Trivy Integration
Guide for Resmo Trivy integration
Last updated
Guide for Resmo Trivy integration
Last updated
Trivy is an all-in-one open-source security scanner. It has the ability to generate SBOM (Software Bill of Materials) given a repository, file system, or container image. Using the generated SBOM, it can also find vulnerabilities by comparing them to the CVE databases.
Query your SBOM Metadata, SBOM components, component dependencies, and vulnerabilities identified by Trivy.
Create custom security rules for your Trivy resources.
Get timely notifications of critical rule changes.
Understand asset relationships in graph view.
At Resmo, you are expected to send the SBOM in CycloneDX JSON format through our REST API. When a new SBOM payload is received, Resmo stores it and also scans it for vulnerabilities using Trivy. The SBOM is also periodically scanned in order to catch any future vulnerabilities in your container images or repositories.
This way, you can ensure vulnerabilities are not only caught in build-time and anytime a new one is announced. Consolidating SBOM and vulnerabilities allows you to make cross-tool queries, such as comparing the vulnerabilities with already deployed containers on Kubernetes, Fargate, GCP, and others.
Select Trivy on the Integrations page.
Click the Add Integration button at the bottom right corner of the opening modal.
Then, you must enter your Ingest Key to the related field.
Below, you can find a detailed guide on how you can install Trivy.
The first step of the integration is generating an SBOM from your target, whether it's a source code repository or container images. You can make use of Trivy or your build tools plugins to generate an SBOM.
Trivy can generate SBOM and scan the vulnerabilities at one config, but at Resmo, we only need SBOM from you. To generate an SBOM from a code repository, use the following command:
However, note that this command traverses all files in the repository recursively (not just root), and in some package managers like npm and yarn, it can generate more files. To reduce the scope, it’s recommended to specify the exact file to scan for your package manager. A few examples are given for you to run at the root directory for your source code repositories:
Yarn
NPM
Java (Maven):
Python (pip)
Go
It can also scan the binaries built by Go, that are not minimized with UPX.
For the complete list, please refer to the Trivy documentation.
For complex package managers and situations, please refer to how to generate a proper SBOM for your final artifact to reduce the scope. As an example, there is a Gradle CycloneDX plugin that can be helpful in such cases. You are always welcome to reach out to Resmo customer support as well.
Generating SBOM from your container images will also help you identify some issues that are present with libraries and operating system packages. You can also cross-reference vulnerabilities of container images with the actual images deployed by joining the vulnerability and container tables on image hashes.
Trivy also identifies binaries and some distributions (like Java) and generates their SBOM too, so you might only use container image scanning with Resmo for better results.
Note: One thing to consider is that the names of the container images are not unique. Meaning; in most of the container registries, you can make use of the same name. Therefore, you must note that you can only identify the container images by their ID, not name. This also means you cannot identify containers by tags as well, and someone else might have used the same tag to upload their container.
There are many ways of building container images. If you have a specific use case not mentioned here, please do not hesitate to reach out to customer support.
Using Docker Engine
If the container image is present on the local container image, trivy will first attempt to use that. To scan a container image, you can use the following commands:
Image ID (Full, sha256):
Image ID (Short):
Image Name & Tag (not-recommended)
You need to create a Trivy integration at Resmo. After the integration is created, it will give you an ingest key that we will use it to send the data. You also need to define a componentName variable so that we can identify which repository the SBOM belongs to. This also helps clean up the vulnerabilities as they are resolved. You can use any HTTP Client to send the SBOM JSON file to Resmo Rest API. Here is an example with curl:
Although Trivy has a component name in the generated SBOM files, at Resmo, you need to explicitly provide a component name. Trivy-generated component names are not distinguishable and lack the context of the actual environment. To keep track of the generated SBOM and discovered vulnerabilities, and fixes over time, choosing a proper component name is crucial.
Our recommendations for component names are:
For repositories, use the format GitHub: Let’s build from here <org>/<repository>@<branch>
For Docker images, use the format <repo>/<org>@<environment>
Docker images have both names/tags and IDs. However, most container registries do not have tag immutability; over time, a tag can identify different images which can be misleading. Therefore, at Resmo, we identify container SBOMs by their IDs. But as a result of building images continuously, to reduce clutter and duplication, we keep track of the images by their component names and only keep the latest 5 image IDs per component name.
Important: If you use a different component name for each container image, SBOMs and Vulnerabilities will pile up because Resmo will identify each API call as part of a different component.
When a new SBOM is uploaded, Resmo processes it immediately to generate three resource types:
SBOM (trivy_sbom): Contains the complete SBOM of a component, including the versions of the software, libraries, and packages used.
Vulnerability (trivy_vulnerability): A list of vulnerabilities associated with SBOMs. Contains severity with CVE IDs and the source component (i.e library, package) of the vulnerability.
Resmo uses trivy to scan for vulnerabilities whenever a new SBOM is uploaded through API. Vulnerabilities are also checked periodically for already existing SBOMs to discover new vulnerabilities if they arise after SBOMs are uploaded.
The best way to use Resmo Trivy integration is to integrate it with your CI/CD pipelines to detect issues early. Upon a successful build on the main branch or deployment to a production environment, you can generate an SBOM using Trivy CLI and send the SBOM file to Resmo through our API. Generating an SBOM per branch or non-production environment is also an option, but will possibly generate thousands of SBOM components vulnerabilities which would be duplicated.
We’ve prepared several examples on Github so that you can have a better idea of how Trivy can be integrated into your workflows and how Resmo can be helpful to identify issues.
(Coming soon) Java Spring Boot application with known vulnerabilities (Repository example)
(Coming soon) Kubernetes Cron Job to watch related deployments (Docker image example)
Select Trivy on your Integrations page.
Navigate to the Connected Integrations tab on the opening modal.
Click the Trivy integration you want to remove.
To temporarily disable the integration, click the Disable button from the top right. This way, you can enable it later on. For permanent deletion, click the Delete button instead. This action cannot be undone.
