---
sourceDocument: Brazil IT Operations Management
sourceDocumentLink: https://www.servicenow.com/docs/r/it-operations-management
Release :
- brazil
ft:locale :
- en-US
ft:publication_title :
- Brazil IT Operations Management
ft:clusterId :
- itom
bundleId :
- itom
workflow :
- Technology
---
# Enabling container image scanning with Syft scanner
# Enabling container image scanning with Syft scanner {#ariaid-title1}
Release version: Brazil
Updated September 10, 2026
 3 minutes to read
Summarize
 Summarized using AI
This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete.
## Summary of Enabling container image scanning with Syft scanner
Container image scanning with the Syft scanner in Kubernetes Visibility Agent (KVA) provides visibility into software packages within container images.
This enables ServiceNow customers to identify installed software for compliance, licensing, and security purposes without needing a MID Server.
Syft integrates seamlessly with KVA as an alternative to the Aqua Trivy integration, offering simpler deployment and no manual tool installation.
Show full answer Show less
## Key Features
* **No MID Server Required:** Eliminates the need for additional infrastructure or manual scanning tool installation.
* **Automatic Integration:** Works directly with KVA Informer to scan container images from the Kubernetes cluster.
* **Helm Chart Installation:** Supported only via Helm chart installation of KVA Informer by enabling the `runSyftScanner=true` parameter.
* **System Properties for Enabling Scanning:** Set `snitompattern.containerimagescan` and `snaccvisibility.imagescanenabled` to true to enable scanning with Syft.
* **Exclusive Scanning Method:** Only one scanning method (Syft or Aqua Trivy) can be active at a time.
* **Informer UI Enhancements:** New fields show scanner enablement status and accessible image registries; a UI action retrieves Syft scanner logs for troubleshooting.
## Data Collected
When Syft scans a container image, it populates key metadata fields on the Docker Image CI record, including:
* Operating System and Version
* Processor Architecture
* Image Size
* OS Family
* Image Creation Timestamp
* Default Container Start Command
Additionally, Syft identifies software packages within the image and creates detailed records (including package name, version, and maintainer) in the Container Image OS Packages related list on the Docker Image CI form.
## Monitoring and Scan Status
Scan statuses are tracked in the Container Image Scan Status table, accessible via the ServiceNow instance URL. Status values include:
* None (not scanned)
* In Progress (scanning ongoing)
* Scanned (completed successfully)
* Error (scan failed; message details available)
* Skipped (invalid or unreachable image URL)
## Practical Benefits for ServiceNow Customers
Integrating Syft scanner with KVA simplifies container image scanning by removing dependency on MID Servers and manual configuration. Customers gain automated, accurate software inventory and metadata from container images directly in ServiceNow, supporting compliance and security workflows. The enhanced UI and logging capabilities facilitate easier monitoring and troubleshooting of image scans.
Container image scanning with Syft scanner provides visibility into software packages within
container images, helping you identify installed software for compliance, licensing, and security purposes without requiring a MID Server.
KVA integrates with the Syft open-source tool to scan container images and discover software packages. This feature provides an alternative to the existing Aqua Trivy integration that requires a MID Server. For customers already using KVA, Syft scanner offers a simpler deployment without additional infrastructure or manual tool installation.
Note:
For more information about this feature, see the [Software decomposition of container images using Kubernetes Visibility Agent and Syft \[KB3149735\]](https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB3149735) article in the Now Support Knowledge Base.
## Benefits of Syft scanner integration {#enabling-software-decomposition-tool__section_benefits}
The Syft scanner integration provides the following advantages:
* No MID Server required
* No manual installation of scanning tools
* Automatic integration with KVA Informer
* Scans container images directly from the Kubernetes cluster
* Populates the same data model as the Aqua Trivy integration
{#enabling-software-decomposition-tool__ul_benefits}
## Installation method {#enabling-software-decomposition-tool__section_installation}
The Syft scanner is only supported when installing KVA Informer using the Helm chart method. YAML-based installation does not support the Syft scanner feature.
