Focus

Prisma AIRS

Viewing Scan Results

Table of Contents

Organize Security Scans with Custom Labels

Understanding Model Security Scan Results

Viewing Scan Results

Retrieve and analyze model scan results through the CLI, Strata Cloud Manager, or Strata Logging Service.

Where Can I Use This?	What Do I Need?
Prisma AIRS (AI Model Security)	Prisma AIRS AI Model Security License

The scan command displays results directly, showing the overall verdict and key findings. For deeper analysis, you can retrieve detailed results using the scan ID.

After a model is scanned, it will either pass or fail the scan based on the security checks performed by AI Model Security. If the model passes the scan, it will be downloaded as usual. If the model fails the scan, it will fail to download and return a 403 error as well as a Universally Unique Identifier (UUID) that can be used to view the scan results.

Scan results are also automatically recorded in Strata Logging Service when it is enabled on your tenant, providing a centralized audit trail for all model security activity without requiring per-scan configuration.

Using CLI

Scan provide immediate results with options to retrieve detailed findings later using scan ID, view scan history, and access enhanced analysis through the CLI.

Retrieving a Specific Scan (CLI/SDK)

After a scan completes, note the scan ID from the output. Retrieve the full results at any time.

Retrieve Scan Results using CLI

model-security get-scan --uuid "87654321-4321-4321-4321-210987654321"

Retrieve Scan Results using Python SDK


scan_result = client.get_scan(uuid="87654321-4321-4321-4321-210987654321")

print(f"Scan Status: {scan_result.eval_outcome}")
print(f"Model URI: {scan_result.model_uri}")
print(f"Created: {scan_result.created_at}")

View Scan Summary (CLI/SDK)

View a summary of recent scans to track your security assessments.

View Scan Summary using CLI

model-security list-scans \
    --security-group-uuid "12345678-1234-1234-1234-123456789012" \
    --source-types "HUGGING_FACE" \
    --source-types "S3" \
    --eval-outcomes "ALLOWED" \
    --eval-outcomes "BLOCKED" \
    --start-time "2025-01-01 T00:00:00" \
    --end-time "2025-12-31 T23:59:59" \
    --labels-query "env:production AND team:ml-platform" \
    --search-query "sentiment" \
    --sort-order "asc" \
    --limit 50

View Scan Summary using Python SDK


from datetime import datetime, timezone

scans = client.list_scans(
    security_group_uuid="12345678-1234-1234-1234-123456789012",
    source_types=["HUGGING_FACE", "S3"],
    eval_outcomes=["ALLOWED", "BLOCKED"],
    start_time=datetime(2025, 1, 1, tzinfo=timezone.utc),
    end_time=datetime(2025, 12, 31, 23, 59, 59, tzinfo=timezone.utc),
    labels_query="env:production AND team:ml-platform",
    search_query="sentiment",
    sort_order="asc",
    limit=50
)

You can also filter scans by source type, evaluation outcome, or time range.

Filter Scans by source type, evaluation outcome, or time range using CLI


model-security list-scans \ 
    --source-types "HUGGING_FACE" \
    --source-types "S3" \
    --eval-outcomes "ALLOWED" \
    --eval-outcomes "BLOCKED" \
    --start-time "2025-01-01T00:00:00" \
    --end-time "2025-12-31T23:59:59" \
    --limit 50

Filter Scans by source type, evaluation outcome, or time range using Python SDK


from datetime import datetime, timezone

scans = client.list_scans(
    source_types=["HUGGING_FACE", "S3"],
    eval_outcomes=["ALLOWED", "BLOCKED"],
    start_time=datetime(2025, 1, 1, tzinfo=timezone.utc),
    end_time=datetime(2025, 12, 31, 23, 59, 59, tzinfo=timezone.utc),
    limit=50
  )

Strata Cloud Manager

Scan provide immediate results with options to retrieve detailed findings later using scan ID, view scan history, and access enhanced analysis through the Strata Cloud Manager.

Although the CLI delivers complete results, the AI Model Security web interface provides additional tools for analyzing scan findings.

Log in to Strata Cloud Manager.
Navigate to the AI SecurityAI Model SecurityScans.
Locate your scan by ID or filter the scan list. Review detailed findings for each rule evaluation. Export results or share them with your team.
Following is an example scan result that is Allowed. After locating the specific scan, select Overview to review the evaluation details.

Following is an example scan result that is Blocked. After locating the specific scan, select Overview to review the evaluation details.

Select Files to review the complete file structure of the model that was scanned, including file-level violation detail.

Select JSON of the specific Scan, to review the details of the scan, its violations (if any), and rule evaluations and get instructions for retrieving that JSON locally.

The Strata Cloud Manager displays rule violations visually, identifies the specific files or model components that caused findings, and offers remediation guidance.

Strata Logging Service

Each model scan automatically generates a log entry in Strata Logging Service, capturing the scan outcome, model details, and any security violations found.

