Trivy integration
Filter Trivy's comprehensive scan output to focus on exploitable vulnerabilities.
Integration details
Primary category
Container Image Security
Sync direction
Trivy ↔ Konvu
Findings are ingested from Trivy into Konvu. Based on your workflow, Konvu can then push context, status changes, and severity updates back to Trivy.
Status
Available
What is Trivy?
Trivy is an open-source vulnerability scanner that scans container images, filesystems, Git repositories, Kubernetes clusters, and IaC files for CVEs, misconfigurations, and secrets.
Why connect Trivy to Konvu
- Cut through Trivy's exhaustive CVE lists by surfacing only vulnerabilities that are exploitable in your specific codebase and configuration.
- Bridge the gap between Trivy's CLI output and your team's workflow with centralized triage and evidence tracking.
- Prioritize SBOM findings based on exploitability in your environment, not just severity scores.
How it works
Scan
Trivy produces findings from scans or assessments.
Ingest & enrich
Konvu ingests those findings and enriches them with code, configuration, and deployment context.
Assess exploitability
Konvu determines exploitability and recommended action with evidence attached.
Sync decisions
Based on your workflow, Konvu can push context, status updates, and severity adjustments back into Trivy.
Quick setup
Configure Trivy from the integrations list in Konvu.
- 1Go to /configuration/integrations in Konvu and choose Trivy.
- 2Authorize access and confirm the data sources you want to sync.
- 3Save the configuration to start syncing.
Sync direction
Trivy ↔ Konvu
Findings are ingested from Trivy into Konvu. Based on your workflow, Konvu can then push context, status changes, and severity updates back to Trivy.
More integrations
View all
Grype
Focus Grype's container image scan results on vulnerabilities that are actually exploitable.
Snyk
Triage Snyk vulnerabilities across code, dependencies, and containers with exploit context.
Anchore
Triage Anchore policy violations and SBOM vulnerabilities with exploitability analysis.
Aqua Security
Triage Aqua image CVEs and vulnerability findings with exploitability analysis.
Docker Scout
Focus Docker Scout recommendations on vulnerabilities exploitable in your environment.
Sysdig
Prioritize Sysdig vulnerability findings with environment-specific exploitability analysis.