External scanner support
How Seal makes its remediation visible to scanners run outside your organization, by customers, regulators, or other external parties.
Last updated
How Seal makes its remediation visible to scanners run outside your organization, by customers, regulators, or other external parties.
Some scans of your software are run by parties you do not control: a customer running their own SBOM check against an image you shipped, a regulator running an audit scan, a security team inside a partner organization. They cannot read the Seal Platform, and they will not be configured with credentials that let Seal update their dashboards.
For those scans, the integration is on the scanner's side: the scanner consumes Seal's published vulnerability data and recognizes sealed packages as remediated.
Two artifacts make this work, and both are publicly available:
The Seal vulnerability feed: a continuously updated dataset listing every sealed package version and the vulnerabilities each one resolves.
VEX records: per-sealed-package Vulnerability Exploitability eXchange records that scanners can attach to an SBOM to mark each remediated vulnerability as fixed.
This chapter is for the scans you cannot drive from your CI. The Seal CLI is not involved; no specific Seal deployment method is required on your side. Whether you run the Seal CLI in Remote, Local, or all mode, or use the Seal Artifact Server as a remote, the feed and the VEX records are produced by the Seal Platform for every sealed package and are equally available.
Trivy (Aqua Security): recognizes every sealed package Seal publishes, across every ecosystem, regardless of whether the package is renamed. No configuration on the customer side.
Wiz: recognizes sealed OS packages today. Application-layer ecosystems are not covered yet. No configuration on the customer side.
For scanners not on this list, the customer-side strategy is Package renaming, which avoids the external scanner's false positives by changing what the scanner sees in the manifest.
The Seal vulnerability feed: what the feed contains and how scanners consume it.
VEX records: per-package machine-readable remediation records.
Trivy: coverage details.
Wiz: coverage details.
Internal scanner integrations: for scanners your organization runs and can be configured against the Seal CLI.
Package renaming: the customer-side strategy for scanners outside the feed.
Last updated