Sto Supported Scanners

The following sections describe the scanners supported by Harness STO, based on the target type:

• Code repo scanners

• Artifact scanners

• Instance scanners

• Configuration scanners

• Other scanners

In addition to the listed supported scanners, the Custom Scan step allows the use of various other scanners. For a complete list of supported scanners, refer to Scanners Supported with Custom Scan Step.

Code repo scanners

A code scanner can detect one or more of the following issue types in your source code. For information about the specific vulnerabilities detected by each scanner, go to the scanner provider's documentation.

• SAST (Static Application Security Testing): Known vulnerabilities in open-source and proprietary code.

• SCA (Software Composition Analysis): Known vulnerabilities in open-source libraries and packages used by the code.

• Secrets: Hard-coded secrets such as access keys and passwords.

• IaC: Known vulnerabilities in Infrastructure-as-Code files such as Terraform configurations.

• Misconfigurations: Known vulnerabilities in software configurations.

Open Source

Commercial

Aqua Trivy Orchestration, Ingestion Bandit Orchestration, Ingestion Brakeman Orchestration, Ingestion Coverity Ingestion Gitleaks Orchestration, Ingestion Grype Orchestration, Ingestion ModelScan Orchestration, Ingestion Open Source Vulnerabilities (OSV) Orchestration, Ingestion OWASP Dependency Check Orchestration, Ingestion Reapsaw Ingestion Semgrep Code (open-source option) Orchestration, Ingestion SonarQube/SonarCloud (free option) Orchestration, Extraction, Ingestion Checkov Orchestration, Ingestion

Harness Code Orchestration Black Duck Hub Orchestration, Extraction, Ingestion Checkmarx Orchestration, Extraction, Ingestion Checkmarx One Orchestration, Extraction, Ingestion CodeQL Ingestion Data Theorem Extraction, Ingestion Fortify on Demand Orchestration, Extraction, Ingestion Fortify Static Code Analyzer Ingestion Fossa Ingestion GitHub Advanced Security Orchestration, Extraction, Ingestion Mend (formerly WhiteSource) Orchestration, Extraction, Ingestion Nexus IQ Orchestration, Extraction, Ingestion Semgrep Code (paid option) Orchestration, Ingestion Snyk Code Orchestration, Ingestion Snyk Infrastructure as Code Orchestration, Ingestion Snyk Open Source Orchestration, Ingestion SonarQube/SonarCloud Orchestration, Extraction, Ingestion Veracode Orchestration, Extraction, Ingestion Wiz Orchestration, Ingestion

Artifact scanners

An artifact scanner can detect one or more of the following issue types in your container images and other artifacts. For information about the specific vulnerabilities detected by each scanner, go to the scanner provider's documentation.

• SCA (Software Composition Analysis): Known vulnerabilities in open-source libraries and packages used by the code.

• Container Scanning: Identify vulnerabilities in container images.

Open Source

Commercial

Grype Orchestration, Ingestion Aqua Trivy Orchestration, Ingestion Clair Orchestration, Ingestion

Harness Container Orchestration Anchore Enterprise Orchestration, Extraction, Ingestion Aqua Security Orchestration, Ingestion AWS ECR Extraction Black Duck Hub Orchestration, Extraction, Ingestion Docker Content Trust (DCT) Orchestration, Ingestion Mend (formerly WhiteSource) Orchestration, Extraction, Ingestion Prisma Cloud (formerly Twistlock) Orchestration, Extraction, Ingestion Snyk Container Orchestration, Ingestion Sysdig Orchestration, Ingestion Tenable.io Orchestration, Ingestion Wiz Orchestration, Ingestion JFrog Xray Ingestion

Instance scanners

An instance scanner scans a running application for vulnerabilities by simulating a malicious external actor exploiting known vulnerabilities. This is also known as a DAST (Dynamic Application Security Testing) scan.

For information about the specific vulnerabilities detected by each scanner, go to the scanner provider's documentation.

Open Source	Commercial
Metasploit Framework Orchestration, Ingestion Nikto Orchestration, Ingestion Nmap ("Network Mapper") Orchestration, Ingestion OpenVAS Orchestration, Ingestion ZAP Orchestration, Ingestion	Burp Enterprise Orchestration, Extraction, Ingestion Traceable Orchestration, Extraction, Ingestion Fortify on Demand Extraction, Ingestion HCL AppScan Ingestion Qualys Web Application Scanning (WAS) Ingestion Tenable.io Nessus vulnerability scan Orchestration, Ingestion Tenable.io Nessus web app scan Orchestration, Ingestion

Configuration scanners

The following scanners detect misconfigurations in your cloud environment that can result in vulnerabilities. For information about the specific vulnerabilities detected by each scanner, go to the scanner provider's documentation.

Open Source	Commercial
ScoutSuite Ingestion Prowler Orchestration, Ingestion	AWS Security Hub Extraction, Ingestion

Other scanners

If you use a scanner that isn't listed above, you can still ingest your scan results into STO.

• If your scanner can publish to SARIF format, go to Ingest SARIF scan results into STO.

• For other scanners, go to Ingest results from unsupported scanners.