> For the complete documentation index, see [llms.txt](https://developer.harness.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://developer.harness.io/security-testing-orchestration/3.0/use-sto/sto-scanner-configuration/grype/grype-scanner-reference.md).

# Grype step configuration

You can scan your container images and ingest results from [Grype](https://github.com/anchore/grype).

For information about setting up Grype in an air-gapped environment, go to [Set up Grype in air-gapped environments](/security-testing-orchestration/use-sto/sto-scanner-configuration/grype/grype-setup-in-airgapped.md).

### Important notes for running Grype scans in STO <a href="#important-notes-for-running-grype-scans-in-sto" id="important-notes-for-running-grype-scans-in-sto"></a>

* You can utilize custom STO scan images and pipelines to run scans as a non-root user. For more details, refer [Configure your pipeline to use STO images from private registry](/security-testing-orchestration/3.0/troubleshooting-and-resources/sto-use-cases/set-up-sto-pipelines/configure-pipeline-to-use-sto-images-from-private-registry.md).
* STO supports three different approaches for loading self-signed certificates. For more information, refer [Run STO scans with custom SSL certificates](/security-testing-orchestration/3.0/troubleshooting-and-resources/sto-use-cases/secure-sto-pipelines/ssl-setup-in-sto.md#supported-workflows-for-adding-custom-ssl-certificates).

### Grype step settings for STO <a href="#grype-step-settings-for-sto" id="grype-step-settings-for-sto"></a>

The recommended workflow is to add a Grype step to a Security or Build stage and then configure it as described below.

#### Scan <a href="#scan" id="scan"></a>

**Scan Mode**

**Scan Configuration**

#### Target <a href="#target" id="target"></a>

**Type**

**Target and Variant Detection**

**Name**

**Variant**

#### Ingestion File <a href="#ingestion-file" id="ingestion-file"></a>

#### Container image <a href="#container-image" id="container-image"></a>

**Type**

**Domain**

**Name**

**Tag/Digest**

**Access Id**

**Access Token**

#### Log Level <a href="#log-level" id="log-level"></a>

#### Additional CLI flags <a href="#additional-cli-flags" id="additional-cli-flags"></a>

Use this field to run the [`grype`](https://github.com/anchore/grype?tab=readme-ov-file) binary with CLI arguments such as:

`--only-fixed`

With this flag, `grype` reports only vulnerabilities that have known fixes.

#### Fail on Severity <a href="#fail-on-severity" id="fail-on-severity"></a>

#### Settings <a href="#settings" id="settings"></a>

#### Additional Configuration <a href="#additional-configuration" id="additional-configuration"></a>

#### Advanced settings <a href="#advanced-settings" id="advanced-settings"></a>

### Configure Anchore Grype as a Built-in Scanner <a href="#configure-anchore-grype-as-a-built-in-scanner" id="configure-anchore-grype-as-a-built-in-scanner"></a>

The Anchore Grype scanner is available as a [built-in scanner](/security-testing-orchestration/3.0/use-sto/set-up-sto-scans/built-in-scanners.md) in STO. Configuring it as a built-in scanner enables the step to automatically perform scans using the free version without requiring any licenses. Follow these steps to set it up:

1. Search for **Container** in the step palette or navigate to the **Built-in Scanners** section and select the **Container** step.
2. Select **Anchore Grype** from the list of scanners.
3. Expand the **Additional CLI Flags** section if you want to configure optional CLI flags.
4. Configure the **Container Information** by setting the [Type](#type-1) and [Image](#container-image).
5. Click **Add Scanner** to save the configuration.

The scanner will automatically use the free version, detect scan targets, and can be further configured by clicking on the step whenever needed.

### Proxy settings <a href="#proxy-settings" id="proxy-settings"></a>

### Troubleshoot "vulnerability database build date exceeds max allowed age" exception <a href="#troubleshoot-vulnerability-database-build-date-exceeds-max-allowed-age-exception" id="troubleshoot-vulnerability-database-build-date-exceeds-max-allowed-age-exception"></a>

The full exception is: `db could not be loaded: the vulnerability database was built n weeks ago (max allowed age is 5 days)`

This exception indicates that the Grype step in the STO process is unable to load the vulnerability database due to its age exceeding the maximum allowed age of 5 days. If the environment where you're running these scans has restricted internet connectivity (firewalled), you must set up a local database for Grype to update itself. For comprehensive documentation for the initial setup, configuring the local database, and final configuration, go to [Set up Grype in air-gapped environments](/security-testing-orchestration/use-sto/sto-scanner-configuration/grype/grype-setup-in-airgapped.md).

While Harness updates the database every time it rebuilds the Grype image, this is primarily done for performance reasons. A fresher database requires less time and effort to update at runtime. However, this update is not sufficient to bypass the database access requirement, as the maximum allowed age is 5 days. You can temporarily disable the age check and run Grype with the database it ships with, but this is not recommended from a security standpoint. It's advisable to follow the provided instructions to resolve the database access issue in a more secure manner.