mirror of
https://github.com/aquasecurity/trivy.git
synced 2025-12-05 20:40:16 -08:00
docs: add example of creating whitelist of checks (#7821)
Signed-off-by: nikpivkin <nikita.pivkin@smartforce.io>
This commit is contained in:
@@ -477,13 +477,13 @@ ignore {
|
||||
```
|
||||
|
||||
```bash
|
||||
trivy image --ignore-policy contrib/example_policy/basic.rego centos:7
|
||||
trivy image --ignore-policy examples/ignore-policies/basic.rego centos:7
|
||||
```
|
||||
|
||||
For more advanced use cases, there is a built-in Rego library with helper functions that you can import into your policy using: `import data.lib.trivy`.
|
||||
More info about the helper functions are in the library [here](https://github.com/aquasecurity/trivy/tree/{{ git.tag }}/pkg/result/module.go).
|
||||
|
||||
You can find more example checks [here](https://github.com/aquasecurity/trivy/tree/{{ git.tag }}/pkg/result/module.go)
|
||||
You can create a whitelist of checks using Rego, see the detailed [example](https://github.com/aquasecurity/trivy/tree/{{ git.tag }}/examples/ignore-policies/whitelist.rego). Additional examples are available [here](https://github.com/aquasecurity/trivy/tree/{{ git.tag }}/examples/ignore-policies).
|
||||
|
||||
### By Vulnerability Exploitability Exchange (VEX)
|
||||
| Scanner | Supported |
|
||||
|
||||
13
examples/ignore-policies/whitelist.rego
Normal file
13
examples/ignore-policies/whitelist.rego
Normal file
@@ -0,0 +1,13 @@
|
||||
package trivy
|
||||
|
||||
import rego.v1
|
||||
|
||||
allowed_checks := {
|
||||
"AVD-AWS-0089"
|
||||
}
|
||||
|
||||
default ignore := false
|
||||
|
||||
ignore if not is_check_allowed
|
||||
|
||||
is_check_allowed if input.AVDID in allowed_checks
|
||||
Reference in New Issue
Block a user