trivy

Scan filesystem Scan a local directory for vulnerabilities and misconfigs trivy fs --severity HIGH,CRITICAL . #trivy#security Scan k8s cluster Security audit of the whole cluster: images, configs, RBAC trivy k8s --report summary cluster #trivy#security Scan specific namespace Scan workloads only in a specific namespace trivy k8s --namespace production --report summary all #trivy#security Scan Helm chart Check Helm chart templates for security misconfigurations trivy config ./my-chart #trivy#security#helm Scan with JSON output Machine-readable vulnerability scan results trivy image --format json -o results.json img:tag #trivy#security Scan IaC directory Find misconfigurations in Terraform/Kubernetes/Helm code trivy config --severity MEDIUM,HIGH,CRITICAL ./terraform #trivy#security#terraform Ignore unfixed CVEs Skip vulnerabilities that have no fix available yet trivy image --ignore-unfixed --severity HIGH,CRITICAL img:tag #trivy#security Update vulnerability DB Pre-download the latest vulnerability database trivy image --download-db-only #trivy#security Scan filesystem Scan the current directory for vulnerabilities trivy fs . #trivy#security#scan#filesystem Scan Kubernetes cluster Scan the entire Kubernetes cluster for vulnerabilities and misconfigs trivy k8s --report summary cluster #trivy#security#k8s#scan Scan with SARIF output Output scan results in SARIF format for CI/IDE integration trivy image --format sarif --output results.sarif myimage:tag #trivy#security#sarif#ci Scan config files Scan IaC config files for misconfigurations trivy config . #trivy#security#iac#config Filter by severity Show only HIGH and CRITICAL vulnerabilities trivy image --severity HIGH,CRITICAL myimage:tag #trivy#security#severity#filter Ignore unfixed vulns Skip vulnerabilities that have no fix available trivy image --ignore-unfixed myimage:tag #trivy#security#ignore#filter Scan sbom Scan a Software Bill of Materials file for vulnerabilities trivy sbom ./sbom.json #trivy#security#sbom#scan