Integrate Steampipe with Vulnetix. Query cloud infrastructure with SQL and run CIS, PCI-DSS, and NIST compliance benchmarks via Powerpipe. Export findings as JSON for upload to Vulnetix.
Install & scan
$ # Linux/macOS install script sudo /bin/sh -c "$(curl -fsSL https://raw.githubusercontent.com/turbot/steampipe/main/install.sh)" # Homebrew brew tap turbot/tap && brew install steampipe # Install AWS plugin steampipe plugin install aws # Install Powerpipe (for benchmarks) brew install powerpipe # or: sudo /bin/sh -c "$(curl -fsSL https://powerpipe.io/install/powerpipe.sh)" $ # Install AWS compliance mod powerpipe mod install github.com/turbot/steampipe-mod-aws-compliance # Start Steampipe service steampipe service start # Run CIS v3.0 benchmark and export JSON powerpipe benchmark run aws_compliance.benchmark.cis_v300 --output=json --export=steampipe-compliance.json
Run Steampipe in CI
Scan on every push and upload the report as a workflow artifact:
- name: Install Steampipe and Powerpipe
run: |
sudo /bin/sh -c "$(curl -fsSL https://raw.githubusercontent.com/turbot/steampipe/main/install.sh)"
sudo /bin/sh -c "$(curl -fsSL https://powerpipe.io/install/powerpipe.sh)"
steampipe plugin install aws
- name: Run CIS AWS compliance benchmark
run: |
powerpipe mod install github.com/turbot/steampipe-mod-aws-compliance
steampipe service start
powerpipe benchmark run aws_compliance.benchmark.cis_v300 --export=steampipe-cis.json
- name: Upload to Vulnetix
run: vulnetix upload --file steampipe-cis.json
How Vulnetix compares: better together
Vulnetix does not replace Steampipe. Keep running it. Vulnetix sits on top of Steampipe (and every other scanner you already own) turning disconnected tool outputs into one prioritised, fixable queue.
Steampipe is strongest at its core category and also carries features in IaC & Cloud Configuration, Compliance & Policy Engines, just as Vulnetix spans categories.
| Capability | Vulnetix | Steampipe |
|---|---|---|
| Security coverage | ||
| SAST (static code analysis) | ✓ Built-in rules + Semgrep augmentation | ✗ |
| SCA / dependencies | ✓ 40+ ecosystems, transitive graph | ✗ |
| DAST (dynamic testing) | ~ Ingests DAST results; no native dynamic engine | ✗ |
| Container & image | ✓ Image CVEs, base image, Dockerfile | ✗ |
| IaC / misconfiguration | ✓ Terraform, k8s, CloudFormation | ~ Terraform/config plugins let you query IaC files as tables, but no dedicated misconfig-rule engine |
| Secret scanning | ✓ 1,000+ rules, source + binary + git history | ✗ |
| Cloud / CSPM | ✓ Cloud-posture findings, compliance tab | ✓ Core: SQL over live cloud config; Powerpipe runs CIS/PCI/NIST/SOC2 posture benchmarks |
| Mobile (MAST) | ~ Ingests mobile scanner output; no native mobile engine | ✗ |
| License compliance | ✓ SPDX, copyleft/AGPL/SSPL policy | ✗ |
| SBOM generation | ✓ CycloneDX 1.7 + SPDX 2.3, cosign-signable | ✗ |
| Malware / supply-chain | ✓ De-duplicated corpus + install-time firewall (25+ registries) | ✗ |
| Network / infra vuln | ~ Ingests network scanner output; no native network scanner | ✗ |
| Fuzzing | ✗ Ingests fuzzing crashes; no native fuzzer | ✗ |
| Pentest / bug bounty | ✗ Ingests pentest/bug-bounty findings; not a testing service | ✗ |
| The Vulnetix orchestration layer | ||
| Cross-scanner dedup & one queue (ASPM) | ✓ Correlates every scanner into one prioritised queue with ownership routing | ✗ |
| Exploit-intel prioritisation | ✓ EPSS, CISA KEV, Coalition ESS, CWSS, Vulnetix LEV | ✗ |
| Reachability analysis | ✓ Tree-sitter + CVEAffected; direct/transitive/semantic | ✗ |
| Versioned VEX + audit trail | ✓ Immutable OpenVEX/CycloneDX, cosign-signable | ✗ |
| Safe Harbour autofix | ✓ Resolves + applies the nearest safe version | ✗ |
| End-of-life policy | ✓ Flags/blocks past-EOL runtimes & packages | ✗ |
| SSVC / risk-based policy | ✓ SSVC v2 + CISA/FedRAMP/Essential-8 presets | ✗ |
✓ full · ~ partial · ✗ not covered
What Steampipe does well
- Turns 100+ cloud/SaaS APIs into a live PostgreSQL-queryable surface via zero-ETL plugins, so security teams can ask arbitrary SQL questions about their real running infrastructure
- Companion Powerpipe ships maintained mods with full compliance benchmarks (CIS, PCI-DSS, HIPAA, NIST CSF, SOC 2, FedRAMP, GDPR) runnable as CLI controls or dashboards across AWS/Azure/GCP
- Open-source, embeddable (CLI, Postgres FDW, SQLite extension) and scriptable, trivially integrated into CI or ad-hoc investigation
- Huge community plugin hub keeps coverage current as providers add services
Where Vulnetix adds to it: Steampipe/Powerpipe is a live-query and compliance-benchmark engine for cloud posture. It finds misconfigurations but has no dependency, SAST, malware, or exploit-intel layer. Vulnetix ingests Powerpipe/CSPM findings and merges them into one cross-scanner queue, then adds EPSS/KEV/LEV exploit prioritisation, versioned VEX, EOL and SSVC policy, and Safe Harbour autofix on top of the raw posture results.
No migration, no rip-and-replace. Steampipe keeps doing what it does best; Vulnetix adds the orchestration, exploit-intelligence prioritisation and remediation layer built for the way AppSec works today.
Centralise Steampipe results in Vulnetix
Upload Steampipe JSON, CSV, HTML output to the Vulnetix platform to deduplicate findings, prioritise them with EPSS, CISA KEV and Coalition ESS exploit intelligence, and track remediation across every scanner in a single queue.