SCA (Software Composition Analysis)
Qualys supports Software Composition Analysis (SCA) of code repositories, container images, and containers. An SCA discovers installed open-source software and libraries, as well as associated vulnerabilities, present in your code assets, container images, and containers.
While evaluating the security posture of code repositories, container images, and containers, it is important to identify all software packages present. The SCA scan can be used to identify programming language-based software packages inside images and containers, as well as within source code scanned by QScanner. In addition, metadata information for each image layer is also provided. The SCA scan detects packages for these programming languages: Java, Python, Go, Node.js, .NET, PHP, Ruby, and Rust.
SCA is available for all sensor types (General, Registry, and CI/CD), and is supported for Docker, containerd, and CRI-O runtimes. SCA scanning is also supported for source code repositories scanned through QScanner. SCA scanning is not supported for Mac OS.
Prerequisites
- Update your sensors to sensor version 1.24 or later.
- Relaunch your sensors with the parameter --perform-sca-scan to perform SCA scanning.
How it Works
SCA is not performed by default. You must enable SCA using the parameter --perform-sca-scan when deploying your sensors. When enabled, an SCA is performed after a standard vulnerability scan (Static or Dynamic) on your container images.
When the SCA scan is completed, the sensor uploads the metadata information collected by the scan to the Qualys backend where posture evaluation is performed. You can view SCA data findings in the Container Security UI and API as part of image details.
Vulnerability detection found by the SCA are presented as QIDs. Filters are provided so you can identify the type of scan (SCA, Dynamic or Static) used to detect a particular vulnerability.
During an SCA scan, the following files are scanned for the language-specific software packages:
| Language | Files |
|---|---|
| Python | egg package wheel package |
| Node.js | package.json |
| .NET | packages.lock.json packages.config *.deps.json |
| Java | JAR/WAR/PAR/EAR |
| Go | Binaries built by Go |
| PHP | Composer.lock |
| Ruby | gemspec |
| Rust | Cargo.lock and Binaries built with cargo-auditable |
Search for SCA Scanned Assets
You can search for SCA scanned assets across images, containers, and code repositories using the scanType: token to filter by scan type (Dynamic, Static, or SCA).
- To search images, go to Assets > Images and use scanType: SCA.
- To search containers, go to Assets > Containers and use scanType: SCA.
- To search code repositories, go to Assets > Code and use scanType: SCA.
View SCA Details
Go to Assets > Images, Containers, or Code and select View Details for any asset listed. SCA findings are available in the following tabs.
The Summary tabThe Summary tab
It shows general information about the image. The Scan Types field shows the types of scans run on the image, including SCA.
The Installed Software tabThe Installed Software tab
The Installed Software tab lists software detected by scans. Use the Packages filter to easily switch the list view. Choose All to see all software packages, choose OS to see only Operating System based packages, or choose Non-OS to see SCA related packages.
You can search installed software detected by SCA scans using the search query scanType: SCA.
The Vulnerabilities tabThe Vulnerabilities tab
The Vulnerabilities tab shows vulnerabilities detected by all scans, including SCA scans. The SCAN TYPE column identifies the type of scan used for each detection.
You can search vulnerabilities detected by SCA scans using scanType: SCA.
Note about Vulnerability Counts
You may notice a difference in the number of vulnerabilities reported for an image that has been scanned by SCA and the number of vulnerabilities for the containers launched from the image. This is because the SCA scan detects package-based vulnerabilities which may not apply at the container layer. The image scan reports all vulnerabilities, including OS-based vulnerabilities and non-OS or SCA package related vulnerabilities, whereas the container scan reports only the OS-based vulnerabilities. For code repositories, SCA findings reflect vulnerabilities in packages and dependencies identified within the source code by QScanner.
For example, you scan an image using a sensor launched with the --perform-sca-scan flag enabled and get 25 vulnerabilities reported. You launch a container on this image and it reports 22 vulnerabilities. Three vulnerabilities were excluded, because they were package based.