| cli-scanner-url | URL to sysdig-cli-scanner binary download | no | — |
| cli-scanner-version | Custom sysdig-cli-scanner version to download. Oldest supported version is 1.22.6. | no | 1.24.1 |
| cli-scanner-sha256sum | SHA256 sum of the Sysdig CLI scanner binary to verify the download. | no | — |
| registry-user | Registry username. | no | — |
| registry-password | Registry password. | no | — |
| stop-on-failed-policy-eval | Fail the job if the Policy Evaluation is Failed. | no | false |
| stop-on-processing-error | Fail the job if the Scanner terminates execution with errors. | no | false |
| standalone | Enable standalone mode. Do not depend on Sysdig backend for execution, avoiding the need of specifying 'sysdig-secure-token' and 'sysdig-secure-url'. | no | false |
| db-path | Specify directory for database to use while scanning. | no | — |
| skip-upload | Skip uploading results to Sysdig Secure. | no | false |
| skip-summary | Skip generating Summary. | no | false |
| use-policies | Comma-separated list of Sysdig Secure VM Policies to evaluate against the image. Policies with spaces must be enclosed in quotes. | no | — |
| override-pullstring | Custom PullString to give the image when scanning and uploading. | no | — |
| severity-at-least | Filtering option to only report vulnerabilities with at least the specified severity. Can take [critical|high|medium|low|negligible|any]. Default value "any" for no filtering. | no | any |
| package-types | Comma-separated list of package types to include in the SARIF/summary report. Example: "java,javascript" | no | — |
| not-package-types | Comma-separated list of package types to exclude from the SARIF/summary report. Example: "os,alpine" | no | — |
| exclude-accepted | Exclude vulnerabilities that have accepted risks from SARIF/summary report. true/false | no | false |
| group-by-package | Enable grouping the vulnerabilities in the SARIF report by package. | no | false |
| image-tag | Tag of the image to analyse. (Required if not in IaC mode.) | no | — |
| sysdig-secure-token | API token for Sysdig Scanning auth. (Required if not in Standalone mode.) | no | — |
| sysdig-secure-url | Sysdig Secure URL (ex: "https://secure-sysdig.com"). | no | https://secure.sysdig.com |
| sysdig-skip-tls | Skip TLS verification when calling secure endpoints. | no | — |
| extra-parameters | Additional parameters added to the secure-inline-scan container execution. | no | — |
| mode | Mode of operation. Can be "vm" or "iac". | no | vm |
| recursive | Recursively scan all folders within the folder specified in the iacScanPath. | no | false |
| minimum-severity | Minimum severity to fail when scanning in IaC mode | no | high |
| iac-scan-path | Path to the IaC files to scan. | no | ./ |