Grype takes the inventory Syft produced (or scans an image directly) and matches it against vulnerability databases. Splitting generation from matching is the useful part: the SBOM is produced once at build time and can be re-scanned every day afterwards, so an artifact already shipped still gets re-evaluated as new advisories appear.
GRY
Grype
Anchore
Scans an SBOM or image for known vulnerabilities — the matching half of the Syft pair.
Cyber Kill Chain & Defender Lifecycle
Attacker — Kill Chain
1
Reconnaissance
2
Weaponization
3
Delivery
4
Exploitation
5
Installation
6
Command & Control
7
Actions on Objectives
Defender — IR Lifecycle
8
Preparation
9
Detection & Analysis
10
Containment, Eradication & Recovery
11
Post-Incident Activity
Description
Use cases
- Daily re-scan of an already-released artifact
- Vulnerability gate on a container image before deploy
- Pairing with Syft for a generate-once, scan-often pipeline
Example
grype sbom:./sbom.json --fail-on high