Template Analyzer Integration Guide

Integrate Microsoft Template Analyzer with Vulnetix. Scan Azure ARM templates and Bicep files for security misconfigurations and export SARIF findings for upload to Vulnetix.

Install & scan

$ dotnet tool install --global Microsoft.Azure.TemplateAnalyzer

# Verify
template-analyzer --version
$ template-analyzer analyze-template template.json   --output-file-format sarif   --output-file analyzer-results.sarif

Run Template Analyzer in CI

Scan on every push and upload the report as a workflow artifact:

- name: Install Template Analyzer
  run: dotnet tool install --global Microsoft.Azure.TemplateAnalyzer

- name: Analyze ARM templates
  run: template-analyzer analyze-template template.json --output-file-format sarif --output-file results.sarif

- name: Upload report
  uses: actions/upload-artifact@v6
  with:
    name: templateanalyzer
    path: results.sarif
    if-no-files-found: warn

Then one publish job hands every artifact in the run to Vulnetix, recorded under Template Analyzer's own name and version. Written once per workflow, however many scanners you run:

publish:
  name: Publish to Vulnetix
  runs-on: ubuntu-latest
  needs: [scan]        # every scanner job, or its report is never published
  if: always()         # or one failing scanner suppresses all the others
  permissions:
    contents: read
    actions: read      # required to list the run's artifacts
  env:
    VULNETIX_ORG_ID: ${{ secrets.VULNETIX_ORG_ID }}
    VULNETIX_API_KEY: ${{ secrets.VULNETIX_API_KEY }}
  steps:
    - uses: actions/checkout@v5
    - name: Install Vulnetix CLI
      run: |
        curl -fsSL https://cli.vulnetix.com/install.sh | sh -s -- --install-dir "$HOME/.local/bin"
        echo "$HOME/.local/bin" >> "$GITHUB_PATH"
    - name: Publish scanner reports
      env:
        GITHUB_TOKEN: ${{ github.token }}
      run: vulnetix gha upload --org-id "$VULNETIX_ORG_ID" --json

After the run, vulnetix gha status reports what was actually recorded.

How Vulnetix compares: better together

Vulnetix does not replace Template Analyzer. Keep running it. Vulnetix sits on top of Template Analyzer (and every other scanner you already own) turning disconnected tool outputs into one prioritised, fixable queue.

✓ full · ~ partial · ✗ not covered

What Template Analyzer does well

• Native Azure IaC coverage for both ARM templates (.json) and Bicep files, from Microsoft itself
• SARIF output with correct per-rule severity in the level property, for clean CI and security-tooling integration
• Customizable/extensible JSON-authored rules (Rules/BuiltInRules.json) so orgs can enforce only relevant checks
• Free and open-source, purpose-built for Azure security best-practice and misconfiguration detection

Where Vulnetix adds to it: Vulnetix consumes Template Analyzer's SARIF output and merges its Azure ARM/Bicep misconfiguration findings into a single deduplicated, prioritised queue with exploit-intel, SSVC, versioned VEX and autofix across all scanner types. Better together: Template Analyzer stays the Azure IaC checker; Vulnetix orchestrates and prioritises its results alongside every other scanner.

No migration, no rip-and-replace. Template Analyzer keeps doing what it does best; Vulnetix adds the orchestration, exploit-intelligence prioritisation and remediation layer built for the way AppSec works today.

Centralise Template Analyzer results in Vulnetix

Upload Template Analyzer SARIF, JSON output to the Vulnetix platform to deduplicate findings, prioritise them with EPSS, CISA KEV and Coalition ESS exploit intelligence, and track remediation across every scanner in a single queue.

Template Analyzer documentation ↗  ·  Source repository ↗

Wire Template Analyzer into your CI/CD pipeline →