Use Cases

QScanner has various use cases as mentioned below. 

• Scanning for vulnerabilities

  QScanner detects known vulnerabilities according to the versions of installed packages. The following packages are supported:
   - OS packages
   - Supported SCA Languages
  For example,
  $ ./qscanner --pod US3 --access-token $QUALYS_ACCESS_TOKEN image redhat/ubi8:latest

• Scan on image push in AWS ECR

  QScanner can be launched to scan for vulnerabilities in images that get pushed into Amazon ECR. The push event can be triggered via Event bridge. For more details, refer to AWS ECR.

• Generating SBOM

  You can just generate an SBOM for your target container image by running QScanner in --mode inventory-only. QScanner supports SBOM in the following formats.
  - SPDX JSON
  - SPDX TLV
  - Cyclone DX
  For more details, refer to Data Collection Formats.
  For example,
  $ ./qscanner --mode inventory-only --format spdx image centos

• CI/CD pipeline

  QScanner can be executed with --mode evaluate-policy and integrated in CI/CD pipeline. The exit code of QScanner could be used used to pass or fail builds.
  For example,
  $ ./qscanner --pod US3 --access-token $QUALYS_ACCESS_TOKEN --mode get-report --tags dev,all image openjdk

• GitHub action

  QScanner can be used to generate vulnerability report in SARIF format which can be consumed by GitHub Actions. For more details, refer to Report Formats.
  For example,
  $ ./qscanner --pod US3 --access-token $QUALYS_ACCESS_TOKEN --report-format table,sarif image python