Does servasec support Trivy's SBOM output?

Yes. Trivy can generate SBOM in CycloneDX format, and servasec can ingest the SARIF output that includes vulnerability data alongside SBOM information.

Can I scan both images and filesystems?

Yes. Trivy supports both modes. Push the results from each scan type to servasec and they will be normalized and displayed together in the dashboard.

Supported/Container / SCA

Trivy + servasec

Comprehensive vulnerability scanner for containers, filesystems, and Git repositories. Covers OS packages and language dependencies.

What is Trivy?

Trivy is a comprehensive and versatile security scanner by Aqua Security. It can find vulnerabilities, misconfigurations, secrets, and SBOM in containers, filesystems, git repositories, Kubernetes, and more. Trivy is the most popular open source vulnerability scanner for containers, with support for all major package managers and operating systems.

Container image scanningOS package vulnerability detectionLanguage dependency scanning (npm, pip, go, etc.)IaC misconfiguration detectionSBOM generation with Syft

Integrate Trivy with servasec

Install Trivy

Install Trivy via the official install script or Docker.

curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b /usr/local/bin

Scan a container image

Run Trivy against a container image or filesystem.

trivy image --format sarif -o results.sarif nginx:latest

Push to servasec

Send the SARIF results to your servasec instance.

curl -X POST "$SSC_PUBLIC_URL/api/ingest" \
  -H "X-Api-Token: $API_TOKEN" \
  -F "[email protected]"

What servasec adds to Trivy

Unified vulnerability view

See container vulnerabilities alongside application-level SAST and SCA findings.

Severity trending

Track vulnerability counts over time to measure improvement.

Webhook alerts

Get notified when critical container vulnerabilities are detected.

Try Trivy with servasec

Self-host servasec and connect Trivy in minutes. AGPLv3 licensed, full data ownership.