> For the complete documentation index, see [llms.txt](https://developer.harness.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://developer.harness.io/security-testing-orchestration/3.0/use-sto.md).

# Use STO

- [Set up Scans](https://developer.harness.io/security-testing-orchestration/3.0/use-sto/set-up-sto-scans.md)
- [Static Application Security Testing - SAST](https://developer.harness.io/security-testing-orchestration/3.0/use-sto/set-up-sto-scans/static-application-security-testing.md): Set up SAST scanning using STO
- [Secret Detection](https://developer.harness.io/security-testing-orchestration/3.0/use-sto/set-up-sto-scans/secret-detection.md): Set up scans to detect secrets
- [Software Composition Analysis - SCA](https://developer.harness.io/security-testing-orchestration/3.0/use-sto/set-up-sto-scans/software-composition-analysis.md): Setup SCA scan with Harness STO
- [Container Scanning](https://developer.harness.io/security-testing-orchestration/3.0/use-sto/set-up-sto-scans/container-scanning.md)
- [Container Scanning](https://developer.harness.io/security-testing-orchestration/3.0/use-sto/set-up-sto-scans/container-scanning/container-scanning.md): Set up Container scanning using STO
- [Base Image Vulnerabilities](https://developer.harness.io/security-testing-orchestration/3.0/use-sto/set-up-sto-scans/container-scanning/base-image-vulnerabilites.md)
- [Detect Base Image Vulnerabilities](https://developer.harness.io/security-testing-orchestration/3.0/use-sto/set-up-sto-scans/container-scanning/base-image-vulnerabilites/base-image-detection.md): Set up container image scanning to identify vulnerabilities in base images.
- [Approve Base Image](https://developer.harness.io/security-testing-orchestration/3.0/use-sto/set-up-sto-scans/container-scanning/base-image-vulnerabilites/approve-base-image.md): Set up container image scanning to identify vulnerabilities in base images.
- [Dynamic Application Security Testing - DAST](https://developer.harness.io/security-testing-orchestration/3.0/use-sto/set-up-sto-scans/dynamic-application-security-testing.md): Set up DAST scanning using STO
- [Infrastructure as Code scanning](https://developer.harness.io/security-testing-orchestration/3.0/use-sto/set-up-sto-scans/infrastructure-as-code-scanning.md): Set-up IaC scanning using STO
- [Built-in scanners](https://developer.harness.io/security-testing-orchestration/3.0/use-sto/set-up-sto-scans/built-in-scanners.md): Scan your targets without the need for scan tool licenses and configurations
- [Harness Security Scanners](https://developer.harness.io/security-testing-orchestration/3.0/use-sto/harness-security-scanners.md)
- [Harness Code Scanner](https://developer.harness.io/security-testing-orchestration/3.0/use-sto/harness-security-scanners/sast.md): Scan code repositories with Harness Code Scanner
- [Harness Container Scanner](https://developer.harness.io/security-testing-orchestration/3.0/use-sto/harness-security-scanners/sca.md): Scan container images with Harness Container Scanner
- [Scanner Configuration](https://developer.harness.io/security-testing-orchestration/3.0/use-sto/sto-scanner-configuration.md)
- [Harness API DAST step configuration (previously Traceable)](https://developer.harness.io/security-testing-orchestration/3.0/use-sto/sto-scanner-configuration/traceable-step-configuration.md): Scan application instances with Harness API DAST.
- [Anchore Enterprise step configuration](https://developer.harness.io/security-testing-orchestration/3.0/use-sto/sto-scanner-configuration/anchore-enterprise-scanner-reference.md): Scan container images with Anchore Enterprise.
- [Aqua Security step configuration](https://developer.harness.io/security-testing-orchestration/3.0/use-sto/sto-scanner-configuration/aquasec-scanner-reference.md): Scan container images with Aqua Security.
- [Aqua Trivy](https://developer.harness.io/security-testing-orchestration/3.0/use-sto/sto-scanner-configuration/trivy.md)
- [Aqua Trivy step configuration](https://developer.harness.io/security-testing-orchestration/3.0/use-sto/sto-scanner-configuration/trivy/aqua-trivy-scanner-reference.md): Scan container images with  Aqua Trivy.
