Sysdig Integration Guide

Integrate Sysdig Secure with Vulnetix. Use the sysdig-cli-scanner to scan container images for CVEs. Export SARIF findings and upload to Vulnetix.

Run Sysdig in CI

Scan on every push and upload the report as a workflow artifact:

- name: Scan with Sysdig
  id: scan
  uses: sysdiglabs/scan-action@v6
  with:
    image-tag: myapp:${{ github.sha }}
    sysdig-secure-token: ${{ secrets.SYSDIG_SECURE_TOKEN }}
    severity-at-least: high
    stop-on-failed-policy-eval: false

- name: Upload report
  uses: actions/upload-artifact@v6
  with:
    name: sysdig
    path: ${{ github.workspace }}/sarif.json
    if-no-files-found: warn

Then one publish job hands every artifact in the run to Vulnetix, recorded under Sysdig's own name and version. Written once per workflow, however many scanners you run:

publish:
  name: Publish to Vulnetix
  runs-on: ubuntu-latest
  needs: [scan]        # every scanner job, or its report is never published
  if: always()         # or one failing scanner suppresses all the others
  permissions:
    contents: read
    actions: read      # required to list the run's artifacts
  env:
    VULNETIX_ORG_ID: ${{ secrets.VULNETIX_ORG_ID }}
    VULNETIX_API_KEY: ${{ secrets.VULNETIX_API_KEY }}
  steps:
    - uses: actions/checkout@v5
    - name: Install Vulnetix CLI
      run: |
        curl -fsSL https://cli.vulnetix.com/install.sh | sh -s -- --install-dir "$HOME/.local/bin"
        echo "$HOME/.local/bin" >> "$GITHUB_PATH"
    - name: Publish scanner reports
      env:
        GITHUB_TOKEN: ${{ github.token }}
      run: vulnetix gha upload --org-id "$VULNETIX_ORG_ID" --json

After the run, vulnetix gha status reports what was actually recorded.

How Vulnetix compares: better together

Vulnetix does not replace Sysdig. Keep running it. Vulnetix sits on top of Sysdig (and every other scanner you already own) turning disconnected tool outputs into one prioritised, fixable queue.

Sysdig is strongest at its core category and also carries features in Cloud Security & CSPM, IaC & Cloud Configuration, Secret Scanning, SCA, Network & Vulnerability Scanners, SAST, DAST, just as Vulnetix spans categories.

✓ full · ~ partial · ✗ not covered

What Sysdig does well

• Runtime-powered vulnerability management: In-Use validation filters CVEs to packages actually loaded in running workloads, high-signal prioritization
• Falco-based Cloud Detection & Response (CDR) plus CSPM, KSPM and CIEM in one CNAPP with deep runtime threat detection
• EPSS score and percentile policies plus Has-Exploit/Has-Fix context built directly into the findings and policy engine
• Agentless + agent coverage (Host/Cluster Shield) building CycloneDX SBOMs from live workloads and registries

Where Vulnetix adds to it: Vulnetix ingests Sysdig's container, cloud, IaC and AppSec findings and consolidates them with other scanners into one prioritised queue, adding immutable versioned VEX, Safe Harbour autofix/fix PRs, EOL policy and SSVC, capabilities Sysdig does not provide. Sysdig's runtime In-Use reachability, WAAS and Falco-based CDR remain its own live-workload strengths that Vulnetix ingests but does not run or replicate.

No migration, no rip-and-replace. Sysdig keeps doing what it does best; Vulnetix adds the orchestration, exploit-intelligence prioritisation and remediation layer built for the way AppSec works today.

Centralise Sysdig results in Vulnetix

Upload Sysdig SARIF, JSON output to the Vulnetix platform to deduplicate findings, prioritise them with EPSS, CISA KEV and Coalition ESS exploit intelligence, and track remediation across every scanner in a single queue.

Sysdig documentation ↗

Wire Sysdig into your CI/CD pipeline →