> For the complete documentation index, see [llms.txt](https://baric6.gitbook.io/barics-knowledge-base/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://baric6.gitbook.io/barics-knowledge-base/security-programs/audit-and-scanners/trivy-scanner.md).

# Trivy scanner

Targets (what Trivy can scan):

* Container Image
* Filesystem
* Git Repository (remote)
* Virtual Machine Image
* Kubernetes
* AWS

Scanners

* OS packages and software dependencies in use (SBOM)
* Known vulnerabilities (CVEs)
* IaC issues and misconfigurations
* Sensitive information and secrets
* Software licenses

Trivy is available in most common distribution channels. The full list of installation options is available in the Installation page. Here are a few popular examples:

* brew install trivy
* docker run aquasec/trivy
* Download binary from 

{% embed url="<https://github.com/aquasecurity/trivy/releases/latest/>" %}