# AI use cases for Trivy (aquasecurity/trivy) Repo: [aquasecurity/trivy](https://github.com/aquasecurity/trivy) | Use cases: 3 | Page: https://dedupedai.com/use-cases/aquasecurity-trivy/ Trivy is Aqua Security's open source security scanner. It scans container images, filesystems, remote git repositories, virtual machine images and Kubernetes clusters for known vulnerabilities (CVEs), software dependencies (SBOM), infrastructure as code misconfigurations, secrets and software licenses. It installs through Homebrew, Docker or a binary and integrates with GitHub Actions, a Kubernetes operator and VS Code. This file holds every use case of this repo. Each one starts with a "## " heading and ends with its URL. - Scan a container image for known vulnerabilities: https://dedupedai.com/use-cases/aquasecurity-trivy/scan-a-container-image-for-cves/ - Check a project folder for vulnerabilities, secrets and misconfigurations: https://dedupedai.com/use-cases/aquasecurity-trivy/scan-a-project-for-vulns-secrets-and-misconfigs/ - Get a security summary of a Kubernetes cluster: https://dedupedai.com/use-cases/aquasecurity-trivy/get-a-security-summary-of-a-kubernetes-cluster/ ## How to scan a container image for known vulnerabilities with Trivy Repo: [aquasecurity/trivy](https://github.com/aquasecurity/trivy) | Difficulty: Beginner | Time: 10 minutes | Basis: From the README Run Trivy image on any image to list CVEs in its OS packages and dependencies. **Who it is for:** A developer about to deploy a Docker image who wants to know what known vulnerabilities it carries. **The problem:** Base images and dependencies quietly accumulate CVEs, and you rarely know which ones until something breaks. **The outcome:** A list of vulnerabilities in the image with severities, so you can upgrade or swap the base image. ### Steps 1. Install with `brew install trivy`, or use `docker run aquasec/trivy` 2. Scan an image, for example `trivy image python:3.4-alpine` 3. Read the results by severity and focus on the packages with fixes available 4. Rebuild on a newer base image and scan again to confirm the count went down 5. Add the Trivy GitHub Action to scan images on every build ### Prompt to paste into your agent ```text Install aquasecurity/trivy and scan my image . Summarize the critical and high vulnerabilities, which ones have fixed versions, and whether switching to would remove most of them. ``` ### Caveat A CVE list shows known issues only; it does not prove an image is safe or that each finding is exploitable in your setup. Disclaimer: Third-party repos we don't own or vouch for. AI-generated use cases can be wrong: review everything and run at your own risk. Full text: https://dedupedai.com/disclaimer/ URL: https://dedupedai.com/use-cases/aquasecurity-trivy/scan-a-container-image-for-cves/ ## How to check a project folder for vulnerabilities, secrets and misconfigurations with Trivy Repo: [aquasecurity/trivy](https://github.com/aquasecurity/trivy) | Difficulty: Beginner | Time: 15 minutes | Basis: From the README Run one Trivy fs command that looks for vulnerable dependencies, leaked secrets and IaC mistakes. **Who it is for:** A developer cleaning up a project before open sourcing it or handing it to a client. **The problem:** Separate tools for dependencies, secrets and Terraform or Kubernetes files are a hassle to run together. **The outcome:** One report covering vulnerable dependencies, exposed secrets and infrastructure misconfigurations. ### Steps 1. Install Trivy with `brew install trivy` 2. Run `trivy fs --scanners vuln,secret,misconfig myproject/` on your project folder 3. Fix or rotate any secrets it finds first 4. Upgrade the flagged dependencies and correct the IaC issues and misconfigurations 5. Rerun the same command until the report is clean enough to ship ### Prompt to paste into your agent ```text Run aquasecurity/trivy fs with the vuln, secret and misconfig scanners on . Group the findings by type, propose fixes for each, and list any secrets I must rotate. ``` ### Caveat Misconfiguration checks follow general best practice, so some findings may be intentional choices for your environment. Disclaimer: Third-party repos we don't own or vouch for. AI-generated use cases can be wrong: review everything and run at your own risk. Full text: https://dedupedai.com/disclaimer/ URL: https://dedupedai.com/use-cases/aquasecurity-trivy/scan-a-project-for-vulns-secrets-and-misconfigs/ ## How to get a security summary of a Kubernetes cluster with Trivy Repo: [aquasecurity/trivy](https://github.com/aquasecurity/trivy) | Difficulty: Intermediate | Time: 30 minutes | Basis: From the README Run Trivy k8s to scan a cluster and print a summary report of what needs attention. **Who it is for:** A platform engineer who wants a quick security overview of a cluster without buying a commercial tool. **The problem:** Clusters run many images and manifests, and nobody has a clear picture of their combined risk. **The outcome:** A summary report across the cluster that points to the workloads to fix first. ### Steps 1. Install Trivy and make sure your kubectl context points at the cluster you want to scan 2. Run `trivy k8s --report summary cluster` 3. Review the summary to find the workloads with the most serious findings 4. Fix images and manifests, starting with the highest severities 5. For continuous scanning, look at the Trivy Kubernetes operator in the Ecosystem page ### Prompt to paste into your agent ```text Using aquasecurity/trivy, run a summary scan of my current Kubernetes context and list the ten workloads with the most critical findings, with a suggested fix for each. Do not change anything in the cluster. ``` ### Caveat Scanning a large cluster can take a while and pulls image data, so try it on a test cluster first. Risk, credentials: The scan uses your current kubeconfig credentials, so run it against the intended cluster with read access only. Disclaimer: Third-party repos we don't own or vouch for. AI-generated use cases can be wrong: review everything and run at your own risk. Full text: https://dedupedai.com/disclaimer/ URL: https://dedupedai.com/use-cases/aquasecurity-trivy/get-a-security-summary-of-a-kubernetes-cluster/