Supported Security Scanners

Supported scanners in STO

Harness STO supports over 40 security scanners, they are categorized as follows:

• Harness Security Scanners: Scanners developed, maintained, and fully supported by Harness

• Third-Party Scanners: External commercial or open-source scanners integrated with the Harness platform, not developed or directly maintained by Harness.

  • Open-Source Scanners: A subset of third-party scanners that are open-source.

• Built-in Scanner Steps: Harness-provided scanner steps using pre-configured open-source scanners. These are ready-to-use within Harness pipelines and do not require additional commercial licenses. For a complete guide, refer to Built-in Scanners.

For a comprehensive list of all scanners, you can view them by Scan Type or Target Type further down this page.

Harness Security Scanners

Harness is expanding its native security scanning capabilities. These scanners are developed and maintained directly by Harness.

• API DAST (previously Traceable): A Dynamic Application Security Testing scanner for your APIs. This was formerly known as the Traceable API DAST scanner.

• SAST: A Static Application Security Testing scanner for your Code Repositories.

• SCA: A Software Composition Analysis scanner for your Container Images.

Third-Party Scanners

The following are the list of third-party scanners that are categorized by Scan Type and Target Type. The list includes both commercial and open-source scanners.

Scan Type

Here are the list of scanners supported by STO by scan type.

• Static Application Security Testing - SAST Scanners

• Secret Detection Scanners

• Software Composition Analysis - SCA Scanners

• Container Scanners

• Dynamic Application Security Testing - DAST Scanners

• Infrastructure as Code - IaC Scanners

• AI Scanners

In addition to the listed supported scanners, the Custom Scan step allows the use of various other scanners. For a complete list of supported scanners, refer to Scanners Supported with Custom Scan Step.

Static Application Security Testing - SAST Scanners

Static Application Security Testing (SAST) is a security testing practice that analyzes source code for potential vulnerabilities without executing the application. To configure and run SAST scans, refer Static Application Security Testing documentation.

1. Harness Code

2. Bandit - open-source

3. Black Duck (by Synopsys)

4. Brakeman - open-source

5. Checkmarx

6. Checkmarx One

7. Coverity - open-source

8. CodeQL

9. FOSSA

10. GitHub Advanced Security

11. Mend (formerly known as WhiteSource)

12. Semgrep - open-source option

13. Snyk

14. SonarQube

15. Veracode

16. Wiz

In addition to the listed supported scanners, the Custom Scan step allows the use of various other scanners. For a complete list of supported scanners, refer to Scanners Supported with Custom Scan Step.

Secret Detection Scanners

Secret Detection is a security testing practice that scans code repositories for exposed credentials, API keys, tokens, and other sensitive information. To configure and run secret detection scans, refer Secret Detection documentation.

1. Harness Code

2. Aqua Trivy - open-source

3. Checkmarx One

4. Gitleaks - open-source

5. GitHub Advanced Security

In addition to the listed supported scanners, the Custom Scan step allows the use of various other scanners. For a complete list of supported scanners, refer to Scanners Supported with Custom Scan Step.

Software Composition Analysis - SCA Scanners

Software Composition Analysis (SCA) is a security testing practice that identifies vulnerabilities in open-source dependencies and third-party libraries used in your applications. To configure and run SCA scans, refer Software Composition Analysis documentation.

1. Harness Container

2. Aqua Trivy - open-source

3. Checkmarx

4. Checkmarx One

5. GitHub Advanced Security

6. OSV Scanner - open-source

7. OWASP Dependency-Check - open-source

8. Snyk

9. Veracode

10. Wiz

In addition to the listed supported scanners, the Custom Scan step allows the use of various other scanners. For a complete list of supported scanners, refer to Scanners Supported with Custom Scan Step.

Container Scanners

Container Scanning is a security testing practice that analyzes your container images for potential vulnerabilities. To configure and run container scans, refer Container Scanning documentation.

1. Anchore

2. Aqua Security

3. Aqua Trivy - open-source

4. AWS ECR Scan

5. Black Duck

6. Checkmarx One

7. Grype - open-source

8. Prisma Cloud

9. Snyk

10. Sysdig

11. Wiz

In addition to the listed supported scanners, the Custom Scan step allows the use of various other scanners. For a complete list of supported scanners, refer to Scanners Supported with Custom Scan Step.

Dynamic Application Security Testing - DAST Scanners

Dynamic Application Security Testing (DAST) is a security testing practice that identifies vulnerabilities in running applications by simulating real-world attacks. To configure and run DAST scans, refer Dynamic Application Security Testing documentation.

