Does grype fully handle the Trivy based SBOM vulnerability analysis?

Grype
1

I run trivy for SBOM generation and analyze it with grype, so I found that grype did not find vulnerabilities in the trivy-based SBOM

2

grype will work best when you use syft’s SBOM

in case you want better results, try to use trivy’s sbom with a known format like spdx, etc.

1 Like
3

Grype should work with SBOMs generated by other tools. Do you have any example SBOM you could share? As @TimBrown1611 says, it needs to be a standard format: SPDX or CyloneDX (or Syft format)