# Clair Application Analysis

The Clair coordinate-based matching feature provides the ability to scan and evaluate Clair-identified container dependencies.

For reference on how to use Clair please refer to the Clair documentation.

## What is Supported

Files named clair-scanner-output.json created by the client Clair scanner ( [https://github.com/arminc/clair-scanner](https://github.com/arminc/clair-scanner) ).

## Steps to analyze using the Sonatype IQ CLI

### Create the clair-scanner-output.json by running the Clair scanner

For detailed instructions on Clair scanner please refer to the Clair scanner documentation.

Example command

```bash
clair-scanner --ip 10.0.1.144 -r clair-scanner-output.json vulnerables/web-dvwa
```

Example file content

```
{
    "image": "image",
    "vulnerabilities": [
        {
            "featurename": "apt",
            "featureversion": "1.4.8",
            "vulnerability": "CVE-2019-3462",
            "namespace": "debian:9",
            "description": "TEST",
            "link": "https://security-tracker.debian.org/tracker/CVE-2019-3462",
            "severity": "Critical",
            "fixedby": "1.4.9"
        },
        {
            "featurename": "libxslt",
            "featureversion": "1.1.29-2.1",
            "vulnerability": "CVE-2017-16997",
            "namespace": "debian:9",
            "description": "TEST",
            "link": "https://security-tracker.debian.org/tracker/CVE-2017-16997",
            "severity": "Critical",
            "fixedby": "2.24-11+deb9u4"
        }
    ]
}
```

### Run a scan

Invoke a Sonatype IQ CLI scan of the directory containing clair-scanner-output.json. Instructions on how to do this can be found here [Sonatype IQ CLI](https://help.sonatype.com/en/sonatype-iq-cli.html "Sonatype IQ CLI").

## Steps to analyze using the Jenkins plugin

By default, the Jenkins plugin will not evaluate the clair-scanner-output.json file. A custom Scan Target is needed.

**Example Pipeline Script with Scan Patterns**

```
nexusPolicyEvaluation iqApplication: 'SampApp', iqScanPatterns: [[scanPattern: '**/clair-scanner-output.json']], iqStage: 'build'
```

To find more information on configuring Jenkins, please go to [Sonatype Platform Plugin for Jenkins](https://help.sonatype.com/en/sonatype-platform-plugin-for-jenkins.html "Sonatype Platform Plugin for Jenkins - Lifecycle").

## Steps to analyze using the Bamboo plugin

Bamboo Scan Targets control what files are examined. Add clair-scanner-output.json to the scan targets via "**/clair-scanner-output.json" to evaluate Clair. To find more information on configuring Bamboo, please go to [Sonatype IQ for Bamboo](https://help.sonatype.com/en/sonatype-for-bamboo-data-center.html "Sonatype for Bamboo Data Center").

## Search results

No results found