Findings come inContainer & infrastructure
Trivy
Ingests Trivy's container image, filesystem and IaC results and ties each one to the image or repository it belongs to, so a base-image upgrade shows up as one fix and not forty findings.
What the connector does
- Image, filesystem and configuration scan results
- Image digests treated as identity, so a retagged image is not a new asset
- Package vulnerabilities correlated with the same package reported by other sources
- Misconfigurations mapped to CWE for compliance control coverage
Credential required
None beyond access to wherever the reports are published — Trivy runs in your pipeline, not here.
What this connector is for
Container scanning produces volume. A single outdated base image can generate dozens of findings across every service that builds on it, and a list that repeats one fix forty times is a list nobody works through. The platform's deduplication is what turns that back into one piece of work.
What is ingested
Vulnerabilities in OS and language packages, and misconfigurations from IaC scanning. Images are identified by digest where one is available and by repository reference otherwise — the distinction is not cosmetic: it is what stops a retagged image from arriving as a brand new asset with a brand new set of findings.
What happens next
Findings attach to the image or repository, roll up to the application that ships it, and inherit that application's owner and criticality. Where the same package vulnerability is also reported by a dependency scanner, both become one finding. Misconfigurations mapped to a weakness class feed the compliance control coverage report alongside everything else.
What you have to grant
Nothing in Trivy itself. It runs where your builds run; the platform reads the reports it produces.