> For the complete documentation index, see [llms.txt](https://developer.harness.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://developer.harness.io/security-testing-orchestration/use-sto/set-up-sto-scans/container-scanning/container-scanning.md).

# Container Scanning

Container Scanning is a security testing practice that analyzes your container images for potential vulnerabilities. It is a critical step in identifying and addressing security risks early in the software development lifecycle (SDLC).

With Harness Security Testing Orchestration (STO), easily perform container scanning using a wide range of [integrated scanners](#supported-scanners-for-container-scanning). STO also applies its own features, such as results normalization, deduplication of findings within each scanner, and formatting results to make them actionable.

### Set up Container Scanning with Harness STO <a href="#set-up-container-scanning-with-harness-sto" id="set-up-container-scanning-with-harness-sto"></a>

You can use any of the [integrated scanners](#supported-scanners-for-container-scanning) that perform Container Scanning, or you can leverage the Harness STO [Built-in Scanner workflow](/security-testing-orchestration/use-sto/set-up-sto-scans/built-in-scanners.md). The Built-in Scanner step enables you to set up scans without requiring paid licenses or complex configurations. Alternatively, select any scanner from the list below for detailed configuration steps.

{% embed url="<https://youtu.be/__42LZDVZIo?si=_jYgcj86q0aS7oJ->" %}

#### Supported Scanners for Container Scanning <a href="#supported-scanners-for-container-scanning" id="supported-scanners-for-container-scanning"></a>

Below is the list of supported scanners for Container Scanning in Harness STO:

1. [**Anchore**](/security-testing-orchestration/use-sto/sto-scanner-configuration/anchore-enterprise-scanner-reference.md)
2. [**Aqua Security**](/security-testing-orchestration/use-sto/sto-scanner-configuration/aquasec-scanner-reference.md)
3. [**Aqua Trivy**](/security-testing-orchestration/use-sto/sto-scanner-configuration/trivy/aqua-trivy-scanner-reference.md) *- open-source*
4. [**AWS ECR Scan**](/security-testing-orchestration/use-sto/sto-scanner-configuration/aws-ecr-scanner-reference.md)
5. [**Black Duck**](/security-testing-orchestration/use-sto/sto-scanner-configuration/black-duck-hub-scanner-reference.md)
6. [**Checkmarx One**](/security-testing-orchestration/use-sto/sto-scanner-configuration/checkmarx/checkmarxone-scanner-reference.md)
7. [**Grype**](/security-testing-orchestration/use-sto/sto-scanner-configuration/grype/grype-scanner-reference.md) - *open-source*
8. [**Prisma Cloud**](/security-testing-orchestration/use-sto/sto-scanner-configuration/prisma-cloud-scanner-reference.md)
9. [**Snyk**](/security-testing-orchestration/use-sto/sto-scanner-configuration/snyk/snyk-scanner-reference.md)
10. [**Sysdig**](/security-testing-orchestration/use-sto/sto-scanner-configuration/sysdig-scanner-reference.md)
11. [**Wiz**](/security-testing-orchestration/use-sto/sto-scanner-configuration/wiz/artifact-scans-with-wiz.md)

If the scanner you use for container scanning is not listed, you can explore additional [scanners](/security-testing-orchestration/use-sto/sto-custom-scanning-and-ingestion/custom-scan-reference.md) that are compatible with the [Custom Scan step](/security-testing-orchestration/use-sto/sto-custom-scanning-and-ingestion/custom-scan-reference.md). If the Custom Scan step does not support the scanner you need, you can use the [Custom Ingestion](/security-testing-orchestration/use-sto/sto-custom-scanning-and-ingestion/custom-ingest-reference.md) step to ingest and process your scan results.

### Next steps <a href="#next-steps" id="next-steps"></a>

After running a security scan, you can take the following actions:

* **View Scan Results**: See the security scan results in the pipeline execution. [View scan results](/security-testing-orchestration/use-sto/sto-security-issues/view-scan-results.md).
* **Remediate Issues with AI**: Use AI-based suggestions to fix identified vulnerabilities. [Use AI to fix security issues](/security-testing-orchestration/use-sto/sto-remediate-issues/ai-based-remediations.md).
* **Create Jira Tickets**: Create Jira tickets for detected security issues directly from the UI. [Create Jira Tickets](/security-testing-orchestration/use-sto/jira-integrations.md).
* **Exempt issues**: Manage and exempt specific issues based on requirements. [Exemption workflows](/security-testing-orchestration/use-sto/sto-exempt-issues/exemption-workflows.md)
* **Enforce Policies**: Apply OPA policies for control and governance. [Enforce OPA policies](/security-testing-orchestration/use-sto/enforce-sto-policies-for-governance/enforce-opa-policies.md).