- [Tutorial: Container image scans with Aqua Trivy](https://developer.harness.io/security-testing-orchestration/3.0/use-sto/sto-scanner-configuration/trivy/container-scan-aqua-trivy.md): Scan a container image using Aqua Trivy
- [AWS ECR step configuration](https://developer.harness.io/security-testing-orchestration/3.0/use-sto/sto-scanner-configuration/aws-ecr-scanner-reference.md): Scan container images with AWS ECR.
- [AWS Security Hub step configuration](https://developer.harness.io/security-testing-orchestration/3.0/use-sto/sto-scanner-configuration/aws-security-hub-scanner-reference.md): Scan configurations with AWS Image scanner.
- [Bandit step configuration](https://developer.harness.io/security-testing-orchestration/3.0/use-sto/sto-scanner-configuration/bandit-scanner-reference.md): Scan code repositories with with Bandit.
- [Black Duck step configuration](https://developer.harness.io/security-testing-orchestration/3.0/use-sto/sto-scanner-configuration/black-duck-hub-scanner-reference.md): Scan code repositories and container images with Black Duck.
- [Brakeman step configuration](https://developer.harness.io/security-testing-orchestration/3.0/use-sto/sto-scanner-configuration/brakeman-scanner-reference.md): Scan code repositories with Brakeman.
- [Burp Suite Enterprise Edition step configuration](https://developer.harness.io/security-testing-orchestration/3.0/use-sto/sto-scanner-configuration/burp-scanner-reference.md): Scan application instances with Burp.
- [Checkmarx](https://developer.harness.io/security-testing-orchestration/3.0/use-sto/sto-scanner-configuration/checkmarx.md)
- [Checkmarx step configuration](https://developer.harness.io/security-testing-orchestration/3.0/use-sto/sto-scanner-configuration/checkmarx/checkmarx-scanner-reference.md): Scan code repositories with Checkmarx.
- [Checkmarx One step configuration](https://developer.harness.io/security-testing-orchestration/3.0/use-sto/sto-scanner-configuration/checkmarx/checkmarxone-scanner-reference.md): Scan code repositories, container and web instances with Checkmarx One.
- [Ingest from Checkmarx GitHub Action](https://developer.harness.io/security-testing-orchestration/3.0/use-sto/sto-scanner-configuration/checkmarx/checkmarx-github-action-ingestion.md): Ingest data from Checkmarx GitHub Action.
- [Checkov IaC scanning](https://developer.harness.io/security-testing-orchestration/3.0/use-sto/sto-scanner-configuration/checkov-iac-scan.md): Scan Infrastructure as Code repositories with Checkov. Orchestration and Ingestion modes supported.
- [Clair step configuration](https://developer.harness.io/security-testing-orchestration/3.0/use-sto/sto-scanner-configuration/clair-scanner-reference.md): Scan container images with Clair.
- [CodeQL step configuration](https://developer.harness.io/security-testing-orchestration/3.0/use-sto/sto-scanner-configuration/codeql-scanner-reference.md): Scan code repositories with CodeQL.
- [Coverity step configuration](https://developer.harness.io/security-testing-orchestration/3.0/use-sto/sto-scanner-configuration/coverity-scanner-reference.md): Scan code repositories with Coverity.
- [Data Theorem step configuration](https://developer.harness.io/security-testing-orchestration/3.0/use-sto/sto-scanner-configuration/data-theorem-scanner-reference.md): Scan code repositories with Data Theorem.
- [Docker Content Trust (DCT) step configuration](https://developer.harness.io/security-testing-orchestration/3.0/use-sto/sto-scanner-configuration/docker-content-trust-dct-scanner-reference.md): Scan container images with Docker Content Trust.
- [Fortify Static Code Analyzer step configuration](https://developer.harness.io/security-testing-orchestration/3.0/use-sto/sto-scanner-configuration/fortify-scanner-reference.md): Ingest Fortify scan results into your pipelines.
- [Fortify on Demand step configuration](https://developer.harness.io/security-testing-orchestration/3.0/use-sto/sto-scanner-configuration/fortify-on-demand-scanner-reference.md): Ingest Fortify on Demand scan results into your pipelines.