1. Burp Suite Enterprise Edition

2. Checkmarx One

3. Nikto - open-source

4. Nmap - open-source

5. Traceable

6. Veracode

7. Zap - open-source

In addition to the listed supported scanners, the Custom Scan step allows the use of various other scanners. For a complete list of supported scanners, refer to Scanners Supported with Custom Scan Step.

Infrastructure as Code - IaC Scanners

Infrastructure as Code (IaC) scanning is a security testing practice that analyzes IaC configurations to identify misconfigurations, security vulnerabilities, and compliance issues before deployment. To configure and run IaC scans, refer Infrastructure as Code documentation.

1. Checkmarx One

2. Checkov - open-source

3. Snyk

4. Wiz

AI Scanners

AI Scanners are helps you to identify vulnerabilities in your ML models. To configure and run AI scanners, refer to ModelScan step documentation.

In addition to the listed supported scanners, the Custom Scan step allows the use of various other scanners. For a complete list of supported scanners, refer to Scanners Supported with Custom Scan Step.

---

Target Type

The following sections describe the scanners supported by Harness STO, based on the target type:

• Code repo scanners

• Artifact scanners

• Instance scanners

• Configuration scanners

• Other scanners

In addition to the listed supported scanners, the Custom Scan step allows the use of various other scanners. For a complete list of supported scanners, refer to Scanners Supported with Custom Scan Step.

Code repo scanners

A code scanner can detect one or more of the following issue types in your source code. For information about the specific vulnerabilities detected by each scanner, go to the scanner provider's documentation.

• SAST (Static Application Security Testing): Known vulnerabilities in open-source and proprietary code.

• SCA (Software Composition Analysis): Known vulnerabilities in open-source libraries and packages used by the code.

• Secrets: Hard-coded secrets such as access keys and passwords.

• IaC: Known vulnerabilities in Infrastructure-as-Code files such as Terraform configurations.

• Misconfigurations: Known vulnerabilities in software configurations.

Open Source

Commercial

Aqua Trivy Orchestration, Ingestion Bandit Orchestration, Ingestion Brakeman Orchestration, Ingestion Coverity Ingestion Gitleaks Orchestration, Ingestion Grype Orchestration, Ingestion ModelScan Orchestration, Ingestion Open Source Vulnerabilities (OSV) Orchestration, Ingestion OWASP Dependency Check Orchestration, Ingestion Reapsaw Ingestion Semgrep Code (open-source option) Orchestration, Ingestion SonarQube/SonarCloud (free option) Orchestration, Extraction, Ingestion Checkov Orchestration, Ingestion

Harness Code Orchestration Black Duck Hub Orchestration, Extraction, Ingestion Checkmarx Orchestration, Extraction, Ingestion Checkmarx One Orchestration, Extraction, Ingestion CodeQL Ingestion Data Theorem Extraction, Ingestion Fortify on Demand Orchestration, Extraction, Ingestion Fortify Static Code Analyzer Ingestion Fossa Ingestion GitHub Advanced Security Orchestration, Extraction, Ingestion Mend (formerly WhiteSource) Orchestration, Extraction, Ingestion Nexus IQ Orchestration, Extraction, Ingestion Semgrep Code (paid option) Orchestration, Ingestion Snyk Code Orchestration, Ingestion Snyk Infrastructure as Code Orchestration, Ingestion Snyk Open Source Orchestration, Ingestion SonarQube/SonarCloud Orchestration, Extraction, Ingestion Veracode Orchestration, Extraction, Ingestion Wiz Orchestration, Ingestion

Artifact scanners

An artifact scanner can detect one or more of the following issue types in your container images and other artifacts. For information about the specific vulnerabilities detected by each scanner, go to the scanner provider's documentation.

• SCA (Software Composition Analysis): Known vulnerabilities in open-source libraries and packages used by the code.

• Container Scanning: Identify vulnerabilities in container images.