To enable Syft scanner during Helm installation, add the following parameter to the Helm install command:
--set runSyftScanner=true
For complete installation instructions, see [Install Kubernetes Visibility Agent (KVA) Informer](https://www.servicenow.com/docs/R6U4gdqxZR~X1CFgafbpkA "You can install Kubernetes Visibility Agent Informer using either a Helm chart or the Kubernetes YAML file.").
## Enabling container image scanning {#enabling-software-decomposition-tool__section_enable}
After installing the Informer with Syft scanner support, enable container image scanning by setting the following system properties to true:
* sn_itom_pattern.container_image_scan - Enables the container image scanning mechanism
* sn_acc_visibility.image_scan_enabled - Directs the system to use the Syft scanner in KVA instead of Aqua Trivy on a MID Server
{#enabling-software-decomposition-tool__ul_properties}
Note:
You cannot use both scanning methods simultaneously. When sn_acc_visibility.image_scan_enabled is set to true, the system uses only the Syft scanner method.
## Informer status fields {#enabling-software-decomposition-tool__section_informer_fields}
When an Informer is configured with Syft scanner support, the following fields appear on the Informer form:
* Image Scanner Enabled - Indicates whether the Informer supports container image scanning (true or false)
* Image Scan Registries - Comma-separated list of image registries the Informer can access through credential-less trust relationships (ecr, acr, google)
{#enabling-software-decomposition-tool__ul_informer_fields}
A new UI action Get Syft Scanner Logs is available on Informer records that have image scanning enabled. Selecting this action retrieves the Syft scanner logs and attaches them to the Informer record as k8s_informer_syft.log.
## Data collected by container image scans {#enabling-software-decomposition-tool__section_data_collected}
When the Syft scanner successfully scans a container image, the system populates the following fields on the Docker Image CI \[cmdb_ci_docker_image\]:
{#enabling-software-decomposition-tool__table_docker_image_fields__entry__2}
| Field | Description |
|-|-|
| Operating System \[os\] | Operating system name |
| OS Version \[os_version\] | Operating system version |
| Architecture \[architecture\] | Processor architecture. Examples: amd64, arm64 |
| Size (bytes) \[size_bytes\] | Image size in bytes |
| OS Family \[os_family\] | Operating system family. Examples: rhel, centos, alpine, azurelinux, windows |
| Image created \[image_created_at\] | Timestamp when the image was created |
| Command \[command\] | Default command executed when the container starts |
[Table 1. Docker Image CI fields populated by Syft scanner]
{#enabling-software-decomposition-tool__table_docker_image_fields}
Note:
Not all fields are populated for every image. Field availability depends on the image metadata and scan results.
## Software packages {#enabling-software-decomposition-tool__section_software_packages}
The Syft scanner identifies software packages contained in the container image and creates records in the Container Image OS Packages \[sn_itom_pattern_container_image_os_packages\] table. This table appears as a related list on the Docker Image CI form.
Each software package record includes:
* Package Name
* Package Version
* Package Maintainer
{#enabling-software-decomposition-tool__ul_package_fields}
Note:
Package maintainer and version information depends on the data available in the image. The Syft scanner reports what is present in the image metadata.
## Monitoring scan status {#enabling-software-decomposition-tool__section_scan_status}
The Container Image Scan Status \[sn_itom_pattern_container_image_scan_status\] table maintains the scan status for each container image. Access this table by navigating to the URL: <instance>.service-now.com/sn_itom_pattern_container_image_scan_status_list.do
Possible scan status values:
* None - Image has not been scanned
* In Progress - Scan is currently running
* Scanned - Scan completed successfully
* Error - Scan failed (check the Message field for details)
* Skipped - Image URL is malformed or unreachable
{#enabling-software-decomposition-tool__ul_scan_status}
**Related concepts**
* [Container image scanning for software decomposition](https://www.servicenow.com/docs/zb3cQIakhyf47PHP6PoyTQ "The ITOM Visibility apps, Discovery and Service Mapping Patterns and Kubernetes Visibility Agent integrate with Aqua Trivy to collect data on container images and OS packages. You can increase your control over container deployment by having visibility to the container components.")