- [Fossa step configuration](https://developer.harness.io/security-testing-orchestration/3.0/use-sto/sto-scanner-configuration/fossa-scanner-reference.md): Scan code repositories with Fossa.
- [Gitleaks step configuration](https://developer.harness.io/security-testing-orchestration/3.0/use-sto/sto-scanner-configuration/gitleaks-scanner-reference.md): Scan code repositories with Gitleaks.
- [GitHub Advanced Security step configuration](https://developer.harness.io/security-testing-orchestration/3.0/use-sto/sto-scanner-configuration/github-advanced-security.md): Scan code repositories with GitHub Advanced Security (GHAS).
- [Grype](https://developer.harness.io/security-testing-orchestration/3.0/use-sto/sto-scanner-configuration/grype.md)
- [Grype step configuration](https://developer.harness.io/security-testing-orchestration/3.0/use-sto/sto-scanner-configuration/grype/grype-scanner-reference.md): Scan container images with Grype.
- [Set up Grype in air-gapped environments](https://developer.harness.io/security-testing-orchestration/3.0/use-sto/sto-scanner-configuration/grype/grype-setup-in-airgapped.md): Set up Grype in air-gapped environments.
- [HCL AppScan step configuration](https://developer.harness.io/security-testing-orchestration/3.0/use-sto/sto-scanner-configuration/hql-appscan-scanner-reference.md): Ingest DAST scan results from HCL AppScan.
- [Mend (formerly Whitesource) step configuration](https://developer.harness.io/security-testing-orchestration/3.0/use-sto/sto-scanner-configuration/mend-scanner-reference.md): Scan code repositories and container images with Mend.
- [Metasploit step configuration](https://developer.harness.io/security-testing-orchestration/3.0/use-sto/sto-scanner-configuration/metasploit-scanner-reference.md): Scan application instances with Metasploit Framework.
- [ModelScan Step Configuration](https://developer.harness.io/security-testing-orchestration/3.0/use-sto/sto-scanner-configuration/modelscan.md): Scan machine learning models with ModelScan.
- [Nessus step configuration](https://developer.harness.io/security-testing-orchestration/3.0/use-sto/sto-scanner-configuration/nessus-scanner-reference.md): Scan application instances with Nessus.
- [Nexus IQ step configuration](https://developer.harness.io/security-testing-orchestration/3.0/use-sto/sto-scanner-configuration/nexus-scanner-reference.md): Scan code repositories with Nexus.
- [Nikto step configuration](https://developer.harness.io/security-testing-orchestration/3.0/use-sto/sto-scanner-configuration/nikto-scanner-reference.md): Scan application instances with Nikto.
- [Nmap (Network Mapper) step configuration](https://developer.harness.io/security-testing-orchestration/3.0/use-sto/sto-scanner-configuration/nmap-scanner-reference.md): Scan application instances with Nmap.
- [OpenVAS step configuration](https://developer.harness.io/security-testing-orchestration/3.0/use-sto/sto-scanner-configuration/openvas-scanner-reference.md): Scan application instances with OpenVAS.
- [Open Source Vulnerabilities (OSV) step configuration](https://developer.harness.io/security-testing-orchestration/3.0/use-sto/sto-scanner-configuration/osv-scanner-reference.md): Scan code repositories with OSV
- [OWASP Dependency-Check step configuration](https://developer.harness.io/security-testing-orchestration/3.0/use-sto/sto-scanner-configuration/owasp-scanner-reference.md): Scan code repositories with OWASP Dependency Check.
- [Prisma Cloud (formerly Twistlock) step configuration](https://developer.harness.io/security-testing-orchestration/3.0/use-sto/sto-scanner-configuration/prisma-cloud-scanner-reference.md): Scan container images with Prisma Cloud.
- [Prowler step configuration](https://developer.harness.io/security-testing-orchestration/3.0/use-sto/sto-scanner-configuration/prowler-scanner-reference.md): Scan configurations with Prowler.
