# Trivy Report Formats: JSON, CycloneDX, SPDX, and SARIF Explained

> Explore Trivy report formats including JSON, CycloneDX, SPDX, and SARIF. Learn how to leverage these formats for effective vulnerability analysis and compliance.

- Repository: [Aqua Security/trivy](https://github.com/aquasecurity/trivy)
- Tags: api-reference
- Published: 2026-03-23

---

**Trivy supports nine built-in output formats ranging from human-readable tables to standardized machine-readable specifications like CycloneDX and SARIF, with format selection logic centralized in [`pkg/report/writer.go`](https://github.com/aquasecurity/trivy/blob/main/pkg/report/writer.go) and constants defined in [`pkg/types/report.go`](https://github.com/aquasecurity/trivy/blob/main/pkg/types/report.go).**

Trivy, the comprehensive vulnerability scanner from Aqua Security, provides flexible output options to integrate with CI/CD pipelines, SBOM tools, and security dashboards. Understanding the available Trivy report formats allows teams to automate compliance workflows and feed scan results directly into vulnerability management systems. This guide examines the nine built-in formats defined in the `aquasecurity/trivy` repository, their implementation details, and practical usage examples.

## Core Report Format Constants in Trivy

Trivy defines all supported output formats as typed constants in **[`pkg/types/report.go`](https://github.com/aquasecurity/trivy/blob/main/pkg/types/report.go)**. The `Format` type serves as the single source of truth for valid output options, exposed through the `SupportedFormats` slice that the CLI validates against.

The complete list of format constants includes:

- **`FormatTable`** – Human-friendly tabular output printed to stdout
- **`FormatJSON`** – Pretty-printed JSON containing the full `Report` structure
- **`FormatTemplate`** – Custom Go template output via the `--template` flag
- **`FormatSarif`** – SARIF (Static Analysis Results Interop Format) for IDE integration
- **`FormatCycloneDX`** – CycloneDX SBOM in JSON format
- **`FormatSPDX`** – SPDX tag/value format (legacy)
- **`FormatSPDXJSON`** – SPDX JSON format (standardized)
- **`FormatGitHub`** – GitHub-specific SARIF-compatible output for the Security tab
- **`FormatCosignVuln`** – Cosign vulnerability predicate format for signed SBOMs

These constants map directly to writer implementations dispatched at runtime.

## How Trivy Dispatches Report Writers

When Trivy executes a scan, the selected format determines which writer implementation instantiates the output. This dispatch logic resides in **[`pkg/report/writer.go`](https://github.com/aquasecurity/trivy/blob/main/pkg/report/writer.go)**, where a switch statement on `option.Format` routes to the appropriate encoder:

```go
switch option.Format {
case types.FormatTable:
    writer = table.NewWriter(table.Options{...})
case types.FormatJSON:
    writer = &JSONWriter{Output: output, ReportOptions: opts}
case types.FormatGitHub:
    writer = &github.Writer{sarifWriter: sarifWriter}
case types.FormatCycloneDX:
    writer = cyclonedx.NewWriter(output, option.AppVersion, option.OS)
case types.FormatSPDX, types.FormatSPDXJSON:
    writer = spdx.NewWriter(output, option.AppVersion, option.Format)
case types.FormatTemplate:
    writer = &TemplateWriter{Output: output, Template: option.Template}
case types.FormatSarif:
    writer = &SarifWriter{Output: output, ...}
case types.FormatCosignVuln:
    writer = predicate.NewVulnWriter(output, option.AppVersion, option.CLIOptions)
default:
    return xerrors.Errorf("unknown format: %v", option.Format)
}

```

Each writer lives in a dedicated package under `pkg/report/`, handling format-specific marshaling logic.

## Machine-Readable Trivy Report Formats

Trivy excels at producing standardized machine-readable outputs that integrate with third-party security and compliance tools. The following sections detail the primary specifications.

### JSON Output Format

The **JSON format** provides the complete vulnerability report structure with indentation for readability. The `JSONWriter` in **[`pkg/report/json.go`](https://github.com/aquasecurity/trivy/blob/main/pkg/report/json.go)** marshals the `types.Report` struct using `json.MarshalIndent`, preserving all metadata including OS packages, library dependencies, and misconfigurations.

```bash
trivy image --format json --output report.json nginx:latest

```

### CycloneDX SBOM Format

**CycloneDX** is a lightweight Software Bill of Materials (SBOM) standard designed for security use cases. The `cyclonedx.NewWriter` function in **[`pkg/report/cyclonedx/cyclonedx.go`](https://github.com/aquasecurity/trivy/blob/main/pkg/report/cyclonedx/cyclonedx.go)** generates JSON documents compliant with the CycloneDX specification, listing components and their vulnerabilities.

```bash
trivy image --format cyclonedx --output sbom.cdx.json nginx:latest

```

### SPDX Format Options

Trivy supports two SPDX output variants defined in **[`pkg/report/spdx/spdx.go`](https://github.com/aquasecurity/trivy/blob/main/pkg/report/spdx/spdx.go)**: the legacy **tag/value** format (`FormatSPDX`) and the standardized **JSON** format (`FormatSPDXJSON`). The `spdx.NewWriter` accepts the format constant to determine serialization style.

```bash

# SPDX JSON (recommended)

trivy image --format spdx-json --output sbom.spdx.json nginx:latest

# SPDX tag-value (legacy)

trivy image --format spdx --output sbom.spdx nginx:latest

