit.com/r/u_sybrenbolandit | 31 Aug 2021

  install: - ... - export TRIVY_VERSION=$(curl --silent "https://api.github.com/repos/aquasecurity/trivy/releases/latest" | grep '"tag_name":' | sed -E 's/.*"v([^"]+)".*/\1/') - wget https://github.com/aquasecurity/trivy/releases/download/v${TRIVY_VERSION}/trivy_${TRIVY_VERSION}_Linux-64bit.tar.gz - tar zxvf trivy_${TRIVY_VERSION}_Linux-64bit.tar.gz

• Vulnerabilities and fixes management tool(s) ?
  2 projects | reddit.com/r/devsecops | 9 Aug 2021
• GitHub - aquasecurity/trivy: Scanner for vulnerabilities in container images, file systems, and Git repositories, as well as for configuration issues
  1 project | reddit.com/r/bag_o_news | 5 Aug 2021
• aquasecurity/trivy - Scanner for vulnerabilities in container images, file systems, and Git repositories, as well as for configuration issues
  1 project | reddit.com/r/GithubSecurityTools | 5 Aug 2021
• Ask HN: Who is hiring? (August 2021)
  14 projects | news.ycombinator.com | 2 Aug 2021

  - https://github.com/aquasecurity/trivy : Golang, OPA, vulnerabilities & Infrastructure as Code scanning.

  I'm the hiring manager, feel free to DM me on twitter @itaysk if you have questions.

  Apply here: https://www.aquasec.com/about-us/careers/co/engineering/81.E...

• 2 Widespread Attacks on Your Containerized Environment and 7 Rules to Prevent it.
  9 projects | dev.to | 23 Jul 2021

  Trivy can detect complex vulnerabilities with high accuracy for OS like Alpine Linux and RHEL/CentOS , Debian, Ubuntu, and others. It is quite powerful, opensource, and free. You can run Trivi in standalone or client/server modes. Therefore you can add it to your CI/CD process.