- [Qualys Web Application Scanning (WAS) step configuration](https://developer.harness.io/security-testing-orchestration/3.0/use-sto/sto-scanner-configuration/qualys-web-app-scanner-reference.md): Scan application instances with Qualys WAS.
- [Reapsaw step configuration](https://developer.harness.io/security-testing-orchestration/3.0/use-sto/sto-scanner-configuration/reapsaw-scanner-reference.md): Scan code repositories with Reapsaw.
- [ScoutSuite step configuration](https://developer.harness.io/security-testing-orchestration/3.0/use-sto/sto-scanner-configuration/scoutsuite-scanner-reference.md): Scan configurations with ScoutSuite.
- [Semgrep](https://developer.harness.io/security-testing-orchestration/3.0/use-sto/sto-scanner-configuration/semgrep.md)
- [Semgrep step configuration](https://developer.harness.io/security-testing-orchestration/3.0/use-sto/sto-scanner-configuration/semgrep/semgrep-scanner-reference.md): Scan code repositories with Semgrep.
- [Tutorial: SAST code scans using Semgrep](https://developer.harness.io/security-testing-orchestration/3.0/use-sto/sto-scanner-configuration/semgrep/sast-scan-semgrep.md): Scan a codebase using Semgrep
- [Snyk](https://developer.harness.io/security-testing-orchestration/3.0/use-sto/sto-scanner-configuration/snyk.md)
- [Snyk step configuration](https://developer.harness.io/security-testing-orchestration/3.0/use-sto/sto-scanner-configuration/snyk/snyk-scanner-reference.md): Scan code repositories and container images with Snyk.
- [Snyk Open Source scanning](https://developer.harness.io/security-testing-orchestration/3.0/use-sto/sto-scanner-configuration/snyk/snyk-open-source.md): Use Harness STO to perform Snyk Open Source scan
- [Snyk Code scanning](https://developer.harness.io/security-testing-orchestration/3.0/use-sto/sto-scanner-configuration/snyk/snyk-code-scanning.md): Use Harness STO to perform Snyk Code scan
- [Snyk Container scanning](https://developer.harness.io/security-testing-orchestration/3.0/use-sto/sto-scanner-configuration/snyk/snyk-container-scanning.md): Use Harness STO to perform Snyk Container scan
- [Snyk IaC scanning](https://developer.harness.io/security-testing-orchestration/3.0/use-sto/sto-scanner-configuration/snyk/snyk-iac-scanning.md): Use Harness STO to perform Snyk IaC scan
- [SonarQube step configuration](https://developer.harness.io/security-testing-orchestration/3.0/use-sto/sto-scanner-configuration/sonarqube-sonar-scanner-reference.md): Scan code repositories with SonarQube.
- [Sysdig step configuration](https://developer.harness.io/security-testing-orchestration/3.0/use-sto/sto-scanner-configuration/sysdig-scanner-reference.md): Scan container images with Sysdig.
- [Tenable step configuration](https://developer.harness.io/security-testing-orchestration/3.0/use-sto/sto-scanner-configuration/tenable-scanner-reference.md): Scan application instances with Tenable.
- [Veracode step configuration](https://developer.harness.io/security-testing-orchestration/3.0/use-sto/sto-scanner-configuration/veracode-scanner-reference.md): Scan code repositories with Veracode.
- [Wiz](https://developer.harness.io/security-testing-orchestration/3.0/use-sto/sto-scanner-configuration/wiz.md)
- [Artifact scans with Wiz](https://developer.harness.io/security-testing-orchestration/3.0/use-sto/sto-scanner-configuration/wiz/artifact-scans-with-wiz.md): Scan artifacts with Wiz. Orchestration and Ingestion modes supported.
- [Code repository scans with Wiz](https://developer.harness.io/security-testing-orchestration/3.0/use-sto/sto-scanner-configuration/wiz/repo-scans-with-wiz.md): Scan code repositories with Wiz. Orchestration and Ingestion modes supported.
- [IaC scans with Wiz](https://developer.harness.io/security-testing-orchestration/3.0/use-sto/sto-scanner-configuration/wiz/iac-scans-with-wiz.md): Scan Infrastructure as Code repositories with Wiz. Orchestration and Ingestion modes supported.
