Skip to content

Instantly share code, notes, and snippets.

@julianoborba

julianoborba/export-trivy-json-as-csv.txt

Created February 9, 2022 15:10
Show Gist options
  • Save julianoborba/b1c8803f3e4e0eaa3c806f60652f4d08 to your computer and use it in GitHub Desktop.
Save julianoborba/b1c8803f3e4e0eaa3c806f60652f4d08 to your computer and use it in GitHub Desktop.
Download ZIP
Export Aquasec Trivy JSON report as flat CSV
Raw
export-trivy-json-as-csv.txt
trivy image --no-progress --light --vuln-type os -f json -o "trivy-report.json" --severity "UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL" "foo/bar:latest"
cat trivy-report.json
# OUTPUT:
# {
# "DockerImage": "foo/bar:latest",
# "Results": [
# {
# "Target": "foo/bar:latest (foobar 3.12.1)",
# "Vulnerabilities": [
# {
# "VulnerabilityID": "CVE-2021-44228",
# "PkgName": "logFooBar",
# "InstalledVersion": "2-foobar",
# "Severity": "CRITICAL"
# }
# ]
# }
# ]
# }
cat trivy-report.json | jq '{ DockerImage: .DockerImage, Results: .Results | [.[]? | { Vulnerabilities: .Vulnerabilities | [.[]? | { PkgName: .PkgName, InstalledVersion: .InstalledVersion, VulnerabilityID: .VulnerabilityID, Severity: .Severity } ] } ] | add | add | .[]? } | { DockerImage: .DockerImage, PkgName: .Results.PkgName, InstalledVersion: .Results.InstalledVersion, VulnerabilityID: .Results.VulnerabilityID, Severity: .Results.Severity }' | jq -s
# OUTPUT:
# [
# {
# "DockerImage": "foo/bar:latest",
# "PkgName": "logFooBar",
# "InstalledVersion": "2-foobar",
# "VulnerabilityID": "CVE-2021-44228",
# "Severity": "CRITICAL"
# }
# ]
cat trivy-report.json | jq '{ DockerImage: .DockerImage, Results: .Results | [.[]? | { Vulnerabilities: .Vulnerabilities | [.[]? | { PkgName: .PkgName, InstalledVersion: .InstalledVersion, VulnerabilityID: .VulnerabilityID, Severity: .Severity } ] } ] | add | add | .[]? } | { DockerImage: .DockerImage, PkgName: .Results.PkgName, InstalledVersion: .Results.InstalledVersion, VulnerabilityID: .Results.VulnerabilityID, Severity: .Results.Severity }' | jq -s -r '["DockerImage","PkgName","InstalledVersion","VulnerabilityID","Severity"], (.[]? | [.DockerImage, .PkgName, .InstalledVersion, .VulnerabilityID, .Severity]) | @csv'
# OUTPUT:
# "DockerImage","PkgName","InstalledVersion","VulnerabilityID","Severity"
# "foo/bar:latest","logFooBar","2-foobar","CVE-2021-44228","CRITICAL"
# COMMAND OVERVIEW:
# cat trivy-report.json | jq '{
# DockerImage: .DockerImage,
# Results: .Results | [
# .[]? | {
# Vulnerabilities: .Vulnerabilities | [
# .[]? | {
# PkgName: .PkgName,
# InstalledVersion: .InstalledVersion,
# VulnerabilityID: .VulnerabilityID,
# Severity: .Severity
# }
# ]
# }
# ] |
# add |
# add |
# .[]?
# } |
# {
# DockerImage: .DockerImage,
# PkgName: .Results.PkgName,
# InstalledVersion: .Results.InstalledVersion,
# VulnerabilityID: .Results.VulnerabilityID,
# Severity: .Results.Severity
# }'
# | jq -s -r '[
# "DockerImage",
# "PkgName",
# "InstalledVersion",
# "VulnerabilityID",
# "Severity"
# ],
# (.[]? | [
# .DockerImage,
# .PkgName,
# .InstalledVersion,
# .VulnerabilityID,
# .Severity
# ]
# ) | @csv'
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment