---
sourceDocument: Australia IT Operations Management
sourceDocumentLink: https://www.servicenow.com/docs/r/australia/it-operations-management
Release :
- australia
ft:locale :
- en-US
ft:publication_title :
- Australia IT Operations Management
ft:clusterId :
- itom
bundleId :
- itom
workflow :
- Technology
---
# Enabling container image scanning with Syft scanner
# Enabling container image scanning with Syft scanner {#ariaid-title1}
Release version: Australia
Updated August 13, 2026
 3 minutes to read
Summarize
 Summarized using AI
This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete.
## Summary of Enabling container image scanning with Syft scanner
Container image scanning with Syft scanner in ServiceNow's Kubernetes Visibility Agent (KVA) offers visibility into software packages within container images for compliance, licensing, and security.
This integration provides a simpler alternative to the Aqua Trivy scanner by eliminating the need for a MID Server or manual tool installation.
It scans container images directly from the Kubernetes cluster and populates the same data model as Aqua Trivy, streamlining container image software decomposition.
Show full answer Show less
## Key Features
* **No MID Server required:** Syft scanner operates without additional infrastructure or manual setup.
* **Automatic integration with KVA Informer:** Scans occur directly within Kubernetes, enhancing efficiency.
* **Helm chart installation:** Syft scanner is supported only when installing KVA Informer via Helm with the parameter `--set runSyftScanner=true`.
* **System property controls:** Enable scanning by setting `snitompattern.containerimagescan` and `snaccvisibility.imagescanenabled` to true. Only Syft or Aqua Trivy can be used at a time.
* **Informer status fields:** Displays image scanner enablement status and accessible image registries.
* **Log retrieval:** A UI action allows retrieval of Syft scanner logs attached to Informer records.
## Data Collected and Monitoring
Syft scanner populates key fields on the Docker Image CI record, including operating system details, architecture, image size, creation timestamp, and default container command. It also identifies software packages inside the container image, creating related records with package names, versions, and maintainers when available.
Scan status is tracked in the Container Image Scan Status table with states such as None, In Progress, Scanned, Error, and Skipped, enabling customers to monitor scan progress and troubleshoot issues.
## Practical Benefits for ServiceNow Customers
* Quick and infrastructure-light container image software visibility for security and compliance.
* Reduced complexity by avoiding MID Server setup and manual scanning tool installations.
* Seamless integration within existing KVA workflows and data models.
* Comprehensive tracking and logging to support operational transparency and troubleshooting.
Container image scanning with Syft scanner provides visibility into software packages within
container images, helping you identify installed software for compliance, licensing, and security purposes without requiring a MID Server.
KVA integrates with the Syft open-source tool to scan container images and discover software packages. This feature provides an alternative to the existing Aqua Trivy integration that requires a MID Server. For customers already using KVA, Syft scanner offers a simpler deployment without additional infrastructure or manual tool installation.
Note:
For more information about this feature, see the [Software decomposition of container images using Kubernetes Visibility Agent and Syft \[KB3149735\]](https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB3149735) article in the Now Support Knowledge Base.
## Benefits of Syft scanner integration {#enabling-software-decomposition-tool__section_benefits}
The Syft scanner integration provides the following advantages:
* No MID Server required
* No manual installation of scanning tools
* Automatic integration with KVA Informer
* Scans container images directly from the Kubernetes cluster
* Populates the same data model as the Aqua Trivy integration
{#enabling-software-decomposition-tool__ul_benefits}
## Installation method {#enabling-software-decomposition-tool__section_installation}
The Syft scanner is only supported when installing KVA Informer using the Helm chart method. YAML-based installation does not support the Syft scanner feature.
To enable Syft scanner during Helm installation, add the following parameter to the Helm install command:
--set runSyftScanner=true
For complete installation instructions, see [Install Kubernetes Visibility Agent (KVA) Informer](https://www.servicenow.com/docs/dshjmcIZsvCvk9wzzpu4~Q "You can install Kubernetes Visibility Agent Informer using either a Helm chart or the Kubernetes YAML file.").
## Enabling container image scanning {#enabling-software-decomposition-tool__section_enable}
After installing the Informer with Syft scanner support, enable container image scanning by setting the following system properties to true:
* sn_itom_pattern.container_image_scan - Enables the container image scanning mechanism
* sn_acc_visibility.image_scan_enabled - Directs the system to use the Syft scanner in KVA instead of Aqua Trivy on a MID Server
{#enabling-software-decomposition-tool__ul_properties}
Note:
You cannot use both scanning methods simultaneously. When sn_acc_visibility.image_scan_enabled is set to true, the system uses only the Syft scanner method.
## Informer status fields {#enabling-software-decomposition-tool__section_informer_fields}
When an Informer is configured with Syft scanner support, the following fields appear on the Informer form:
* Image Scanner Enabled - Indicates whether the Informer supports container image scanning (true or false)
* Image Scan Registries - Comma-separated list of image registries the Informer can access through credential-less trust relationships (ecr, acr, google)
{#enabling-software-decomposition-tool__ul_informer_fields}
A new UI action Get Syft Scanner Logs is available on Informer records that have image scanning enabled. Selecting this action retrieves the Syft scanner logs and attaches them to the Informer record as k8s_informer_syft.log.
## Data collected by container image scans {#enabling-software-decomposition-tool__section_data_collected}
When the Syft scanner successfully scans a container image, the system populates the following fields on the Docker Image CI \[cmdb_ci_docker_image\]:
{#enabling-software-decomposition-tool__table_docker_image_fields__entry__2}
| Field | Description |
|-|-|
| Operating System \[os\] | Operating system name |
| OS Version \[os_version\] | Operating system version |
| Architecture \[architecture\] | Processor architecture. Examples: amd64, arm64 |
| Size (bytes) \[size_bytes\] | Image size in bytes |
| OS Family \[os_family\] | Operating system family. Examples: rhel, centos, alpine, azurelinux, windows |
| Image created \[image_created_at\] | Timestamp when the image was created |
| Command \[command\] | Default command executed when the container starts |
[Table 1. Docker Image CI fields populated by Syft scanner]
{#enabling-software-decomposition-tool__table_docker_image_fields}
Note:
Not all fields are populated for every image. Field availability depends on the image metadata and scan results.
## Software packages {#enabling-software-decomposition-tool__section_software_packages}
The Syft scanner identifies software packages contained in the container image and creates records in the Container Image OS Packages \[sn_itom_pattern_container_image_os_packages\] table. This table appears as a related list on the Docker Image CI form.
Each software package record includes:
* Package Name
* Package Version
* Package Maintainer
{#enabling-software-decomposition-tool__ul_package_fields}
Note:
Package maintainer and version information depends on the data available in the image. The Syft scanner reports what is present in the image metadata.
## Monitoring scan status {#enabling-software-decomposition-tool__section_scan_status}
The Container Image Scan Status \[sn_itom_pattern_container_image_scan_status\] table maintains the scan status for each container image. Access this table by navigating to the URL: <instance>.service-now.com/sn_itom_pattern_container_image_scan_status_list.do
Possible scan status values:
* None - Image has not been scanned
* In Progress - Scan is currently running
* Scanned - Scan completed successfully
* Error - Scan failed (check the Message field for details)
* Skipped - Image URL is malformed or unreachable
{#enabling-software-decomposition-tool__ul_scan_status}
**Related concepts**
* [Container image scanning for software decomposition](https://www.servicenow.com/docs/yYUpHR4iTwDck_so60BEEQ "The ITOM Visibility apps, Discovery and Service Mapping Patterns and Kubernetes Visibility Agent integrate with Aqua Trivy to collect data on container images and OS packages. You can increase your control over container deployment by having visibility to the container components.")