The new docs.trellix.com offers a modernized UI and AI-powered features like conversational searches. Content is currently available only in English. Other languages will be available in mid-October 2026. We hope you enjoy the new experience.

Press CTRL+K to open search

Perform image scanning with Trellix Endpoint Security (ENS) for Linux Container Vulnerability Scanner

  • Published on Sep 13, 2026
  • 1 minute(s) read
Prev Next

Follow these steps to scan docker hub and private registry images using Trellix Endpoint Security (ENS) for Linux Container Vulnerability Scanner.

You must have McAfee Agent 5.6.4.110 or later installed and running on your system. For private registry setups that support https, you must store the self-signed TLS certificate in your cert store for appropriate functioning of Container Vulnerability Scanner.

Important

To get the CVE information, the Trellix CVS scanner must have access to https://www.myshn.net/.

  1. Navigate to the location of mfecvs binary:

    cd $HOME/some/path/CVS

  2. To start scanning:

    ./mfecvs help scan

    This command helps you to get the vulnerabilities information for a particular $image:$tag

    [Private Registry]

    mfecvs scan -r "Docker Private Registry" -i ubuntu:latest -f json -o output.json

    [Docker Hub]

    Note

    If registry flag is not set, then the default registry is assumed to be DockerHub.

    mfecvs scan -i ubuntu:latest --format table --output Vulnerability.txt --severity High

    Flags that can be used with the list command:

    Flags:

    -f

    --format string

    Specify the format to get the output. Valid options are table and json. Eg: --format table (default "table")

    -h

    --help

    help for scan

    -i

    --image string

    Specify the imagename to scan. Eg: --image ubuntu:latest

    -o

    --output string

    Specify the output file. Eg: --output vulnerabilities.json

    -p

    --password string

    Specify the password for the registry

    -r

    --registry string

    Specify the name of the registry to look for images. Default is docker hub.

    -s

    --severity string

    Specify the minimum severity to output. Valid options are Default, High, Medium, Low, and Unknown. Eg: --severity High (default "High")

    Global Flags:

    --config string

    config file (default is $HOME/.mfecvs.yaml)

    Classify your scan using these flags as required.

  3. On entering your password, the Container Vulnerability Scanner displays the results mentioning the severity level of each package.

Related articles