The new docs.trellix.com offers a modernized UI and AI-powered features like conversational searches. Content is currently available only in English. Other languages will be available in mid-October 2026. We hope you enjoy the new experience.

Press CTRL+K to open search

Configure Trellix Endpoint Security (ENS) for Linux Container Vulnerability Scanner

  • Published on Sep 13, 2026
  • 1 minute(s) read
Prev Next

You must have McAfee Agent 5.6.4.110 or later installed and running on your system. For private registry setups that support https, you must store the self-signed TLS certificate in your cert store for appropriate functioning of Container Vulnerability Scanner.

To configure Trellix Endpoint Security (ENS) for Linux Container Vulnerability Scanner, you must first enter your registry credentials in the config yaml file. The registry credentials must include the name of the registry, URL, and the username with which you are trying to access the registry. For docker hub registry image, the registry name is fixed as DockerHub. There can be only one DockerHub. For private registry, you can have a username of your choice.

Follow these steps to configure Trellix Endpoint Security (ENS) for Linux Container Vulnerability Scanner on your system.

  1. Create a config file:

    $HOME/.mfecvs.yaml

    You can also change the location of the yaml using –config flag with the intended commands. For a sample on how to write the yaml file, please refer to .mfecvs.yaml.sample shipped along with the product.

    ./mfecvs --config "/path/to/file" list

  2. Use the help command to know the correct usage of a particular command. The help commands also enables you to get to the man page.

    Few examples of help commands include./mfecvs help, ./mfecvs help list, and /mfecvs help scan.

    These commands enables you to output a manpage that describes the usage details of the command.

  3. To list an image in the registry for both private docker registries and docker hub, navigate to:

    ./mfecvs help list

    [Private Registry]

    mfecvs list --registry "YourPrivateRegistryName"

    [Docker Hub]

    Note

    If registry flag is not set, then the default registry is assumed to be docker hub.

    mfecvs list -r "DockerHub"

    or

    mfecvs list

    Flags that can be used with the list command:

    Flags:

    -h,

    --help

    help for list

    -p,

    --password string

    Specify the password for the registry

    -r,

    --registry string

    Specify the name of the registry to look for images. Default is docker hub

    Global Flags:

    --config string

    config file (default is $HOME/.mfecvs.yaml)

  4. On entering the password, Container Vulnerability Scanner fetches all the images present in your registry.