Use Cases
QScanner has various use cases as mentioned below.
- Scanning for vulnerabilities
QScanner detects known vulnerabilities according to the versions of installed packages. The following packages are supported:
- OS packages
- Supported SCA Languages
For example,
$ ./qscanner --pod US3 --access-token $QUALYS_ACCESS_TOKEN image redhat/ubi8:latest
- Scan on image push in AWS ECR
QScanner can be launched to scan for vulnerabilities in images that get pushed into Amazon ECR. The push event can be triggered via Event bridge. For more details, refer to AWS ECR.
- Generating SBOM
You can just generate an SBOM for your target container image by running QScanner in
--mode inventory-only
. QScanner supports SBOM in the following formats.
- SPDX JSON
- SPDX TLV
- Cyclone DX
For more details, refer to Data Collection Formats.
For example,
$ ./qscanner --mode inventory-only --format spdx image centos
- CI/CD pipeline
QScanner can be executed with
--mode evaluate-policy
and integrated in CI/CD pipeline. The exit code of QScanner could be used used to pass or fail builds.
For example,
$ ./qscanner --pod US3 --access-token $QUALYS_ACCESS_TOKEN --mode get-report --tags dev,all image openjdk
- GitHub action
QScanner can be used to generate vulnerability report in SARIF format which can be consumed by GitHub Actions. For more details, refer to Report Formats.
For example,
$ ./qscanner --pod US3 --access-token $QUALYS_ACCESS_TOKEN --report-format table,sarif image python