Open Source

Commercial

Grype Orchestration, Ingestion Aqua Trivy Orchestration, Ingestion Clair Orchestration, Ingestion

Harness Container Orchestration Anchore Enterprise Orchestration, Extraction, Ingestion Aqua Security Orchestration, Ingestion AWS ECR Extraction Black Duck Hub Orchestration, Extraction, Ingestion Docker Content Trust (DCT) Orchestration, Ingestion Mend (formerly WhiteSource) Orchestration, Extraction, Ingestion Prisma Cloud (formerly Twistlock) Orchestration, Extraction, Ingestion Snyk Container Orchestration, Ingestion Sysdig Orchestration, Ingestion Tenable.io Orchestration, Ingestion Wiz Orchestration, Ingestion JFrog Xray Ingestion

Instance scanners

An instance scanner scans a running application for vulnerabilities by simulating a malicious external actor exploiting known vulnerabilities. This is also known as a DAST (Dynamic Application Security Testing) scan.

For information about the specific vulnerabilities detected by each scanner, go to the scanner provider's documentation.

Open Source	Commercial
Metasploit Framework Orchestration, Ingestion Nikto Orchestration, Ingestion Nmap ("Network Mapper") Orchestration, Ingestion OpenVAS Orchestration, Ingestion ZAP Orchestration, Ingestion	Burp Enterprise Orchestration, Extraction, Ingestion Traceable Orchestration, Extraction, Ingestion Fortify on Demand Extraction, Ingestion HCL AppScan Ingestion Qualys Web Application Scanning (WAS) Ingestion Tenable.io Nessus vulnerability scan Orchestration, Ingestion Tenable.io Nessus web app scan Orchestration, Ingestion

Configuration scanners

The following scanners detect misconfigurations in your cloud environment that can result in vulnerabilities. For information about the specific vulnerabilities detected by each scanner, go to the scanner provider's documentation.

Open Source	Commercial
ScoutSuite Ingestion Prowler Orchestration, Ingestion	AWS Security Hub Extraction, Ingestion

Other scanners

If you use a scanner that isn't listed above, you can still ingest your scan results into STO.

• If your scanner can publish to SARIF format, go to Ingest SARIF scan results into STO.

• For other scanners, go to Ingest results from unsupported scanners.

---

Scanners supported with Custom Scan step

The following scanners do not have a dedicated step in STO, but they can be used through the Custom Scan step.

1. Clair

2. Data Theorem

3. Docker Content Trust

4. Fortify Static Code Analyzer

5. Fortify on Demand

6. HCL AppScan

7. Metasploit - open-source

8. Nessus

9. Nexus

10. OpenVAS - open-source

11. Qualys Web Application Scanning

12. Reapsaw - open-source

13. ScoutSuite - open-source

14. Tenable

15. Veracode

16. JFrog Xray

If you are looking for scanners that are not available as steps or are not supported through the Custom Scan step, you can use the Custom Ingest step to import scan results into STO. For detailed instructions, see Ingest results from unsupported scanners

Supported ingestion formats

Here are the scanners that support ingestion scan mode in STO and the data format each scanner expects for ingestion into STO.

Static Analysis Results Interchange Format (SARIF) is an open JSON format supported by many scan tools, especially tools available as GitHub Actions. Harness STO can ingest SARIF 2.1.0 data from any tool that supports this format.

Harness recommends that you publish and ingest using the scanner-specific JSON format when available, because it tends to include more useful information.

• Anchore Enterprise — JSON

• Aqua Security — JSON

• Aqua Trivy — JSON (recommended), SARIF

• AWS ECR — JSON

• AWS Security Hub — JSON

• Bandit — JSON (recommended), SARIF

• Black Duck Hub — JSON

• Brakeman — JSON

• Burp — XML

• Traceable — JSON

• Checkmarx — XML, SARIF

• CheckmarxOne — JSON

• CodeQL — SARIF

• Coverity — XML

• Data Theorem — JSON

• Docker Content Trust — JSON

• Fortify — JSON

• Fortify on Demand — JSON

• Fossa — JSON

• Gitleaks — JSON (recommended), SARIF

• GitHub Advanced Security — SARIF

• HQL AppScan — XML

• Grype — JSON

• Mend (formerly Whitesource) — JSON

• ModelScan — JSON

• Nessus — XML

• Nexus — JSON

• Nikto — XML

• Nmap — XML

• OpenVAS — JSON

• OWASP Dependency Check — JSON

• Prisma Cloud — JSON

• Prowler — JSON

• Qualys — XML

• Reapsaw — JSON

• Semgrep — SARIF

• Snyk — JSON (recommended), SARIF

• SonarQube — JSON

• Sysdig — JSON

• Tenable — JSON

• Veracode — XML

• JFrog Xray — JSON

• Wiz - JSON (recommended), SARIF

• Zed Attack Proxy (ZAP) — JSON

• Checkov - JSON, SARIF