openshift · agantony · Jun 22, 2026 · May 18, 2026
diff --git a/cli/command-reference/roxctl-scanner.adoc b/cli/command-reference/roxctl-scanner.adoc
@@ -6,28 +6,15 @@ include::modules/common-attributes.adoc[]
 
 toc::[]
 
-Commands related to the StackRox Scanner and Scanner V4 services.
+[role="_abstract"]
+Use the `roxctl scanner` command to manage StackRox Scanner and Scanner V4 services, including generating deployment configurations, downloading vulnerability databases, and uploading database files.
 
-.Usage
-[source,terminal]
-----
-$ roxctl scanner [command] [flags]
-----
+//roxctl scanner overview
+include::modules/roxctl-scanner-overview.adoc[leveloffset=+1]
 
-.Available commands
-[cols="2,2",options="header"]
-|===
-|Command |Description
+include::modules/roxctl-scanner-usage.adoc[leveloffset=+2]
 
-|`download-db`
-| Download the offline vulnerability database for StackRox Scanner and Scanner V4.
-
-|`generate`
-|Generate the required YAML configuration files to deploy the StackRox Scanner and Scanner V4.
-
-|`upload-db`
-|Upload a vulnerability database for the StackRox Scanner and Scanner V4.
-|===
+include::modules/roxctl-scanner-available-commands.adoc[leveloffset=+2]
 
 //Options inherited from the parent command
 :commandname: roxctl scanner
@@ -37,7 +24,20 @@ include::modules/options-inherited-from-the-parent-command.adoc[leveloffset=+1]
 //roxctl scanner generate
 include::modules/roxctl-scanner-generate.adoc[leveloffset=+1]
 
+include::modules/roxctl-scanner-generate-usage.adoc[leveloffset=+2]
+
+include::modules/roxctl-scanner-generate-options.adoc[leveloffset=+2]
+
 //roxctl scanner upload-db
 include::modules/roxctl-scanner-upload-db.adoc[leveloffset=+1]
 
-include::modules/roxctl-scanner-download-db.adoc[leveloffset=+1]
+include::modules/roxctl-scanner-upload-db-usage.adoc[leveloffset=+2]
+
+include::modules/roxctl-scanner-upload-db-options.adoc[leveloffset=+2]
+
+//roxctl scanner download-db
+include::modules/roxctl-scanner-download-db.adoc[leveloffset=+1]
+
+include::modules/roxctl-scanner-download-db-usage.adoc[leveloffset=+2]
+
+include::modules/roxctl-scanner-download-db-options.adoc[leveloffset=+2]
diff --git a/modules/options-inherited-from-the-parent-command.adoc b/modules/options-inherited-from-the-parent-command.adoc
@@ -25,6 +25,7 @@ endif::[]
 [id="options-inherited-from-the-parent-command_{context}"]
 = {commandname} command options inherited from the parent command
 
+[role="_abstract"]
 The `{commandname}` command supports the following options inherited from the parent `roxctl` command:
 
 [cols="2,2",options="header"]

diff --git a/modules/roxctl-scanner-available-commands.adoc b/modules/roxctl-scanner-available-commands.adoc
@@ -0,0 +1,24 @@
+// Module included in the following assemblies:
+//
+// * cli/command-reference/roxctl-scanner.adoc
+
+:_mod-docs-content-type: REFERENCE
+[id="roxctl-scanner-available-commands_{context}"]
+= Available commands
+
+[role="_abstract"]
+Available commands for the `roxctl scanner` command.
+
+[cols="2,2",options="header"]
+|===
+|Command |Description
+
+|`download-db`
+| Download the offline vulnerability database for StackRox Scanner and Scanner V4.
+
+|`generate`
+|Generate the required YAML configuration files to deploy the StackRox Scanner and Scanner V4.
+
+|`upload-db`
+|Upload a vulnerability database for the StackRox Scanner and Scanner V4.
+|===
diff --git a/modules/roxctl-scanner-download-db-options.adoc b/modules/roxctl-scanner-download-db-options.adoc
@@ -0,0 +1,34 @@
+// Module included in the following assemblies:
+//
+// * cli/command-reference/roxctl-scanner.adoc
+
+:_mod-docs-content-type: REFERENCE
+[id="roxctl-scanner-download-db-options_{context}"]
+= Options
+
+[role="_abstract"]
+Options for the `roxctl scanner download-db` command.
+
+.Options
+[cols="2,2",options="header"]
+|===
+|Option |Description
+
+|`--force`
+| Force overwriting the output file if it already exists. The default value is `false`.
+
+|`--scanner-db-file string`
+| Output file to save the vulnerability database to. The default value is the name and path of the remote file that you download.
+
+|`--skip-central`
+| Do not contact Central when detecting the version. The default value is `false`.
+
+|`--skip-variants`
+| Do not attempt to process variants of the determined version. The default value is `false`.
+
+|`-t`, `--timeout duration`
+|Set the timeout for API requests representing the maximum duration of a request. The default value is `10m0s`.
+
+|`--version string`
+| Download a specific version or version variant of the vulnerability database. By default, the version is automatically detected.
+|===
diff --git a/modules/roxctl-scanner-download-db-usage.adoc b/modules/roxctl-scanner-download-db-usage.adoc
@@ -0,0 +1,16 @@
+// Module included in the following assemblies:
+//
+// * cli/command-reference/roxctl-scanner.adoc
+
+:_mod-docs-content-type: REFERENCE
+[id="roxctl-scanner-download-db-usage_{context}"]
+= roxctl scanner download-db usage
+
+[role="_abstract"]
+Usage syntax for the `roxctl scanner download-db` command.
+
+.Usage
+[source,terminal]
+----
+$ roxctl scanner download-db [flags]
+----
diff --git a/modules/roxctl-scanner-download-db.adoc b/modules/roxctl-scanner-download-db.adoc
@@ -1,47 +1,18 @@
 // Module included in the following assemblies:
 //
-// * command-reference/roxctl-scanner.adoc
+// * cli/command-reference/roxctl-scanner.adoc
 
