Trivy integration
Run Trivy with JSON output (trivy image --format json) and upload the report against the Trivy source. Every vulnerability in the report becomes a tracked finding on an asset named after the scanned artifact.
Scan types imported
- Container image vulnerabilities (OS packages)
- Language / library dependency CVEs
File import
The template walks Results[].Vulnerabilities[] and uses ArtifactName as the asset.
What Centraleyezer expects in the file
- Unmodified Trivy JSON: VulnerabilityID, Severity (CRITICAL/HIGH/MEDIUM/LOW), PkgID, Description, References, CVSS V3Vector and V3Score, CweIDs, InstalledVersion and FixedVersion.
- The finding’s target records the affected package; installed and fixed versions are preserved for remediation tracking.
- The artifact name (image reference or path) is matched against your assets.
How imported findings are risk-scored
Every Trivy finding is normalised into Centraleyezer’s risk model on import: the scanner’s native severity scale maps to a configurable DREAD vector (Damage, Reproducibility, Exploitability, Affected users, Discoverability), which combines with asset criticality, network exposure, exploitability intelligence and the platform’s other risk factors to produce one comparable risk score across every scanner you run. CVE, CVSS and CWE metadata are preserved on the finding for reference and reporting, and duplicate findings from repeated imports are automatically correlated instead of creating noise.