> For the complete documentation index, see [llms.txt](https://developer.harness.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://developer.harness.io/security-testing-orchestration/use-sto/sto-scanner-configuration/xray-scanner-reference.md).

# Jfrog Xray step configuration

You can ingest scan results for your container images from [JFrog Xray](https://jfrog.com/help/r/jfrog-security-documentation).

### Workflow descriptions <a href="#workflow-descriptions" id="workflow-descriptions"></a>

This workflow applies to scanner integrations that support Ingestion mode.

1. Add a Build or Security stage to your pipeline.
2. Add a Run step and set it up to save your scan results to a shared folder.

   For more information, go to [Run an ingestion scan in an STO Pipeline](/security-testing-orchestration/new-to-sto/key-concepts/ingest-scan-results-into-an-sto-pipeline.md).
3. Add a [Custom Scan](/security-testing-orchestration/use-sto/sto-custom-scanning-and-ingestion/custom-scan-reference.md) step.
4. Review the [Important notes for Custom Scan steps](/security-testing-orchestration/use-sto/sto-custom-scanning-and-ingestion/custom-scan-reference.md#important-notes-for-custom-scan-steps) for additional requirements and relevant information.
5. Add the relevant `key:value` pairs to **Settings**.

**Required settings**

* [Product name](#product-name)
* [Scan type](#scan-type)
* [Policy type](#policy-type)
* [Product config name](#product-config-name)
* [Target and variant](#target-and-variant)
* [Ingestion file](#ingestion-file)
* [Fail on severity](#fail-on-severity)

<details>

<summary>YAML step example</summary>

```yaml
- step:
    type: Security
    name: custom_scan_xray
    identifier: custom_scan_xray
    spec:
      privileged: true
      settings:
        policy_type: ingestionOnly
        scan_type: containerImage
        product_name: xray
        product_config_name: default
        target_name: YOUR_REPO/YOUR_IMAGE
        target_variant: YOUR_TAG
        ingestion_file: /shared/scan_results/xray2.json
```

</details>

### Custom Scan step settings for JFrog XRay <a href="#custom-scan-step-settings-for-jfrog-xray" id="custom-scan-step-settings-for-jfrog-xray"></a>

#### Scanner settings <a href="#scanner-settings" id="scanner-settings"></a>

These settings are required.

**Product name**

**Key**

```
product_name
```

**Value**

```
xray
```

**Scan type**

**Key**

```
scan_type
```

**Value**

```
containerImage
```

**Policy type**

**Key**

```
policy_type
```

**Value**

```
ingestionOnly
```

**Product config**

**Key**

```
product_config_name
```

**Value**

```
default
```

#### Target and variant <a href="#target-and-variant" id="target-and-variant"></a>

Every Custom Scan step needs a [target and baseline](/security-testing-orchestration/new-to-sto/key-concepts/targets-and-baselines.md).

* [Target name](#target-name)
* [Target variant](#target-variant)

**Target name**

**Key**

```yaml
target_name
```

**Value**

A user-defined label for the code repository, container, application, or configuration to scan. Specify a unique, descriptive name. This makes it much easier to navigate your scan results in the STO UI.

**Target variant**

**Key**

```yaml
target_variant
```

**Value**

A [user-defined label](/security-testing-orchestration/new-to-sto/key-concepts/targets-and-baselines.md) for the branch, tag, or other target variant to scan.

#### Ingestion file <a href="#ingestion-file" id="ingestion-file"></a>

This setting applies to Custom Scan steps when the `policy_type` is [`ingestionOnly`](/security-testing-orchestration/new-to-sto/key-concepts/ingest-scan-results-into-an-sto-pipeline.md).

**Key**

```
ingestion_file
```

**Value**

The path to your scan results when running an [Ingestion scan](/security-testing-orchestration/new-to-sto/key-concepts/ingest-scan-results-into-an-sto-pipeline.md), for example `/shared/scan_results/myscan.latest.sarif`.

* The data file must be in a [supported format](/security-testing-orchestration/new-to-sto/sto-whats-supported/scanners.md#supported-ingestion-formats) for the scanner.
* The data file must be accessible to the scan step. It's good practice to save your scan results to a [shared path](/continuous-integration/new-to-harness-ci/key-concepts.md#stages) in your stage. In the visual editor, go to the stage where you're running the scan. Then go to **Overview** > **Shared Paths**. You can also add the path to the YAML stage definition like this:

  ```yaml
      - stage:
        spec:
          sharedPaths:
            - /shared/scan_results
  ```

#### Fail on severity <a href="#fail-on-severity" id="fail-on-severity"></a>

If the scan finds any vulnerability with the specified [severity level](/security-testing-orchestration/new-to-sto/key-concepts/severities.md) or higher, the pipeline fails automatically. `NONE` means do not fail on severity.

For more information, go to:

* [STO workflows for blocking builds and PRs](/security-testing-orchestration/troubleshooting-and-resources/sto-use-cases/stop-builds-based-on-scan-results/stop-pipelines-overview.md).
* [Exemptions to override Fail on Severity thresholds for specific issues in STO](/security-testing-orchestration/use-sto/sto-exempt-issues/exemption-workflows.md)

**Key**

```
fail_on_severity
```

**Value**

```
CRITICAL
```

```
MEDIUM
```

```
LOW
```

```
INFO
```

```
NONE
```

### YAML pipeline example <a href="#yaml-pipeline-example" id="yaml-pipeline-example"></a>

The following pipeline example shows a simple ingestion workflow. The Run step downloads a results file to `/shared/scan_results/xray2.json`. The Custom Scan step then ingests the file.

For information about running scans using XRay, go to the JFrog documentation.

```yaml

pipeline:
  name: xray_ingest_example
  identifier: xray_ingest_example
  projectIdentifier: default
  orgIdentifier: default
  tags: {}
  properties:
    ci:
      codebase:
        connectorRef: stoplugins
        build: <+input>
  stages:
    - stage:
        name: xray_scan_stage
        identifier: xray_scan_stage
        description: ""
        type: SecurityTests
        spec:
          cloneCodebase: true
          caching:
            enabled: true
            paths: []
          platform:
            os: Linux
            arch: Amd64
          runtime:
            type: Cloud
            spec: {}
          execution:
            steps:
              - step:
                  type: Run
                  name: pull_from_s3
                  identifier: pull_from_s3
                  spec:
                    connectorRef: YOUR_IMAGE_REGISTRY_CONNECTOR_ID
                    image: amazon/aws-cli
                    shell: Sh
                    command: aws s3api get-object --bucket my-xray-scan-results --key YOUR_RESULTS_FILE /shared/scan_results/YOUR_RESULTS_FILE
                    envVariables:
                      AWS_ACCESS_KEY_ID: <+secrets.getValue("YOUR_AWS_ACCESS_KEY")>
                      AWS_SECRET_ACCESS_KEY: <+secrets.getValue("YOUR_SECRET_ACCESS_KEY")>
                      AWS_DEFAULT_REGION: us-east-1
                  when:
                    stageStatus: Success
              - step:
                  type: Security
                  name: custom_scan_xray
                  identifier: custom_scan_xray
                  spec:
                    privileged: true
                    settings:
                      policy_type: ingestionOnly
                      scan_type: containerImage
                      product_name: xray
                      product_config_name: default
                      target_name: YOUR_REPO/YOUR_IMAGE
                      target_variant: YOUR_TAG
                      ingestion_file: /shared/scan_results/YOUR_RESULTS_FILE
          sharedPaths:
            - /shared/scan_results/

```