{"id":141,"date":"2022-11-19T14:13:00","date_gmt":"2022-11-19T14:13:00","guid":{"rendered":"http:\/\/blog.firatyasar.com\/?p=141"},"modified":"2023-03-19T14:19:28","modified_gmt":"2023-03-19T14:19:28","slug":"find-vulnerabilities-with-trivy-and-publish-them-in-azure-devops","status":"publish","type":"post","link":"https:\/\/blog.firatyasar.com\/?p=141","title":{"rendered":"Find Vulnerabilities with Trivy and Publish Them in Azure DevOps"},"content":{"rendered":"\n
\"\"\/<\/figure>\n\n\n\n

What is Trivy?<\/h1>\n\n\n\n

Trivy (tri <\/em>pronounced like tri<\/strong>gger, vy<\/em> pronounced like envy<\/strong>) is a simple and comprehensive scanner for Container Images<\/strong>, Rootfs<\/strong>, Filesystem<\/strong>, and Git Repositories <\/strong>to detect vulnerabilities.<\/p>\n\n\n\n

Why We Need Trivy?<\/h1>\n\n\n\n

A short-term problem we face is checking vulnerabilities in our container images, Git Repos and Filesystems. Some research needed to be done to find a suitable open source vulnerability scanner. And we met Trivy after a couple of research.<\/p>\n\n\n\n

What Can Trivy Do?<\/h1>\n\n\n\n

In a simple way of explanation, Trivy can detect vulnerabilities of OS Packages and language-specific packages. Aside from that, it can also scan IaC files like Terraform and Kubernetes, and it can be pretty handy to detect risky configurations that can open the deployments for attacks.<\/p>\n\n\n\n

How to Install Trivy?<\/h1>\n\n\n\n

Install Script
<\/strong>This script downloads Trivy binary based on your OS and architecture.<\/p>\n\n\n\n

