How do you generate Trivy scan reports in different formats (JSON, table, SARIF)?

Trivy's output formats are like choosing between reading a medical report as a patient summary (table), a structured data file for the hospital's database (JSON), or a standardized format that any hospital worldwide can import (SARIF). Each format serves a different audience and use case. Picking the right format determines whether your scan results are actionable by humans, machines, or both.

The default output format is table, which displays a human-readable columnar view in the terminal. Each vulnerability is shown with its CVE ID, package name, installed version, fixed version, and severity. This format is ideal for developers running Trivy locally on a project like payments-api because the results are immediately readable. However, table output is difficult to parse programmatically and does not integrate well with automated tooling. For CI/CD pipelines and security dashboards, other formats are more appropriate.

The JSON format (--format json) produces a structured output that contains all scan metadata, including the target name, scanner type, operating system details, and a complete list of vulnerabilities with their CVSS scores, descriptions, references, and fix availability. This format is essential for integrating Trivy results into security information and event management (SIEM) systems, custom dashboards, or downstream processing scripts. A typical workflow for order-processing-service might pipe JSON output through jq to extract only CRITICAL vulnerabilities, count them, and post the summary to a Slack channel. The SARIF format (Static Analysis Results Interchange Format) is specifically designed for integration with code scanning platforms like GitHub Advanced Security, GitLab SAST, and Azure DevOps. When Trivy generates SARIF output, the results appear as annotations directly on pull requests, showing exactly which file and line introduced a vulnerability or misconfiguration.

Beyond these core formats, Trivy supports SBOM (Software Bill of Materials) formats like CycloneDX and SPDX, which produce a complete inventory of all software components in a container image or filesystem. These formats are increasingly required by government regulations and enterprise procurement processes. Trivy also supports Go template-based custom formats, allowing teams to generate reports in any structure they need. For example, a team managing checkout-service and inventory-sync might create a custom HTML template that produces a branded security report for stakeholders. The --output flag saves results to a file instead of printing to stdout, and it can be combined with any format flag.

In production, teams often generate multiple formats from a single scan. A CI pipeline for user-auth-service might produce table output for the build log, JSON output for the security dashboard, and SARIF output for GitHub code scanning annotations. Since re-running the scan three times would be wasteful, teams typically run Trivy once with JSON output, then use post-processing tools to convert the JSON to other formats as needed. The trivy convert command can transform a previously saved JSON report into SARIF, CycloneDX, or other formats without re-scanning. This approach is both faster and ensures consistency across all report formats.