-:_mod-docs-content-type: REFERENCE
+:_mod-docs-content-type: CONCEPT
 [id="roxctl-scanner-download-db_{context}"]
 = roxctl scanner download-db
 
+[role="_abstract"]
 Download the offline vulnerability database for StackRox Scanner or Scanner V4.
 
 This command downloads version-specific offline vulnerability bundles. The system contacts Central to determine the version if one is not specified. If communication fails, the download defaults to the version embedded within `roxctl`.
 
-By default, it will attempt to download the database for the determined version and less-specific variants. For example, if version `4.4.1-extra` is specified, downloads will be attempted for the following version variants:
+By default, it will attempt to download the database for the determined version and less-specific variants. For example, if you specify version `4.4.1-extra`, the command attempts downloads for the following version variants:
 
 * 4.4.1-extra
 * 4.4.1
-* 4.4
-
-.Usage
-[source,terminal]
-----
-$ roxctl scanner download-db [flags]
-----
-
-.Options
-[cols="2,2",options="header"]
-|===
-|Option |Description
-
-|`--force`
-| Force overwriting the output file if it already exists. The default value is `false`.
-
-|`--scanner-db-file string`
-| Output file to save the vulnerability database to. The default value is the name and path of the remote file that is downloaded.
-
-|`--skip-central`
-| Do not contact Central when detecting the version. The default value is `false`.
-
-|`--skip-variants`
-| Do not attempt to process variants of the determined version. The default value is `false`.
-
-|`-t`, `--timeout duration`
-|Set the timeout for API requests representing the maximum duration of a request. The default value is `10m0s`.
-
-|`--version string`
-| Download a specific version or version variant of the vulnerability database. By default, the version is automatically detected.
-|===
+* 4.4
diff --git a/modules/roxctl-scanner-generate-options.adoc b/modules/roxctl-scanner-generate-options.adoc
@@ -0,0 +1,37 @@
+// Module included in the following assemblies:
+//
+// * cli/command-reference/roxctl-scanner.adoc
+
+:_mod-docs-content-type: REFERENCE
+[id="roxctl-scanner-generate-options_{context}"]
+= Options
+
+[role="_abstract"]
+Options for the `roxctl scanner generate` command.
+
+.Options
+[cols="2,2",options="header"]
+|===
+|Option |Description
+
+|`--cluster-type cluster type`
+|Specify the type of cluster on which you want to run Scanner. Cluster types include `k8s` and `openshift`. The default value is `k8s`.
+
+|`--enable-pod-security-policies`
+|Create `PodSecurityPolicy` resources. The default value is `true`.
+
+|`--istio-support string`
+|Generate deployment files that support the specified Istio version. Valid versions include `1.0`, `1.1`, `1.2`, `1.3`, `1.4`, `1.5`, `1.6`, and `1.7`.
+
+|`--output-dir string`
+|Specify the output directory for the Scanner bundle. Leave blank to use the default value.
+
+|`--retry-timeout duration`
+|Set the timeout after which the system retries API requests. A value of zero means that the system waits for the entire request duration without retrying. The default value is `20s`.
+
+|`--scanner-image string`
+|Specify the Scanner image that you want to use. Leave blank to use the server default.
+
+|`-t`, `--timeout duration`
+|Set the timeout for API requests representing the maximum duration of a request. The default value is `1m0s`.
+|===
diff --git a/modules/roxctl-scanner-generate-usage.adoc b/modules/roxctl-scanner-generate-usage.adoc
@@ -0,0 +1,16 @@
+// Module included in the following assemblies:
+//
+// * cli/command-reference/roxctl-scanner.adoc
+
+:_mod-docs-content-type: REFERENCE
+[id="roxctl-scanner-generate-usage_{context}"]
+= roxctl scanner generate usage
+
+[role="_abstract"]
+Usage syntax for the `roxctl scanner generate` command.
+
+.Usage
+[source,terminal]
+----
+$ roxctl scanner generate [flags]
+----
diff --git a/modules/roxctl-scanner-generate.adoc b/modules/roxctl-scanner-generate.adoc
@@ -1,42 +1,10 @@
 // Module included in the following assemblies:
 //
-// * command-reference/roxctl-scanner.adoc
+// * cli/command-reference/roxctl-scanner.adoc
 