curl -sfL https:\/\/raw.githubusercontent.com\/aquasecurity\/trivy\/main\/contrib\/install.sh | sh -s \u2014 -b \/usr\/local\/bin v0.29.2<\/code><\/pre>\n\n\n\n
Homebrew
<\/strong>You can use homebrew on macOS and Linux.<\/p>\n\n\n\n
brew install aquasecurity\/trivy\/trivy<\/code><\/pre>\n\n\n\n
Debian\/Ubuntu
<\/strong>Add repository setting to \/etc\/apt\/sources.list.d.<\/p>\n\n\n\n
sudo apt-get install wget apt-transport-https gnupg lsb-release wget -qO - https:\/\/aquasecurity.github.io\/trivy-repo\/deb\/public.key | sudo apt-key add - echo deb https:\/\/aquasecurity.github.io\/trivy-repo\/deb $(lsb_release -sc) main | sudo tee -a \/etc\/apt\/sources.list.d\/trivy.list sudo apt-get update sudo apt-get install trivy<\/code><\/pre>\n\n\n\n
You can find more installation types in Trivy documentation.<\/p>\n\n\n\n
How to Use Trivy?<\/h1>\n\n\n\n
Scan images for vulnerabilities and secrets
Simply specify an image name (and a tag).<\/p>\n\n\n\n
trivy image <image><\/code><\/pre>\n\n\n\n
to make it more specific.<\/em><\/p>\n\n\n\n
trivy image --severity=HIGH,CRITICAL <image><\/code><\/pre>\n\n\n\n
After implementing the Trivy in our deployment pipelines, we realized we need to make it more developer-friendly. Every time we had to check vulnerabilities for images, we had to find the relevant deployment and check the result of Trivy in the command prompt until we found a method which is to tell Trivy to output the results in a specific format i.e. JUnit. (Thanks to Liam Gulliver)<\/p>\n\n\n\n
An example of the command prompt table.<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
Let\u2019s make it eye-catching!<\/strong>
The azure pipeline can be like the screenshot below, but it can be modified optionally though.<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
In the first step, we have to specify the severity.<\/p>\n\n\n\n
#you can change severity or add another level of vulnerability like LOW,MEDIUM if it's needed.\ntrivy image --severity HIGH,CRITICAL --format template --template \"@template\/junit.tpl\" -o junit-report-high-crit.xml <image><\/code><\/pre>\n\n\n\n
In the second step, we generate a task that creates the output as a result.<\/p>\n\n\n\n
- task : PublishTestResult@2\n  inputs: \n   testResultsFormat: 'JUnit'\n   testResultsFiles: **\/junit-report-high-crit.xml\n   mergeTestResults: true\n   failTaskOnFailedTests: false\n   testRunTitle: 'Trivy - Low and Medium Vulnerabilities'\n  condition: 'always()'<\/code><\/pre>\n\n\n\n
When the build is done, there will be a tab called\u00a0Tests.\u00a0<\/em>It will show all the pre-defined vulnerability levels on Azure DevOps.<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
Details of a critical vulnerability can be shown below. It can be achieved just a simply clicking on one of them.<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
There is one last step for the job\u2019s done. A template file should be added to get the output. You can find all the templates in the Trivy repository in its documents.<\/p>\n\n\n\n
We put the\u00a0junit.tpl<\/strong>\u00a0file below in a template folder in our repository.<\/p>\n\n\n\n
<?xml version=\"1.0\" ?>\n<testsuites>\n{{- range . -}}\n{{- $failures := len .Vulnerabilities }}\n    <testsuite tests=\"1\" failures=\"{{ $failures }}\" time=\"\" name=\"{{  .Target }}\">\n    {{- if not (eq .Type \"\") }}\n        <properties>\n            <property name=\"type\" value=\"{{ .Type }}\"><\/property>\n        <\/properties>\n        {{- end -}}\n        {{ range .Vulnerabilities }}\n        <testcase classname=\"{{ .PkgName }}-{{ .InstalledVersion }}\" name=\"[{{ .Vulnerability.Severity }}] {{ .VulnerabilityID }}\" time=\"\">\n            <failure message={{escapeXML .Title | printf \"%q\" }} type=\"description\">{{escapeXML .Description | printf \"%q\" }}<\/failure>\n        <\/testcase>\n    {{- end }}\n    <\/testsuite>\n{{- end }}\n<\/testsuites><\/code><\/pre>\n\n\n\n
You can find report formats here: https:\/\/aquasecurity.github.io\/trivy\/v0.18.3\/examples\/report\/#default-templates<\/a><\/p>\n\n\n\n
Briefly, making the Trivy result is shown in a better way as easier as implementing it in your build pipelines.<\/p>\n\n\n\n
source: https:\/\/lgulliver.github.io\/trivy-scan-results-to-azure-devops\/<\/a><\/p>\n\n\n\n
F\u0131rat<\/p>\n","protected":false},"excerpt":{"rendered":"
What is Trivy? Trivy (tri pronounced like trigger, vy pronounced like envy) is a simple and comprehensive scanner for Container Images, Rootfs, Filesystem, and Git Repositories to detect vulnerabilities. Why We Need Trivy? A short-term problem we face is checking vulnerabilities in our container images, Git Repos and Filesystems. Some research needed to be done to find a suitable open source vulnerability scanner. And\u2026 Read More »<\/a><\/span><\/p>\n","protected":false},"author":1,"featured_media":144,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[1],"tags":[],"_links":{"self":[{"href":"https:\/\/blog.firatyasar.com\/index.php?rest_route=\/wp\/v2\/posts\/141"}],"collection":[{"href":"https:\/\/blog.firatyasar.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.firatyasar.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.firatyasar.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.firatyasar.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=141"}],"version-history":[{"count":1,"href":"https:\/\/blog.firatyasar.com\/index.php?rest_route=\/wp\/v2\/posts\/141\/revisions"}],"predecessor-version":[{"id":146,"href":"https:\/\/blog.firatyasar.com\/index.php?rest_route=\/wp\/v2\/posts\/141\/revisions\/146"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/blog.firatyasar.com\/index.php?rest_route=\/wp\/v2\/media\/144"}],"wp:attachment":[{"href":"https:\/\/blog.firatyasar.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=141"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.firatyasar.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=141"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.firatyasar.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=141"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}