diff --git a/scanners/boostsecurityio/trivy-fs/module.yaml b/scanners/boostsecurityio/trivy-fs/module.yaml index 4228378c..ac2698c0 100644 --- a/scanners/boostsecurityio/trivy-fs/module.yaml +++ b/scanners/boostsecurityio/trivy-fs/module.yaml @@ -4,6 +4,7 @@ id: boostsecurityio/trivy-fs name: Trivy (Filesystem scanning) namespace: boostsecurityio/trivy-fs scan_types: + - secrets - sca config: @@ -106,18 +107,19 @@ steps: TRIVY_ADDITIONAL_ARGS: ${TRIVY_ADDITIONAL_ARGS---ignore-unfixed} TRIVY_DB_REPOSITORY: public.ecr.aws/aquasecurity/trivy-db:2,ghcr.io/aquasecurity/trivy-db:2 TRIVY_JAVA_DB_REPOSITORY: public.ecr.aws/aquasecurity/trivy-java-db:1,ghcr.io/aquasecurity/trivy-java-db:1 + TRIVY_SCANNERS: vuln,secret run: > $SETUP_PATH/trivy fs ${TRIVY_ADDITIONAL_ARGS} --format json --no-progress - --scanners vuln + --scanners ${TRIVY_SCANNERS} --skip-version-check . 2>&1 format: sarif post-processor: docker: - image: public.ecr.aws/boostsecurityio/boost-scanner-trivy:fba2c2b@sha256:42514869cb1ad36e13bd51e55523de6a767104094ec9e99391de89835a388dfd + image: public.ecr.aws/boostsecurityio/boost-scanner-trivy:bd6764a@sha256:003d6e55018c4aa334f8c6975cba67886471530fedfd131a612dd7a0d8f96552 command: process environment: PYTHONIOENCODING: utf-8 diff --git a/scanners/boostsecurityio/trivy-fs/rules.yaml b/scanners/boostsecurityio/trivy-fs/rules.yaml index f3edfd83..ce0c16b7 100644 --- a/scanners/boostsecurityio/trivy-fs/rules.yaml +++ b/scanners/boostsecurityio/trivy-fs/rules.yaml @@ -1,2 +1,3 @@ import: - boostsecurityio/sca-cve + - boostsecurityio/stored-secrets diff --git a/scanners/boostsecurityio/trivy-image/module.yaml b/scanners/boostsecurityio/trivy-image/module.yaml index a83f3a76..60d64e8e 100644 --- a/scanners/boostsecurityio/trivy-image/module.yaml +++ b/scanners/boostsecurityio/trivy-image/module.yaml @@ -4,6 +4,7 @@ id: boostsecurityio/trivy-image name: Trivy (Image scanning) namespace: boostsecurityio/trivy-image scan_types: + - secrets - sca_container config: @@ -60,18 +61,19 @@ steps: TRIVY_ADDITIONAL_ARGS: ${TRIVY_ADDITIONAL_ARGS---ignore-unfixed} TRIVY_DB_REPOSITORY: public.ecr.aws/aquasecurity/trivy-db:2,ghcr.io/aquasecurity/trivy-db:2 TRIVY_JAVA_DB_REPOSITORY: public.ecr.aws/aquasecurity/trivy-java-db:1,ghcr.io/aquasecurity/trivy-java-db:1 + TRIVY_SCANNERS: vuln,secret run: > $SETUP_PATH/trivy image ${TRIVY_ADDITIONAL_ARGS} --format json - --scanners vuln + --scanners ${TRIVY_SCANNERS} --skip-version-check --quiet ${BOOST_IMAGE_NAME} format: sarif post-processor: docker: - image: public.ecr.aws/boostsecurityio/boost-scanner-trivy:fba2c2b@sha256:42514869cb1ad36e13bd51e55523de6a767104094ec9e99391de89835a388dfd + image: public.ecr.aws/boostsecurityio/boost-scanner-trivy:bd6764a@sha256:003d6e55018c4aa334f8c6975cba67886471530fedfd131a612dd7a0d8f96552 command: process workdir: /code environment: diff --git a/scanners/boostsecurityio/trivy-image/rules.yaml b/scanners/boostsecurityio/trivy-image/rules.yaml index a65a9653..13922ae8 100644 --- a/scanners/boostsecurityio/trivy-image/rules.yaml +++ b/scanners/boostsecurityio/trivy-image/rules.yaml @@ -1,3 +1,5 @@ +import: + - boostsecurityio/stored-secrets rules: cve-unknown: categories: