Xygeni User Guides
  • Welcome to Xygeni
  • Getting Started
    • Create a Free Trial Account
    • Quick start with your code repository
    • Quick start with Xygeni CLI
    • Quick start with a preloaded project
    • Log in to Xygeni
    • Subscribe to Xygeni
  • Introduction to Xygeni
    • Key Concepts
      • Projects in Xygeni
      • Project Baseline
      • Detected Issues
      • Remediation Actions
      • Policies
      • Risk Level
      • SDLC Inventory
      • Standards Compliance
      • GuardRails
    • Xygeni Products
    • How Xygeni works
    • Xygeni Web UI Overview
      • Projects Screen
        • Risk Level
    • Integrating Xygeni into your Workflow
    • Prioritization Funnels
      • Custom Funnels
      • Prioritization Criteria (Stages)
        • Reachability
        • Exploitability
        • Fixable
    • Guardrails
    • Generate a SBOM
    • Reports
      • Trends
      • Scan History
    • Supported Integrations
    • Customizations
  • Xygeni Products
    • Application Security Posture Management (ASPM)
      • ASPM User Interface Guide
      • All Risks
        • Statistics
        • Issues Evolution
        • Issue Comparison Between Different Scans
      • Governance
      • Inventory
        • All Assets
        • Repositories
        • Components
        • CI/CD Assets
        • Delivery Assets
        • Systems & Tools
        • Collaborators
      • Health Check
      • Inventory Scanner
        • Inventory Scanner Configuration
        • Inventory Collaborators Scan
      • Importing reports from 3rd party tools
        • External Scanners Supported
          • Report upload for Kiuwan
            • ExportRule (.java)
    • Code Security (SAST)
      • Code Security (SAST) User Interface Guide
        • Risks (SAST)
        • Malicious Code
      • Malware Scanner
        • Malware Scanner Configuration
        • Malware Detectors
      • SAST Scanner
        • SAST Scanner Configuration
    • Open Source (SCA)
      • Open Source (SCA) User Interface Guide
      • Open Source Components
      • Supported Package Managers for dependency resolution
      • Risks (SCA)
      • OSS Prioritization Funnels
      • OSS Auto-Remediation
      • Malware Early Warning (MEW)
        • How Malware Early Warning works
        • Common types of Malware found in open source packages
      • Dependency Scanner
        • Dependency scanner configuration
        • Dependency Analyzers
      • Suspect Dependencies Scanner
        • Suspect Deps Scanner Configuration
        • Suspect Deps Detectors
    • CI/CD Security
      • CI/CD Security User Interface Guide
      • CI/CD Details
      • Build Attestations
      • CI/CD Scanner
        • CI/CD Misconfigurations Scanner Configuration
      • Compliance Scanner
        • Supported compliance standards
    • Secrets Security
      • Secrets User Interface Guide
      • Secrets Scanner
        • Secrets scanner configuration
      • Secret Leaks Handling
        • Secret Leaks Handling
        • How to Prevent Hard-Coded Secrets
        • Secret Leaks Handling CheatSheet
      • Secrets Auto-Remediation
    • IaC Security
      • IaC User Interface Guide
      • IaC Scanner
        • IaC Scanner Configuration
    • Malware
    • Build Security
      • Build Security Concepts
      • Build Attestations
      • Attestation format
      • How SALT works
      • Installing Salt CLI
      • Salt Command-Line Reference
      • SALT Architecture
      • SALT How To…​
    • Anomalous Activity Detection
      • Anomalous Activity Detection User Interface Guide
      • Xygeni Sensors
        • Xygeni Sensor for Azure
        • Xygeni Sensor for BitBucket
        • Xygeni Sensor for GitHub
          • GitHub Audit Log Processing
        • Xygeni Sensor for GitLab
        • Xygeni Sensor for Jenkins
        • Anomaly Detection's Detectors
      • Code Tampering Scanner
        • Code Tampering Scanner Configuration
    • Compliance & Malware Insights
      • SSCS Compliance
      • Malicious Packages DB
  • Scan Management
    • Manage Scans
    • Scan History
  • Xygeni Scanner CLI
    • Xygeni Scanners
    • Xygeni CLI Overview
      • Xygeni CLI Prerequisites
      • Xygeni CLI Installation
      • Xygeni CLI Docker Image
      • Xygeni CLI Authentication
        • CLI Authentication with Xygeni
      • SCM, CI/ CD and Container Registry tokens
      • Xygeni CLI Operation Modes
        • Single scan
          • Scanning a docker image
        • Multi Scan
        • Organization scan
      • Xygeni CLI Configuration options
      • Xygeni CLI Output Formats
      • Exporting Xygeni results to 3rd party tools
      • Automatic Remediation
      • Generate SBOM with the Xygeni CLI
      • CLI utils
        • Credentials Encryption
        • Central Configuration
      • Xygeni Guardrails
        • CI/CD Audit Analysis
      • Xygeni CLI Error Codes
      • Xygeni Scanner Reference
  • Xygeni Administration
    • Platform Administration
      • Profile
      • Subscription
      • Users Management
      • Projects Management
      • Groups Management
      • Policies
      • Integrations
        • Xygeni Single Sign-On (SSO) Authentication
          • SSO - OKTA
          • SSO - Microsoft Entra ID
        • Integrate Scanner CLI into CI/CD Systems
          • Azure Pipelines Integration
          • BitBucket Integration
          • CircleCI Integration
          • GitHub Actions Integration
          • GitLab Runner Integration
          • Jenkins Integration
          • Travis CI Integration
        • Git Hooks with Xygeni
        • Collaboration & communication Tools
        • Ticketing Systems
        • Remediation systems
      • Notifications
    • Rest API
  • Support
  • Changelog
    • Version 5.11 - April 11, 2025
    • Version 5.9 – March 26, 2025
Powered by GitBook
On this page
  • Table of Contents
  • Purpose
  • Quick Start
Export as PDF
  1. Xygeni Products
  2. Application Security Posture Management (ASPM)

Inventory Scanner

PreviousHealth CheckNextInventory Scanner Configuration

Last updated 28 days ago

Table of Contents

Purpose

A build/deploy pipeline automates software delivery through a series of processes and tools. These include source control, build tools, continuous integration, automated testing (unit, integration, and regression tests), validation, reporting, and software distribution.

The assets involved in build/deploy pipelines are called SDLC assets, and in the Xygeni platform an inventory of SDLC assets and their relations, for the pipelines used in an organization, are discovered automatically. Security issues and unusual activity events, as captured by the Xygeni platform,

In build/deploy pipelines, the assets involved are referred to as SDLC assets. The Xygeni platform automatically discovers an inventory of SDLC assets and their relationship within an organization's pipelines. Security issues and unusual activity detected by Xygeni is subsequently mapped to the target SDLC assets.

Use the xygeni inventory CLI command to discover SDLC assets.

Discovery involves extracting information from available sources like project and dependency descriptors, build files, CI/CD workflow pipelines, and IaC templates. This process can be enhanced by utilizing the tools APIs to fetch additional data for better qualifying each asset discovered.

For more details about the inventory please refer to the documentation.

Quick Start

The CLI command to run an inventory scan:

xygeni inventory --dir DIR --upload

This scans for assets related to build/deployment pipelines to compile an inventory. Then upload the results to the Xygeni platform unless you use --no-upload instead.

--dir specifies the directory containing the software project to analyze, which may have been cloned from a Git repository.

There are two ways to run the inventory scanner:

1.- Executing its own specific command ( xygeni inventory [options] ).

2.- Executing the general command ( xygeni scan --run="inventory" [options] ) will run all available scanners.

Running the inventory scan alone should be used for configuration and testing.

The CLI command produces the following output:

Assets found: 69
┌───────────────────┬─────────────────────────────┬───────────────────────────────────┬────┐
│       Kind        │Name                         │Belongs To                         │Tags│
├───────────────────┼─────────────────────────────┼───────────────────────────────────┼────┤
│     code_repo     │myorg/ProductXYZ             │                                   │    │
├───────────────────┼─────────────────────────────┼───────────────────────────────────┼────┤
│   cicd_pipeline   │clean-packages               │code_repo:github:myorg/ProductXYZ  │    │
├───────────────────┼─────────────────────────────┼───────────────────────────────────┼────┤
│   cicd_pipeline   │codeql-analysis              │code_repo:github:myorg/ProductXYZ  │    │
├───────────────────┼─────────────────────────────┼───────────────────────────────────┼────┤
│   cicd_pipeline   │deploy-maven                 │code_repo:github:myorg/ProductXYZ  │    │
├───────────────────┼─────────────────────────────┼───────────────────────────────────┼────┤
│ ...
├───────────────────┼─────────────────────────────┼───────────────────────────────────┼────┤
│   dependencies    │docs                         │code_repo:github:myorg/ProductXYZ  │    │
├───────────────────┼─────────────────────────────┼───────────────────────────────────┼────┤
│   security_tool   │CodeQL                       │code_repo:github:myorg/ProductXYZ  │    │
├───────────────────┼─────────────────────────────┼───────────────────────────────────┼────┤
│cloud_configuration│deployment/docker/Dockerfile │code_repo:github:myorg/ProductXYZ  │    │
├───────────────────┼─────────────────────────────┼───────────────────────────────────┼────┤
│   organization    │myorg                        │                                   │    │
└───────────────────┴─────────────────────────────┴───────────────────────────────────┴────┘

2023-03-28 18:30:26 [main] WARN InventoryCommand - report uploaded with analysis code: AN-demo@myorg-184

The command has the following options:

Usage:

xygeni inventory [-huV] [-n=<name>]
  [-d=<directory>] [-e=<excludePatterns>] [-i=<includePatterns>]
  [-repo=<repo>] [--repo-branch=<repoBranch>]
  [--image=<image>] [--image-platform=<platform>]
  [--image-sources=<sources>] [--image-scope=<scope>]
  [-o=<output>] [-f=<format>] [--report-columns=<reportColumns>]
  [-c=<config>] [--[no-]conf-download]
  [--detectors=<detectors>] [--skip-detectors=<skipDetectors>]
  [--never-fail] [@<filename>...]

Discover SDLC assets for a project.

Parameters:
      [@<filename>...]       One or more argument files containing options.
  -n, --name=<name>          The software name.
  -u, --upload               Upload report to xygeni server.
  -h, --help                 Show this help message and exit.
  -V, --version              Print version information and exit.

Input files options:
  -d, --dir=<directory>      The directory to analyze (default: current directory).
  -i, --include=<includePatterns>
                             Include patterns, comma-separated (optional).
  -e, --exclude=<excludePatterns>
                             Exclude patterns, comma-separated (optional).
                             Example: '**/test/**'

Repository options:
  -repo, --repository=<repo> The repository. Either a URL or scm:owner/repo,
                             like 'github:tensorflow/tensorflow'
  --repo-branch=<ref>        The repository branch or commit SHA to checkout for analysis.
                             HEAD if unspecified.

Container image options:
      --image=<image>        The container image, in registry/repository/image:tag format.
                             Examples: debian, alpine:latest, cgr.dev/chainguard/go,
                             gcr.io/google-containers/python@sha256:fe...4b
      --image-platform=<platform>
                             The image platform in the form os/arch, if image is multi-platform.
      --image-sources=sources
                             The image source(s) to use, comma-separated in order.
                             Defaults to docker, containerd, podman, remote.
      --image-scope=<scope>  How layers are analyzed. One of merged, mergedExceptBase, byLayer,
                             byLayerExceptBase. Default: merged.

Output options:
  -o, --output=<output>      Output file. Use 'stdout' or '-' for standard output, 'stderr' for standard error.
  -f, --format=<format>      Output format: none, text, json, csv.
      --report-columns=<reportColumns>
                             Report columns, separated by commas (default:
                             config property report/columns)

Collaborators:
      --include-collaborators
                             If repository collaborators should be added to inventory.

Configuration options:
  -c, --conf=<config>        Configuration file (default: xygeni.inventory.yml).
      --[no-]conf-download   Download scanner config? (default: true}
      --detectors=<detectors>
                             Comma-separated list of IDs for detectors to run, or 'all'
      --skip-detectors=<skipDetectors>
                             Comma-separated list of IDs for detectors to ignore

Exit options:
      --never-fail           Do not fail: always exit with code 0, even with flaws or errors.

The most important properties are:

  • Name of the project -n or --name.

  • Specify either a directory (-d|--dir), a repository (-repo|--repository), or a container image (--image). If none is provided, the current local directory is assumed.

  • Enable the --upload option to upload results. Results are not uploaded by default.

  • Specify the output file with the -o or --output option and the format with -f or --format. If no output file is specified, or if stdout or - is used, the standard output is the default. Use --format=none if you do not want to generate any output.

Issues are linked to inventory assets ONLY when the scans are run together with the inventory step. It is recommended to run a full for inventory processing.

Configuration
Collaborators Scan
Inventory
Purpose
Quick Start
Usage
scan command