Each time AI Model Security scans a model, the result is recorded as a log entry in your tenant's Strata™ Logging Service, capturing the verdict, model details, and any security violations found.

No configuration is required within Model Security. Entries appear automatically once Strata Logging Service is active on your tenant.

To get started, enable Strata Logging Service on your tenant. Once active, model security scan entries appear in the Log Viewer alongside your other security logs, where you can search, filter, and export scan activity for monitoring, investigation, and compliance.

Scan Log Fields

scan_uuid is the only required field; all others are optional. Enum fields include both a numeric ID and a text label. Use the text label when filtering or displaying results.

The following fields are logged for each model scan.

Field	Datatype	Description	Example
scan_uuid	String	Unique ID of the scan; use it to correlate with the scan's API record.	57d86937-1ba6-4637-b303-87798f555d09
time_started	String	Timestamp of when the scan started, in UTC using ISO-8601 format.	2026-05-07T14:29:58.000Z
created_by	String	ID of the user or service account that initiated the scan.	9b2e1f44-3c7a-4d61-8a0e-2f5c1d9e7b10
scan_origin	Enum	Channel used to trigger the scan: SDK (MODEL_SECURITY_SDK), REST API (MODEL_SECURITY_API), or web interface (MODEL_SECURITY_FRONTEND).	MODEL_SECURITY_SDK
source_type	Enum	Storage backend the model was pulled from: HUGGING_FACE, S3, GCS, AZURE, LOCAL, ARTIFACTORY, GITLAB.	HUGGING_FACE
eval_outcome	Enum	Security policy outcome for the scan: ALLOWED — the model passed all rules and is permitted for use. BLOCKED — the model violated one or more rules and is not permitted. ERROR — the scan did not complete successfully and no verdict was reached.	BLOCKED
error_code	Enum	Set only when a scan does not complete successfully: RESOURCE_NOT_FOUND, INTERNAL_ERROR, SCAN_DATA_PENDING. Not set when the scan completes successfully.	INTERNAL_ERROR
error_message	String	Plain-language error detail returned when a scan does not complete successfully.	Model file not found at source
total_files_scanned	Integer	Total number of model files evaluated during the scan.	12
total_files_skipped	Integer	Total number of model files skipped during the scan.	1
enabled_rule_count	Integer	Number of security rules active and applied during this scan.	8
rule_passed_count	Integer	Number of security rules the model complied with during the scan.	7
rule_failed_count	Integer	Number of security rules the model did not comply with during the scan.	1
violation_count	Integer	Total number of security violations detected during the scan.	2
security_group_name	String	Name of the security group applied to this scan.	production-models-sg
security_group_uuid	String	Unique ID of the security group applied to this scan.	a1b2c3d4-5678-90ab-cdef-1234567890ab
labels	String	User-defined labels on the scan, as a JSON string.	{"team":"ml-platform","env":"prod"}
scanner_version	String	Version of the model scanning engine.	1.0.0
sdk_version	String	Version of the client SDK that started the scan.	0.9.2
model_uri	String	Full URI of the scanned model, including the storage backend prefix.	hf://meta-llama/Llama-2-7b
model_name	String	Name of the scanned model.	meta-llama or Llama-2-7b
model_version	String	Revision or version identifier of the scanned model.	main
model_author	String	Author or organization that published the model.	meta-llama
model_formats	List<String>	File formats identified in the scanned model.	["pickle","safetensors"]
violations	List<ViolationItem>	One entry for each security violation found during the scan. Not present when the scan passes without violations.Each object uses the Violation Log Fields schema.	Violation Log Fields

Violation Log Fields

The violations field in the scan log contains an array of violation objects. The following fields describe each violation.

Field	Datatype	Description	Example
rule_name	String	Name of the rule that was violated.	No unsafe pickle operators
threat	Enum	Threat category code, PAIT taxonomy.	PAIT-PKL-100
threat_description	String	Plain-language description of the threat category.	Pickle model arbitrary code execution at load time
rule_instance_state	Enum	Whether the rule blocks or only warns: DISABLED, ALLOWING, BLOCKING.	BLOCKING
description	String	Plain-language details of the specific violation instance.	model.pkl uses operator 'exec' which is unsafe.
file_path	String	Path to the file containing the violation. Not set for violations that apply to the model as a whole.	model.pkl
operator	String	The unsafe operator or callable detected.	exec
module	String	Module or framework associated with the violation.	pickle
violation_uuid	String	Unique ID of the violation.	b1d4e2a0-1111-4c22-9a33-aaaa11112222

Organize Security Scans with Custom Labels

Understanding Model Security Scan Results

Prisma AIRS Docs

Viewing Scan Results

Prisma AIRS Docs

Viewing Scan Results

Using CLI

Retrieving a Specific Scan (CLI/SDK)

View Scan Summary (CLI/SDK)

Strata Cloud Manager

Strata Logging Service

Scan Log Fields

Violation Log Fields

Activation & Onboarding

Next-Generation Firewalls

Cloud-Delivered Security Services

Network Security

Visibility & Monitoring