```

### SARIF for Static Analysis Integration

The **SARIF** (Static Analysis Results Interop Format) output enables integration with GitHub Advanced Security, Azure DevOps, and VS Code. Implemented in **[`pkg/report/sarif.go`](https://github.com/aquasecurity/trivy/blob/main/pkg/report/sarif.go)**, the `SarifWriter` structures vulnerability locations and severity levels according to the SARIF 2.1.0 specification.

```bash
trivy image --format sarif --output report.sarif nginx:latest

```

### GitHub and Cosign Vuln Formats

Beyond standard specifications, Trivy provides specialized formats for modern DevSecOps workflows. The **`FormatGitHub`** constant triggers the writer in **[`pkg/report/github.go`](https://github.com/aquasecurity/trivy/blob/main/pkg/report/github.go)**, producing SARIF optimized for GitHub's Security tab. For supply chain security, **`FormatCosignVuln`** (implemented in **[`pkg/report/predicate.go`](https://github.com/aquasecurity/trivy/blob/main/pkg/report/predicate.go)**) generates Cosign-compatible vulnerability predicates for signing and verifying SBOM attestations.

## Generating Trivy Reports from the CLI

All formats are accessible via the `--format` flag across Trivy subcommands (image, filesystem, repository, etc.). The CLI validates input against the `SupportedFormats` slice before execution.

Common usage patterns:

```bash

# Human-readable table (default)

trivy image nginx:latest

# Full JSON report for automation

trivy fs --format json --output trivy-report.json .

# CycloneDX SBOM for compliance

trivy repo --format cyclonedx --output sbom.json https://github.com/org/repo

# SARIF for GitHub Actions integration

trivy image --format sarif --output trivy-results.sarif alpine:latest

```

## Programmatic Report Generation with the Go API

Developers embedding Trivy can generate reports programmatically using the `report.Write` function. The `flag.Options` struct (defined in [`pkg/flag/flag.go`](https://github.com/aquasecurity/trivy/blob/main/pkg/flag/flag.go)) specifies the format and output destination, mirroring CLI behavior.

```go
package main

import (
    "context"
    "os"

    "github.com/aquasecurity/trivy/pkg/report"
    "github.com/aquasecurity/trivy/pkg/types"
    "github.com/aquasecurity/trivy/pkg/flag"
)

func main() {
    // Assume reportData is populated from a scan
    var reportData types.Report

    opts := flag.Options{
        Format: types.FormatJSON,      // or FormatCycloneDX, FormatSarif, etc.
        Output: "scan-results.json",
    }

    ctx := context.Background()
    if err := report.Write(ctx, reportData, opts); err != nil {
        panic(err)
    }
}

```

The `Write` function internally dispatches to the appropriate writer implementation based on `opts.Format`.

## Summary

- Trivy defines **nine built-in report formats** as constants in [`pkg/types/report.go`](https://github.com/aquasecurity/trivy/blob/main/pkg/types/report.go), ranging from human-readable tables to machine-readable SBOM standards.
- Format selection logic resides in **[`pkg/report/writer.go`](https://github.com/aquasecurity/trivy/blob/main/pkg/report/writer.go)**, which instantiates specialized writers including `JSONWriter`, `SarifWriter`, and `cyclonedx.Writer`.
- **Standardized formats** include CycloneDX (SBOM), SPDX (tag/value and JSON), and SARIF (static analysis), enabling integration with GitHub, Azure DevOps, and compliance tools.
- **Specialized formats** like `FormatGitHub` and `FormatCosignVuln` support DevSecOps workflows including signed attestations and GitHub Security tab integration.
- Both CLI (`--format`) and Go API (`report.Write`) interfaces accept these format constants, with validation against the `SupportedFormats` slice.

## Frequently Asked Questions

### What is the default report format in Trivy?

The default format is **`FormatTable`**, which produces human-readable tabular output printed directly to stdout. This format is defined in [`pkg/types/report.go`](https://github.com/aquasecurity/trivy/blob/main/pkg/types/report.go) and instantiated via `table.NewWriter` in [`pkg/report/writer.go`](https://github.com/aquasecurity/trivy/blob/main/pkg/report/writer.go) when no `--format` flag is specified.

### How do I generate a CycloneDX SBOM with Trivy?

Use the `--format cyclonedx` flag with any scan target. Trivy marshals the component inventory and vulnerability data using the `cyclonedx.NewWriter` in [`pkg/report/cyclonedx/cyclonedx.go`](https://github.com/aquasecurity/trivy/blob/main/pkg/report/cyclonedx/cyclonedx.go), outputting a valid CycloneDX JSON document suitable for SBOM repositories and compliance audits.

### Can Trivy output SPDX 2.3 JSON format?

Yes. Specify `--format spdx-json` to generate SPDX in JSON format. The `spdx.NewWriter` in [`pkg/report/spdx/spdx.go`](https://github.com/aquasecurity/trivy/blob/main/pkg/report/spdx/spdx.go) handles both the legacy tag/value format (`spdx`) and the standardized JSON format (`spdx-json`), with the latter conforming to SPDX 2.3 specifications.

### Which Trivy format should I use for GitHub Advanced Security?

Use **`--format sarif`** or **`--format github`**. The standard SARIF format (`sarif`) works with any SARIF-compatible tool, while the GitHub-specific format (`github`) is optimized for the GitHub Security tab and code scanning alerts, implemented in [`pkg/report/github.go`](https://github.com/aquasecurity/trivy/blob/main/pkg/report/github.go).