gitea-mirror/trivy
1
0
Fork 0
mirror of https://github.com/aquasecurity/trivy.git synced 2025-12-13 00:00:19 -08:00
Code Issues Packages Projects Releases Wiki Activity

feat: allow ignoring findings by type in Rego (#9578)

Browse Source 
Signed-off-by: nikpivkin <nikita.pivkin@smartforce.io>
This commit is contained in:
Nikita Pivkin
2025-10-07 00:17:23 +06:00
committed by GitHub
parent 4bef183489
commit c638fc646c
9 changed files with 163 additions and 71 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
docs/docs/configuration/filtering.md
View File

@@ -480,6 +480,19 @@ ignore {
trivy image --ignore-policy examples/ignore-policies/basic.rego centos:7
```
To filter findings of a specific type based on a field that may exist in multiple structures (for example, `PkgName` in both `DetectedVulnerability` and `DetectedLicense`), you can use the `Type` field. This field is automatically added when exporting findings to Rego and indicates the kind of finding. Possible values are: `vulnerability`, `misconfiguration`, `secret`, and `license`.
For example, the following policy ignores vulnerabilities with a specific package name without affecting other finding types:
```rego
package trivy
ignore {
input.Type == "vulnerability"
input.PkgName == "foo"
}
```
For more advanced use cases, there is a built-in Rego library with helper functions that you can import into your policy using: `import data.lib.trivy`.
More info about the helper functions are in the library [here](https://github.com/aquasecurity/trivy/tree/{{ git.tag }}/pkg/result/module.go).