-:_mod-docs-content-type: REFERENCE
+:_mod-docs-content-type: CONCEPT
 [id="roxctl-scanner-generate_{context}"]
 = roxctl scanner generate
 
-Generate the required YAML configuration files to deploy Scanner.
-
-.Usage
-[source,terminal]
-----
-$ roxctl scanner generate [flags]
-----
-
-.Options
-[cols="2,2",options="header"]
-|===
-|Option |Description
-
-|`--cluster-type cluster type`
-|Specify the type of cluster on which you want to run Scanner. Cluster types include `k8s` and `openshift`. The default value is `k8s`.
-
-|`--enable-pod-security-policies`
-|Create `PodSecurityPolicy` resources. The default value is `true`.
-
-|`--istio-support string`
-|Generate deployment files that support the specified Istio version. Valid versions include `1.0`, `1.1`, `1.2`, `1.3`, `1.4`, `1.5`, `1.6`, and `1.7`.
-
-|`--output-dir string`
-|Specify the output directory for the Scanner bundle. Leave blank to use the default value.
-
-|`--retry-timeout duration`
-|Set the timeout after which API requests are retried. A value of zero means that the entire request duration is waited for without retrying. The default value is `20s`.
-
-|`--scanner-image string`
-|Specify the Scanner image that you want to use. Leave blank to use the server default.
-
-|`-t`, `--timeout duration`
-|Set the timeout for API requests representing the maximum duration of a request. The default value is `1m0s`.
-|===
+[role="_abstract"]
+Generate the required YAML configuration files to deploy Scanner.
diff --git a/modules/roxctl-scanner-overview.adoc b/modules/roxctl-scanner-overview.adoc
@@ -0,0 +1,10 @@
+// Module included in the following assemblies:
+//
+// * cli/command-reference/roxctl-scanner.adoc
+
+:_mod-docs-content-type: CONCEPT
+[id="roxctl-scanner-overview_{context}"]
+= roxctl scanner
+
+[role="_abstract"]
+Commands related to the StackRox Scanner and Scanner V4 services.
diff --git a/modules/roxctl-scanner-upload-db-options.adoc b/modules/roxctl-scanner-upload-db-options.adoc
@@ -0,0 +1,22 @@
+// Module included in the following assemblies:
+//
+// * cli/command-reference/roxctl-scanner.adoc
+
+:_mod-docs-content-type: REFERENCE
+[id="roxctl-scanner-upload-db-options_{context}"]
+= Options
+
+[role="_abstract"]
+Options for the `roxctl scanner upload-db` command.
+
+.Options
+[cols="2,2",options="header"]
+|===
+|Option |Description
+
+|`--scanner-db-file string`
+|Specify the file containing the dumped Scanner definitions DB.
+
+|`-t`, `--timeout duration`
+|Set the timeout for API requests representing the maximum duration of a request. The default value is `10m0s`.
+|===
diff --git a/modules/roxctl-scanner-upload-db-usage.adoc b/modules/roxctl-scanner-upload-db-usage.adoc
@@ -0,0 +1,16 @@
+// Module included in the following assemblies:
+//
+// * cli/command-reference/roxctl-scanner.adoc
+
+:_mod-docs-content-type: REFERENCE
+[id="roxctl-scanner-upload-db-usage_{context}"]
+= roxctl scanner upload-db usage
+
+[role="_abstract"]
+Usage syntax for the `roxctl scanner upload-db` command.
+
+.Usage
+[source,terminal]
+----
+$ roxctl scanner upload-db [flags]
+----
diff --git a/modules/roxctl-scanner-upload-db.adoc b/modules/roxctl-scanner-upload-db.adoc
@@ -1,27 +1,10 @@
 // Module included in the following assemblies:
 //
-// * command-reference/roxctl-scanner.adoc
+// * cli/command-reference/roxctl-scanner.adoc
 
-:_mod-docs-content-type: REFERENCE
+:_mod-docs-content-type: CONCEPT
 [id="roxctl-scanner-upload-db_{context}"]
 = roxctl scanner upload-db
 
-Upload a vulnerability database for Scanner.
-
-.Usage
-[source,terminal]
-----
-$ roxctl scanner upload-db [flags]
-----
-
-.Options
-[cols="2,2",options="header"]
-|===
-|Option |Description
-
-|`--scanner-db-file string`
-|Specify the file containing the dumped Scanner definitions DB.
-
-|`-t`, `--timeout duration` 
-|Set the timeout for API requests representing the maximum duration of a request. The default value is `10m0s`.
-|===
+[role="_abstract"]
+Upload a vulnerability database for Scanner.