Compliance Scan
Static Compliance Scan enables you to assess the compliance posture of container images by evaluating them against built-in security controls. QScanner runs a series of compliance checks and reports whether each control passes, fails, or is skipped.
In addition to compliance validation, QScanner analyzes image layers and build history to identify secrets that may have been embedded in container images.
Static Compliance Scan helps organizations implement shift-left security, validate compliance requirements during CI/CD workflows, and identify security misconfigurations before deployment.
Benefits of Compliance Scan
You can use Static Compliance Scan to,
- Validate CIS benchmark compliance before deployment.
- Detect secrets embedded in container images.
- Enforce security requirements in CI/CD pipelines.
- Verify container runtime hardening.
- Perform compliance assessment in air-gapped environments.
- Identify Dockerfile misconfigurations early in the development lifecycle.
How Compliance Scan Works
To do the Compliance scan of an image, run the following command.
# ./qscanner --pod <POD Name> --scan-types compliance image <Image Name or ID>
For example,
# ./qscanner --pod US2 --scan-types compliance image caddy
When a compliance scan is initiated, QScanner,
- Collects target metadata.
- Evaluates the target against built-in compliance controls.
- Checks image layers and Dockerfile history for secrets.
- Generates compliance findings.
- Calculates an overall compliance posture.
Compliance Report
The overall posture is reported in the CLI Console, as well as, in Qualys Enterprise TruRisk™ Platform > Container Security > Assets > Images.
Console Output
Qualys Enterprise TruRisk™ Platform Output
Posture Details
| Posture | Description |
|---|---|
| PASS | The control was successfully evaluated and passed. |
| FAIL | The control was evaluated and failed. |
| SKIPPED | The control could not be evaluated. |