Supported scanning tools
The following table lists the various scanning tools that are integrated into DevSecOps pipelines to provide continuous security checks and monitoring. These scans run at various stages of the Continuous Integration (CI), Continuous Development (CD), and Continuous Deployment (CC) pipelines.
| Tool | Scan | Description | Scan type |
|---|---|---|---|
| IBM Cloud Code Risk Analyzer | Code Risk Analyzer (CRA) analyzes your code for vulnerabilities and compliance with certain rules. | compliance checks stage of CI/CC pipelines |
Dependency scan |
| Checkov | Checkov is a static analysis tool for Infrastructure-as-Code (IaC). It scans Terraform plans, Kubernetes manifests, Helm charts, and Dockerfiles for security misconfigurations and compliance violations. | compliance checks stage of PR app preview/CI/CC pipelines |
Infrastructure-as-Code scan |
| Syft and Grype | Syft and Grype analyze your code for vulnerabilities and compliance with certain rules. | compliance checks stage of PR app preview/CI/CC pipelines |
Dependency scan |
| Gosec | Gosec scan can be used to inspect Golang source code in your scanned repositories. | static scan stage of CI/CC pipelines |
Static scan (SAST) |
| SonarQube | SonarQube provides an overview of the overall health and quality of your source code and highlights issues that are found in new code. | static scan stage of CI/CC pipelines |
Static scan (SAST) |
| TFSec | TFSec is a static analysis security scanner for Terraform code. It detects security misconfigurations and compliance issues in Terraform infrastructure definitions. | compliance checks stage of CI/CC pipelines |
Infrastructure-as-Code scan |
| TFLint | TFLint is a Terraform linter that detects errors, deprecated syntax, and cloud provider-specific issues in Terraform configurations. | static scan stage of CI/CC pipelines |
Infrastructure-as-Code scan |
| Terraform format and validate | Terraform format and validate checks Terraform configuration files for formatting consistency and configuration validity. | static scan stage of CI/CC pipelines |
Infrastructure-as-Code scan |
| OWASP ZAP | Zed Attack Proxy (ZAP) is a free and open source penetration testing tool that is maintained under the umbrella of OWASP. | owasp zap sub-pipeline in CI pipeline and dynamic scan stage of CI/CC pipelines |
Dynamic scan (DAST) |
| IBM Cloud Vulnerability Advisor | The DevSecOps pipeline uses the Vulnerability Advisor (VA) to identify vulnerabilities (CVEs) within Docker images. | scan artifact stage of CI/CC pipelines |
Containerized image scan |
| Sysdig | Sysdig scan uses the Sysdig inline scanner to identify vulnerabilities (CVEs) within Docker images. | scan artifact stage of CI/CC pipelines |
Containerized image scan |
| Detect Secrets | Detect-secrets is a client-side security tool that detects secrets within a codebase to remediate and prevent secret leaks. | detect secrets stage of CI/CC pipelines |
Secrets scan |
| SLSA attestation | SLSA attestation is provided to validate the supply chain security and provide provenance of build. | build artifact stage of CI/CC pipelines |
Supply chain security |