- [Jfrog Xray step configuration](https://developer.harness.io/security-testing-orchestration/3.0/use-sto/sto-scanner-configuration/xray-scanner-reference.md): Scan container images with Jfrog Xray.
- [Zed Attack Proxy (ZAP)](https://developer.harness.io/security-testing-orchestration/3.0/use-sto/sto-scanner-configuration/zap.md)
- [Zed Attack Proxy (ZAP) step configuration](https://developer.harness.io/security-testing-orchestration/3.0/use-sto/sto-scanner-configuration/zap/zap-scanner-reference.md): Scan application instances with ​Zed Attack Proxy (ZAP).
- [Tutorial: DAST app scans using Zed Attack Proxy](https://developer.harness.io/security-testing-orchestration/3.0/use-sto/sto-scanner-configuration/zap/dast-scan-zap.md): Scan a web app using ZAP
- [STO step settings](https://developer.harness.io/security-testing-orchestration/3.0/use-sto/sto-scanner-configuration/security-step-settings-reference.md): This topic lists step settings
- [Custom Scanning and Ingestion](https://developer.harness.io/security-testing-orchestration/3.0/use-sto/sto-custom-scanning-and-ingestion.md)
- [Custom Scan step for supported scanners](https://developer.harness.io/security-testing-orchestration/3.0/use-sto/sto-custom-scanning-and-ingestion/custom-scan-reference.md): Set up scanners using key-value pairs.
- [Custom Ingest step for SARIF and JSON scan results](https://developer.harness.io/security-testing-orchestration/3.0/use-sto/sto-custom-scanning-and-ingestion/custom-ingest-reference.md): Ingest SARIF or JSON scan results.
- [Ingest SARIF scan results](https://developer.harness.io/security-testing-orchestration/3.0/use-sto/sto-custom-scanning-and-ingestion/ingest-sarif-data.md): You can ingest results from any scanner that supports SARIF.
- [Ingest results from unsupported scanners](https://developer.harness.io/security-testing-orchestration/3.0/use-sto/sto-custom-scanning-and-ingestion/ingesting-issues-from-other-scanners.md): You can ingest results from scanners that don't support SARIF.
- [Security Issues](https://developer.harness.io/security-testing-orchestration/3.0/use-sto/sto-security-issues.md)
- [View and manage baseline issues](https://developer.harness.io/security-testing-orchestration/3.0/use-sto/sto-security-issues/issues.md): View and manage issues across all baseline scans in your project.
- [View scan results - Vulnerabilities tab](https://developer.harness.io/security-testing-orchestration/3.0/use-sto/sto-security-issues/view-scan-results.md): View, navigate, discover, and investigate detected issues from an individual scan
- [Export security test results](https://developer.harness.io/security-testing-orchestration/3.0/use-sto/sto-security-issues/export-scan-results.md): Export security test results of a specific pipeline execution.
- [STO Overview Page](https://developer.harness.io/security-testing-orchestration/3.0/use-sto/sto-security-issues/sto-overview.md): The STO Overview page enables you to see all detected issues in your target baselines.
- [Risk and Priortization](https://developer.harness.io/security-testing-orchestration/3.0/use-sto/risk-and-priortization.md)
- [EPSS score](https://developer.harness.io/security-testing-orchestration/3.0/use-sto/risk-and-priortization/epss-score.md): Learn how EPSS scores help prioritize vulnerabilities based on exploitation likelihood.
- [Enforce Policies for Governance](https://developer.harness.io/security-testing-orchestration/3.0/use-sto/enforce-sto-policies-for-governance.md)
- [Create OPA policies to stop STO pipelines automatically](https://developer.harness.io/security-testing-orchestration/3.0/use-sto/enforce-sto-policies-for-governance/create-opa-policies.md): Create OPA policies to stop pipelines automatically.
- [Use security test policies to stop STO pipelines automatically](https://developer.harness.io/security-testing-orchestration/3.0/use-sto/enforce-sto-policies-for-governance/enforce-opa-policies.md): Use security test policies to stop pipelines automatically.
