Scanners
The scanners whose reports AppSec Portal reads, what each one scans and which Auditor job runs it.
Portal reads the reports of the scanners below. The name in the first column is
the scanner name to use when you import a report and in the SCAN_TYPE
variable of an Auditor job.
The last column names the Auditor job that runs the scanner. A scanner without a job reads reports that you import; to run it from Auditor, add a job for it as described in Bring your own scanner.
To see all scanners, including your own, open the settings, then Scanners. Built-in scanners and your own ones are on separate tabs.
Secrets
| Scanner | Scans | Auditor job |
|---|---|---|
| Gitleaks Scan | repository | Gitleaks Scan |
| GitLab Gitleaks | repository | GitLab Gitleaks |
| Trufflehog3 Scan | repository | Trufflehog3 Scan |
| FVLCN Secrets Hunter | repository | FVLCN Secrets Hunter |
| FVLCN Domains Secrets Hunter | domain | FVLCN Domains Secrets Hunter |
Code
| Scanner | Scans | Auditor job |
|---|---|---|
| Bandit Scan | Python code | Bandit |
| Checkov Scan | infrastructure as code | Checkov |
| CodeQL Scan (SARIF) | code | |
| ESLint Scan | JavaScript code | ESlint |
| GitLab Bandit | Python code | |
| GitLab ESLint | JavaScript code | |
| GitLab KICS | infrastructure as code | |
| GitLab Semgrep | code | Gitlab Semgrep, Gitlab Nodejs, Gitlab Php |
| Gosec Scanner | Go code | Gosec |
| Hadolint | Dockerfiles | |
| Mobsfscan | Android and iOS code | Mobsfscan |
| PHPCodeSniffer | PHP code | PHPCodeSniffer |
| Semgrep JSON Report | code | Semgrep |
| Snyk | code, dependencies and infrastructure as code | Snyk Go, Snyk Nodejs, Snyk Python, Snyk Iac |
| Terrascan Scan | infrastructure as code | Terrascan |
| Whitespots AI SAST | code, with a language model | Whitespots AI SAST |
Dependencies
| Scanner | Scans | Auditor job |
|---|---|---|
| Dependency-Track | software bills of materials | |
| GitLab Gemnasium | repository | |
| Retire.js Scan | JavaScript libraries | Retirejs |
| Trivy Scan | repository, Docker image | Trivy Code Dependencies, Trivy Image Dependencies |
| Vulners Trivy | Docker image | Vulners Trivy |
Web
| Scanner | Scans | Auditor job |
|---|---|---|
| Arachni Scan | domain | Arachni |
| Burp Enterprise Scan | web application | |
| GitLab OWASP Zap | web application | |
| Nessus | host | |
| Nuclei Scan | domain | Nuclei Scan, Nuclei Scan CVE |
Infrastructure
These two scanners find assets, not vulnerabilities. Their reports add assets to the product of the audit and create no findings.
| Scanner | Scans | Auditor job |
|---|---|---|
| Subfinder | domain: adds its subdomains as domain assets | Subfinder |
| Naabu | domain: adds each address with an open port as a host asset, or as a domain asset when it’s a name | Naabu |
Cloud
| Scanner | Scans | Auditor job |
|---|---|---|
| AWS Security Hub Scan | AWS account | |
| Prowler | AWS account | Prowler AWS |
| Whitespots Portal | Microsoft Defender alerts | Defender Alerts |
Some jobs need a key of the scanner’s vendor in their environment variables: SNYK_TOKEN for Snyk
Iac, VULNERS_API_KEY for Vulners Trivy, and AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY for
Prowler AWS.
Whitespots AI SAST runs a small model on the Auditor worker by default. To use a hosted model instead, edit the job’s run command, which has the other options commented out, and set the provider’s API key in the job’s variables.