Xygeni User Guides
  • Welcome to Xygeni
  • Getting Started
    • Create a Free Trial Account
    • Quick start with your code repository
    • Quick start with Xygeni CLI
    • Quick start with a preloaded project
    • Log in to Xygeni
    • Subscribe to Xygeni
  • Introduction to Xygeni
    • Key Concepts
      • Projects in Xygeni
      • Project Baseline
      • Detected Issues
      • Remediation Actions
      • Policies
      • Risk Level
      • SDLC Inventory
      • Standards Compliance
      • GuardRails
    • Xygeni Products
    • How Xygeni works
    • Xygeni Web UI Overview
      • Projects Screen
        • Risk Level
    • Integrating Xygeni into your Workflow
    • Prioritization Funnels
      • Custom Funnels
      • Prioritization Criteria (Stages)
        • Reachability
        • Exploitability
        • Fixable
    • Guardrails
    • Generate a SBOM
    • Reports
      • Trends
      • Scan History
    • Supported Integrations
    • Customizations
  • Xygeni Products
    • Application Security Posture Management (ASPM)
      • ASPM User Interface Guide
      • All Risks
        • Statistics
        • Issues Evolution
        • Issue Comparison Between Different Scans
      • Governance
      • Inventory
        • All Assets
        • Repositories
        • Components
        • CI/CD Assets
        • Delivery Assets
        • Systems & Tools
        • Collaborators
      • Health Check
      • Inventory Scanner
        • Inventory Scanner Configuration
        • Inventory Collaborators Scan
      • Importing reports from 3rd party tools
        • External Scanners Supported
          • Report upload for Kiuwan
            • ExportRule (.java)
    • Code Security (SAST)
      • Code Security (SAST) User Interface Guide
        • Risks (SAST)
        • Malicious Code
      • Malware Scanner
        • Malware Scanner Configuration
        • Malware Detectors
      • SAST Scanner
        • SAST Scanner Configuration
    • Open Source (SCA)
      • Open Source (SCA) User Interface Guide
      • Open Source Components
      • Supported Package Managers for dependency resolution
      • Risks (SCA)
      • OSS Prioritization Funnels
      • OSS Auto-Remediation
      • Malware Early Warning (MEW)
        • How Malware Early Warning works
        • Common types of Malware found in open source packages
      • Dependency Scanner
        • Dependency scanner configuration
        • Dependency Analyzers
      • Suspect Dependencies Scanner
        • Suspect Deps Scanner Configuration
        • Suspect Deps Detectors
    • CI/CD Security
      • CI/CD Security User Interface Guide
      • CI/CD Details
      • Build Attestations
      • CI/CD Scanner
        • CI/CD Misconfigurations Scanner Configuration
      • Compliance Scanner
        • Supported compliance standards
    • Secrets Security
      • Secrets User Interface Guide
      • Secrets Scanner
        • Secrets scanner configuration
      • Secret Leaks Handling
        • Secret Leaks Handling
        • How to Prevent Hard-Coded Secrets
        • Secret Leaks Handling CheatSheet
      • Secrets Auto-Remediation
    • IaC Security
      • IaC User Interface Guide
      • IaC Scanner
        • IaC Scanner Configuration
    • Malware
    • Build Security
      • Build Security Concepts
      • Build Attestations
      • Attestation format
      • How SALT works
      • Installing Salt CLI
      • Salt Command-Line Reference
      • SALT Architecture
      • SALT How To…​
    • Anomalous Activity Detection
      • Anomalous Activity Detection User Interface Guide
      • Xygeni Sensors
        • Xygeni Sensor for Azure
        • Xygeni Sensor for BitBucket
        • Xygeni Sensor for GitHub
          • GitHub Audit Log Processing
        • Xygeni Sensor for GitLab
        • Xygeni Sensor for Jenkins
        • Anomaly Detection's Detectors
      • Code Tampering Scanner
        • Code Tampering Scanner Configuration
    • Compliance & Malware Insights
      • SSCS Compliance
      • Malicious Packages DB
  • Scan Management
    • Manage Scans
    • Scan History
  • Xygeni Scanner CLI
    • Xygeni Scanners
    • Xygeni CLI Overview
      • Xygeni CLI Prerequisites
      • Xygeni CLI Installation
      • Xygeni CLI Docker Image
      • Xygeni CLI Authentication
        • CLI Authentication with Xygeni
      • SCM, CI/ CD and Container Registry tokens
      • Xygeni CLI Operation Modes
        • Single scan
          • Scanning a docker image
        • Multi Scan
        • Organization scan
      • Xygeni CLI Configuration options
      • Xygeni CLI Output Formats
      • Exporting Xygeni results to 3rd party tools
      • Automatic Remediation
      • Generate SBOM with the Xygeni CLI
      • CLI utils
        • Credentials Encryption
        • Central Configuration
      • Xygeni Guardrails
        • CI/CD Audit Analysis
      • Xygeni CLI Error Codes
      • Xygeni Scanner Reference
  • Xygeni Administration
    • Platform Administration
      • Profile
      • Subscription
      • Users Management
      • Projects Management
      • Groups Management
      • Policies
      • Integrations
        • Xygeni Single Sign-On (SSO) Authentication
          • SSO - OKTA
          • SSO - Microsoft Entra ID
        • Integrate Scanner CLI into CI/CD Systems
          • Azure Pipelines Integration
          • BitBucket Integration
          • CircleCI Integration
          • GitHub Actions Integration
          • GitLab Runner Integration
          • Jenkins Integration
          • Travis CI Integration
        • Git Hooks with Xygeni
        • Collaboration & communication Tools
        • Ticketing Systems
        • Remediation systems
      • Notifications
    • Rest API
  • Support
  • Changelog
    • Version 5.11 - April 11, 2025
    • Version 5.9 – March 26, 2025
Powered by GitBook
On this page
  • xygeni multi-scan command
  • Map to Xygeni projects
  • --dry-run
Export as PDF
  1. Xygeni Scanner CLI
  2. Xygeni CLI Overview
  3. Xygeni CLI Operation Modes