- [AppSec Chatbot](https://developer.harness.io/security-testing-orchestration/3.0/use-sto/sto-chatbot.md)
- [AppSec Chatbot](https://developer.harness.io/security-testing-orchestration/3.0/use-sto/sto-chatbot/sto-chatbot.md): Learn about the AppSec STO Chatbot
- [Severity Override](https://developer.harness.io/security-testing-orchestration/3.0/use-sto/severity-override.md)
- [Manual Severity Override](https://developer.harness.io/security-testing-orchestration/3.0/use-sto/severity-override/manual-override.md): Override the severity level of a vulnerability.
- [Scanner Severity Override](https://developer.harness.io/security-testing-orchestration/3.0/use-sto/severity-override/scanner-override.md): Override the severity level of a vulnerability.
- [Remediate Issues](https://developer.harness.io/security-testing-orchestration/3.0/use-sto/sto-remediate-issues.md)
- [Fix security issues using Harness AI](https://developer.harness.io/security-testing-orchestration/3.0/use-sto/sto-remediate-issues/ai-based-remediations.md): Enhanced remediation using Harness AI.
- [Create Jira Tickets](https://developer.harness.io/security-testing-orchestration/3.0/use-sto/jira-integrations.md): You can create Jira tickets for any issue detected during an STO pipeline execution.
- [Exempt Issues](https://developer.harness.io/security-testing-orchestration/3.0/use-sto/sto-exempt-issues.md)
- [Issue Exemption Workflow](https://developer.harness.io/security-testing-orchestration/3.0/use-sto/sto-exempt-issues/issue-exemption-workflow.md): Overview of issue exemption process in Harness STO.
- [Request Issue Exemption](https://developer.harness.io/security-testing-orchestration/3.0/use-sto/sto-exempt-issues/exemption-workflows.md): Steps to submit an issue exemption request
- [Manage Issue Exemption Requests](https://developer.harness.io/security-testing-orchestration/3.0/use-sto/sto-exempt-issues/manage-exemptions.md): Procedures and best practices for handling issue exemption requests.
- [Set Notifications](https://developer.harness.io/security-testing-orchestration/3.0/use-sto/sto-set-notifications.md)
- [Generate automated emails for detected issues in STO](https://developer.harness.io/security-testing-orchestration/3.0/use-sto/sto-set-notifications/email-notifications.md): Send emails automatically based on severity levels.
- [Set up Slack notifications for detected issues in STO](https://developer.harness.io/security-testing-orchestration/3.0/use-sto/sto-set-notifications/slack-notifications.md): Set up Slack notifications based on severity levels
- [Set up Notifications for Exemptions](https://developer.harness.io/security-testing-orchestration/3.0/use-sto/sto-set-notifications/exemption-notifications.md): Set up notifications for STO exemption events.
- [Dashboards and Reports](https://developer.harness.io/security-testing-orchestration/3.0/use-sto/sto-dashboards-and-reports.md)
- [STO Dashboards overview](https://developer.harness.io/security-testing-orchestration/3.0/use-sto/sto-dashboards-and-reports/sto-dashboards-overview.md): Explore, navigate, and use dashboards by STO.
- [Security Testing Dashboard](https://developer.harness.io/security-testing-orchestration/3.0/use-sto/sto-dashboards-and-reports/security-testing-dashboard.md): View, navigate, discover, and investigate detected issues in the Security Testing Dashboard.
- [STO Usage Dashboard](https://developer.harness.io/security-testing-orchestration/3.0/use-sto/sto-dashboards-and-reports/sto-usage-dashboard.md): Monitor scan activity, track scanner and pipeline usage, and analyze user-based engagement metrics across your account..
- [STO Pipeline Execution Summary Dashboard](https://developer.harness.io/security-testing-orchestration/3.0/use-sto/sto-dashboards-and-reports/sto-pipeline-execution-summary.md): View, analyze, and export scan results for a specific STO pipeline execution, including detailed issue metadata.
- [STO All Occurrences Dashboard](https://developer.harness.io/security-testing-orchestration/3.0/use-sto/sto-dashboards-and-reports/all-occurences-dashboard.md): View, search, filter, and export all raw scanner findings (occurrences) across your Harness account.