---
sourceDocument: Brazil IT Operations Management
sourceDocumentLink: https://www.servicenow.com/docs/r/it-operations-management

 Release :

    - brazil

ft:locale :

    - en-US

ft:publication_title :

    - Brazil IT Operations Management

ft:clusterId :

    - itom

bundleId :

    - itom

workflow :

    - Technology


---

# Container image scanning with Syft

# Enabling container image scanning with Syft scanner {#ariaid-title1}

Release version: Brazil  
Updated September 10, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 3 minutes to read  
Use container image scanning with the Syft scanner to identify the software packages installed in
your container images for compliance, licensing, and security
purposes
without requiring a MID Server.

This feature provides an alternative to the existing Aqua Trivy integration that requires a MID Server. For customers already using KVA, Syft scanner offers a simpler deployment without additional infrastructure or manual tool installation.  
Note:  
For more information about this feature, see the [Software decomposition of container images using Kubernetes Visibility Agent and Syft \[KB3149735\]](https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB3149735) article in the Now Support Knowledge Base.

## Benefits of Syft scanner integration {#enabling-software-decomposition-tool__section_benefits}

The Syft scanner integration provides the following advantages:

* No MID Server required
* No manual installation of scanning tools
* Automatic integration with KVA Informer
* Scans container images directly from the Kubernetes cluster
* Populates the same data model as the Aqua Trivy integration
{#enabling-software-decomposition-tool__ul_benefits}

## Installation method {#enabling-software-decomposition-tool__section_installation}

The Syft scanner is only supported when installing KVA Informer using the Helm chart. YAML-based installation does not support the Syft scanner feature.

To enable Syft scanner during Helm installation, add the following parameter to the Helm install command:

    --set runSyftScanner=true

Warning:  
The Syft scanner image is not FIPS-140 compliant. Setting runSyftScanner to `true` adds a non-compliant image to the Informer pod, which may affect deployments in regulated environments. For more information, see [Kubernetes Visibility Agent support matrix](https://www.servicenow.com/docs/y9MlRrLy9Zu8jXvZDYK92w "The Kubernetes Visibility Agent component is supported on several versions of Kubernetes and OpenShift and in various Kubernetes environments.").

For complete installation instructions, see [Install Kubernetes Visibility Agent (KVA) Informer](https://www.servicenow.com/docs/R6U4gdqxZR~X1CFgafbpkA "You can install Kubernetes Visibility Agent Informer using either a Helm chart or the Kubernetes YAML file provided by ServiceNow.").

## Enabling container image scanning {#enabling-software-decomposition-tool__section_enable}

After installing the Informer with Syft scanner support, enable container image scanning by setting the following system properties to <kbd class="ph userinput">true</kbd>:

* sn_itom_pattern.container_image_scan - Enables the container image scanning mechanism
* sn_acc_visibility.image_scan_enabled - Directs the system to use the Syft scanner in KVA instead of Aqua Trivy on a MID Server

{#enabling-software-decomposition-tool__ul_properties}  
Note:  
You cannot use both scanning methods simultaneously. When sn_acc_visibility.image_scan_enabled is set to <kbd class="ph userinput">true</kbd>, the system uses only the Syft scanner method.

## Informer status fields {#enabling-software-decomposition-tool__section_informer_fields}

When an Informer is configured with Syft scanner support, the following fields appear on the Informer form:

* Image Scanner Enabled - Indicates whether the Informer supports container image scanning (true or false)
* Image Scan Registries - Comma-separated list of image registries the Informer can access through credential-less trust relationships (ecr, acr, google)

{#enabling-software-decomposition-tool__ul_informer_fields}  
Note:  
To scan images in protected registries that require credentials, grant the Informer's service account read access to the secrets that hold the credentials for those registries.

A new UI action Get Syft Scanner Logs is available on Informer records that have image scanning enabled. Selecting this action retrieves the Syft scanner logs and attaches them to the Informer record as
k8s_informer_syft.log.

## Data collected by container image scans {#enabling-software-decomposition-tool__section_data_collected}

When the Syft scanner successfully scans a container image, the system populates the following fields on the Docker Image CI \[cmdb_ci_docker_image\]:
{#enabling-software-decomposition-tool__table_docker_image_fields__entry__2}

| Field | Description |
|-|-|
| Operating System \[os\] | Operating system name |
| OS Version \[os_version\] | Operating system version |
| Architecture \[architecture\] | Processor architecture. Examples: amd64, arm64 |
| Size (bytes) \[size_bytes\] | Image size in bytes |
| OS Family \[os_family\] | Operating system family. Examples: rhel, centos, alpine, azurelinux, windows |
| Image created \[image_created_at\] | Timestamp when the image was created |
| Command \[command\] | Default command executed when the container starts |
[Table 1. Docker Image CI fields populated by Syft scanner]

{#enabling-software-decomposition-tool__table_docker_image_fields}  
Note:  
Not all fields are populated for every image. Field availability depends on the image metadata and scan results.

## Software packages identified {#enabling-software-decomposition-tool__section_software_packages}

The Syft scanner identifies software packages contained in the container image and creates records in the Container Image OS Packages \[sn_itom_pattern_container_image_os_packages\] table. This table appears as a related list
on the Docker Image CI form.

Each software package record includes:

* Package Name
* Package Version
* Package Maintainer

{#enabling-software-decomposition-tool__ul_package_fields}  
Note:  
Package maintainer and version information depends on the data available in the image. The Syft scanner reports what is present in the image metadata.

## Monitoring scan status {#enabling-software-decomposition-tool__section_scan_status}

The Container Image Scan Status \[sn_itom_pattern_container_image_scan_status\] table maintains the scan status for each container image. Access this table by navigating to the URL:
<kbd class="ph userinput">&lt;instance&gt;.service-now.com/sn_itom_pattern_container_image_scan_status_list.do</kbd>

Possible scan status values:

* None - Image has not been scanned
* In Progress - Scan is currently running
* Scanned - Scan completed successfully
* Error - Scan failed (check the Message field for details)
* Skipped - Image URL is malformed or unreachable
{#enabling-software-decomposition-tool__ul_scan_status}
**Related concepts**   

* [Container image scanning for software decomposition](https://www.servicenow.com/docs/zb3cQIakhyf47PHP6PoyTQ "The ITOM Visibility apps, Discovery and Service Mapping Patterns and Kubernetes Visibility Agent integrate with Aqua Trivy to collect data on container images and OS packages. You can increase your control over container deployment by having visibility to the container components.")