Skip to content

dhi: add aws inspector #25365

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
craig-osterhout wants to merge 1 commit into
base: main
Choose a base branch
from
+8 −3
Draft

dhi: add aws inspector #25365

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 8 additions & 3 deletions content/manuals/dhi/explore/scanner-integrations.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
---
title: Scanner integrations
description: Learn which vulnerability scanners work with Docker Hardened Images and how to choose the right scanner for accurate vulnerability assessment.
keywords: scanner integration, vulnerability scanning, docker scout, trivy, grype, wiz, black duck, aikido, container security scanners
keywords: scanner integration, vulnerability scanning, docker scout, trivy, grype, wiz, black duck, aikido, aws inspector, container security scanners
weight: 40
---

Expand All @@ -10,7 +10,7 @@ accurate results that reflect the actual security posture of these images, your
scanner needs to understand the VEX (Vulnerability Exploitability eXchange)
attestations included with each image.

## Scanners with VEX support
## Supported scanners for Docker Hardened Images

The following scanners can read and apply VEX attestations included with Docker
Hardened Images:
Expand All @@ -27,6 +27,12 @@ Hardened Images:

For step-by-step instructions for Docker Scout, Trivy, and Grype, see [Scan Docker Hardened Images](/manuals/dhi/how-to/scan.md). For Wiz, Mend.io, Black Duck, and Aikido, refer to their respective documentation.

Most scanners can scan Docker Hardened Images. Scanners not listed in the table,
such as [AWS Inspector](https://docs.aws.amazon.com/inspector/latest/user/supported.html),
can scan DHI but won't apply VEX filtering. Results will include more reported
CVEs than the actual risk profile of the image. To reduce false positives, use a
vendor-specific suppression method, such as [AWS Inspector suppression rules](https://docs.aws.amazon.com/inspector/latest/user/findings-managing-supression-rules.html).

## Choosing a scanner for Docker Hardened Images

When selecting a scanner for use with Docker Hardened Images, whether it
Expand Down Expand Up @@ -168,4 +174,3 @@ exceptions. This requires:

Learn how to [scan Docker Hardened Images](/manuals/dhi/how-to/scan.md) with
VEX-compliant scanners.