> For the complete documentation index, see [llms.txt](https://developer.harness.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://developer.harness.io/security-testing-orchestration/3.0/use-sto/sto-scanner-configuration/sysdig-scanner-reference.md).

# Sysdig step configuration

You can scan container images using [Sysdig Vulnerability engine](https://docs.sysdig.com/en/docs/sysdig-secure/vulnerabilities/). Add a Sysdig step to a Build or Security stage and then configure it as described below.

### Important notes for running Sysdig scans in STO <a href="#important-notes-for-running-sysdig-scans-in-sto" id="important-notes-for-running-sysdig-scans-in-sto"></a>

* You need to run the scan step with root access if either of the following apply:
  * You need to run a [Docker-in-Docker background service](/security-testing-orchestration/use-sto/sto-scanner-configuration/security-step-settings-reference.md#configuring-docker-in-docker-dind-for-your-pipeline).
  * You need to add trusted certificates to your scan images at runtime.
* You can set up your STO scan images and pipelines to run scans as non-root and establish trust for your own proxies using custom certificates. For more information, go to [Configure your pipeline to use STO images from private registry](/security-testing-orchestration/3.0/troubleshooting-and-resources/sto-use-cases/set-up-sto-pipelines/configure-pipeline-to-use-sto-images-from-private-registry.md).

### Sysdig step settings for STO scans <a href="#sysdig-step-settings-for-sto-scans" id="sysdig-step-settings-for-sto-scans"></a>

The recommended workflow is to add a Sysdig step to a Security or Build stage and then configure it as described below.

#### Scan <a href="#scan" id="scan"></a>

**Scan Mode**

**Scan Configuration**

#### Target <a href="#target" id="target"></a>

**Type**

**Target and Variant Detection**

**Name**

**Variant**

#### Container image <a href="#container-image" id="container-image"></a>

**Type**

**Domain**

**Name**

**Tag/Digest**

**Access ID**

**Access Token**

**Region**

#### Ingestion File <a href="#ingestion-file" id="ingestion-file"></a>

#### Log Level <a href="#log-level" id="log-level"></a>

#### Fail on Severity <a href="#fail-on-severity" id="fail-on-severity"></a>

#### Additional Configuration <a href="#additional-configuration" id="additional-configuration"></a>

#### Advanced settings <a href="#advanced-settings" id="advanced-settings"></a>

### Proxy settings <a href="#proxy-settings" id="proxy-settings"></a>

### Sysdig pipeline examples <a href="#sysdig-pipeline-examples" id="sysdig-pipeline-examples"></a>

#### Sysdig orchestration pipeline <a href="#sysdig-orchestration-pipeline" id="sysdig-orchestration-pipeline"></a>

If you copy this example, replace the placeholder values with appropriate values for your project, organization, connectors, and access token.

<details>

<summary>YAML pipeline, Sysdig scan, Orchestration mode</summary>

```yaml
pipeline:
  name: sysdig test
  identifier: sysdig_test
  projectIdentifier: default
  orgIdentifier: default
  tags: {}
  stages:
    - stage:
        name: scan
        identifier: scan
        type: SecurityTests
        spec:
          cloneCodebase: false
          execution:
            steps:
              - step:
                  type: Background
                  name: docker
                  identifier: docker
                  spec:
                    connectorRef: YOUR_DOCKER_CONNECTOR_ID
                    image: docker:dind
                    shell: Sh
                    privileged: true
                    resources:
                      limits:
                        memory: 2Gi
                        cpu: 1000m
              - step:
                  type: Sysdig
                  name: Sysdig_1
                  identifier: Sysdig_1
                  spec:
                    mode: orchestration
                    config: default
                    target:
                      name: nodegoat
                      type: container
                      variant: latest
                    advanced:
                      log:
                        level: debug
                    privileged: true
                    image:
                      type: docker_v2
                      name: vulnerables/web-dvwa
                      tag: latest
                    auth:
                      access_token: <+secrets.getValue("YOUR_SYSDIG_ACCESS_TOKEN_SECRET")>
                      domain: https://app.us4.sysdig.com
                    imagePullPolicy: Always
                    resources:
                      limits:
                        memory: 2Gi
                  failureStrategies:
                    - onFailure:
                        errors:
                          - AllErrors
                        action:
                          type: MarkAsSuccess
              - step:
                  type: Run
                  name: Run_1
                  identifier: Run_1
                  spec:
                    connectorRef: YOUR_DOCKER_CONNECTOR_ID
                    image: alpine
                    shell: Sh
                    command: cat /harness/scan-logs
                  failureStrategies:
                    - onFailure:
                        errors:
                          - AllErrors
                        action:
                          type: MarkAsSuccess
          sharedPaths:
            - /addon/results
            - /var/run
          infrastructure:
            type: KubernetesDirect
            spec:
              connectorRef: YOUR_KUBERNETES_CLUSTER_CONNECTOR_ID
              namespace: YOUR_NAMESPACE
              automountServiceAccountToken: true
              nodeSelector: {}
              os: Linux


```

</details>

#### Sysdig ingestion pipeline <a href="#sysdig-ingestion-pipeline" id="sysdig-ingestion-pipeline"></a>

If you copy this example, replace the placeholder values with appropriate values for your project, organization, connectors, and access token.

<details>

<summary>YAML pipeline, Sysdig scan, Ingestion mode</summary>

```yaml

pipeline:
  projectIdentifier: YOUR_PROJECT_ID
  orgIdentifier: YOUR_HARNESS_ORG_ID
  tags: {}
  stages:
    - stage:
        name: sysdig_ingest_scan
        identifier: sysdig_ingest_scan
        type: CI
        spec:
          cloneCodebase: true
          platform:
            os: Linux
            arch: Amd64
          runtime:
            type: Cloud
            spec: {}
          execution:
            steps:
              - step:
                  type: Run
                  name: Run_1
                  identifier: Run_1
                  spec:
                    shell: Sh
                    command: |-
                      # In this example, the codebase connector points to 
                      # https://github.com/GitHubGoneMad/sysdig-scans
                      cp /harness/sysdig-scan-results.json /shared/scan_results/
              - step:
                  type: Sysdig
                  name: Sysdig_1
                  identifier: Sysdig_1
                  spec:
                    mode: ingestion
                    config: default
                    target:
                      type: container
                      detection: manual
                      name: YOUR_CONTAINER_IMAGE_REPO/NAME
                      variant: YOUR_CONTAINER_IMAGE_NAME
                    advanced:
                      log:
                        level: info
                    privileged: false
                    ingestion:
                      file: /shared/scan_results/sysdig-scan-results.json
          sharedPaths:
            - /shared/scan_results/
  properties:
    ci:
      codebase:
        connectorRef: YOUR_CODE_REPO_CONNECTOR_ID
        repoName: YOUR_REPO_NAME
        build: <+input>
  identifier: sysdig_ingestion_test_v2
  name: sysdig_ingestion_test_v2



```

</details>