Multi Scan

PreviousScanning a docker imageNextOrganization scan

Last updated 28 days ago

xygeni multi-scan command

It’s important to ensure that the JAVA_HOME environment variable points to the directory where Java is installed, which may or may not be done automatically depending on your platform. Additionally, you need to make sure that the $JAVA_HOME/bin directory is included in your system’s PATH so that you can access the Java executable from anywhere on your system. Please see for further info.

It is usual to have a software split into multiple modules under different directories, possible under different git repositories (when following a polyrepo architecture), or in a single repository (when all pieces for a software are stored in the same repository, or in a monorepo architecture).

You may run separate xygeni scan commands for each module, which gives flexibility as every command option can be tailored, and good performance as the scan for each module can run only the appropriate stages -for example, running iac stage only when IaC templates exist.

Sometimes the directories comprising the software are not known in advance. Or there is a common software layout, where a module is split into three separate repos. For example, one repo with the source code, another repo with the build and deploy scripts, and another repo with the IaC templates for provisioning of resources in the cloud.

For such situations the multi-scan command could be useful.

xygeni multi-scan [options] 

The different directories to scan can be either discovered

Discovery options:
      --discover             Discover paths under -d | --dir (default: false).
      -dp, --discover-pattern=<discoveryPattern>
                             Regex for paths relative to -d | --dir to be processed.
                             Example: -dp ^micros/AGI_.*|^deploy/AGI_.*|^fe/AGI_.*
      --child-only           Consider only child subdirectories under --dir (default: false)
      --path[=<paths>...]    Path(s) to scan, relative to --dir. Could be specified multiple times.

or specified

      --path[=<paths>...]    Path(s) to scan, relative to --dir. Could be specified multiple times.

In any case, matched paths may be restricted to be roots of git directories using the --git-only option.

      --git-only             Consider only directories that are roots of git repositories (default:
                               false)

Discovery and explicit paths can be combined when the software layout has a set of fixed directories (specified via --path options).You may pass absolute paths in the --path option, otherwise the path is resolved from the --dir option.

The project name given to each matched path could be configured in the -n | --name option

Map to Xygeni projects

If nothing is specified, xygeni multi-scan will create as many projects in xygeni as different directories/repos are matched.

By default, the name of those projects will be the git repository name, but using explicit paths you can provide a custom Xygeni project name .

$ xygeni -q multi-scan --dir $WORKSPACE --git-only
    --path MyOrg/MyApp/code -n MyOrg/MyApp/code:MyApp-Source \
    --path MyOrg/MyApp/build -n MyOrg/MyApp/code:MyApp-Build \
    --path MyOrg/MyApp/deploy -n MyOrg/MyApp/code:MyApp-Infra \
    --run inventory,secrets,iac,codetamper \
    -e '**/test/**,build/**' -f none

XXXXXXXXXXXXXXXXX

PRODUCT UNIT

XXXXXXXXXXXXXXXXXXXX

--dry-run

The --dry-run option shows the matched paths and the scan commands for each matched path without running the scans, so you may write the commands in a CI/CD pipeline.

Examples:

Use --dry-run to check the matched projects and scan command syntax before running it:

# Imagine a project layout with software in separated "application" directories,
# and three repos underneath, one for source code, another for build and deploy,
# and another with deploy playbooks / IaC templates:

$ xygeni -q multi-scan --dir . \
  --discover -dp '^MyOrg/MyApp/' --git-only --dry-run \
  --run inventory,secrets,iac,codetamper \
  -e '**/test/**,build/**' -f none

xygeni scan -n "myorg/MyApp-code" -d MyOrg/MyApp/code -e "**/test/**,build/**" \
    --run=inventory,secrets,iac,codetamper -f none
xygeni scan -n "myorg/MyApp-build" -d MyOrg/MyApp/build -e "**/test/**,build/**" \
    --run=inventory,secrets,iac,codetamper -f none
xygeni scan -n "myorg/MyApp-deploy" -d MyOrg/MyApp/deploy -e "**/test/**,build/**" \
    --run=inventory,secrets,iac,codetamper -f none

After checking that everything is resolved OK, you may remove the --dry-run option to actually run the scans.

Xygeni CLI Prerequisites