1. Home
    2. Prisma
    3. Prisma Cloud
    4. Prisma Cloud Compute Edition Administrator’s Guide
    5. Vulnerability management
    6. VMware Tanzu blobstore scanning
    End-of-Life (EoL)

    VMware Tanzu blobstore scanning

    Prisma Cloud for TAS can scan the droplets in your blobstores for vulnerabilities. Prisma Cloud can be configured to scan your blobstores periodically. Defenders are the entities that perform the scanning.
    When you install Tanzu Application Service (TAS) Defender in your environment, it automatically scans the running apps and hosts in your environment without any special configuration required.
    Tanzu stores large binary files in blobstores. Blobstores are roughly equivalent to registries. One type of file stored in the blobstore is the droplet.
    Droplets are archives that contain ready to run applications. They are roughly equivalent to container images. Droplets contain the OS stack, a buildpack (which contains the languages, libraries, and services used by the app), and custom app code. Before running an app on your infrastructure, the Cloud Controller stages it for delivery by combining the OS stack, buildpack, and source code into a droplet, then storing the droplet in a blobstore.
    The twistcli command line tool also lets you scan droplet files directly. You can integrate twistcli into your CLI to pass or fail builds based on vulnerability thresholds.

    Configure Prisma Cloud to scan a blobstore

    Prisma Cloud can scan internal and external blobstores, and blobstores configured to use the Fog Ruby gem or WebDAV protocol.
    External blobstores that require a custom authentication flow, such as those offered by cloud providers, are not supported.
    Prequisite:
     You’ve already installed TAS Defender in your environment.
    1. Log into Prisma Cloud Console.
    2. Go to
      Defend > Vulnerabilities > VMware Tanzu blobstore
      .
    3. Click
      Add blobstore
      .
    4. Specify the cloud controller.
    5. Specify a Defender to execute the scanning.
      Prisma Cloud lists all the agentIDs where Defender is installed. To correlate the agentID to the Diego cell’s IP address, and determine which host runs a Defender, log into any Diego cell, and inspect /var/vcap/instance/dns/records.json. This file shows the correlation between agentID and host IP address.
    6. Specify the droplets to scan. To scan all droplets, enter a wildcard (*).
    7. Specify the maximum number of droplets to scan. To scan all droplets, enter 0.
    8. Click
      Add
      .
    9. Click
      Save
      .

    Review scan reports

    Scan reports show all vulnerabilities found in the droplets in your blobstores. By default, droplets are rescanned every 24 hours.
    A droplet, which is an artifact of the app staging process, contains the minimum required data to specify an app (binaries/libraries). Droplets are stored in blobstores. Review scan reports for droplets in
    Monitor > Vulnerabilities > VMware Tanzu blobstore
    .
    When an application is run in a Diego cell, it’s run on top of a stack, currently cflinuxfs3, which is derived from Ubuntu Bionic 18.04. Defender automatically scans all running applications (buildpack and docker). Review the scan reports for running apps in
    Monitor > Vulnerabilities > Images
    .
    If you compare the findings for a buildpack app in
    Monitor > Vulnerabilities > VMware Tanzu blobstore
     and
    Monitor > Vulnerabilities > Images
    , you’ll notice a difference in the number of findings. Remember that
    Monitor > Vulnerabilities > Images
     reports any additional findings in the app’s underlying stack that would not be found in the droplet alone.
    When TAS stages Docker-based apps, it doesn’t stage an associated droplet in the blobstore. Therefore, blobstore scanning alone won’t cover Docker-based apps. If you’re running Docker containers in TAS, and you want to scan the images before they run, then configure Prisma Cloud to scan the container registry.
    1. Log into Prisma Cloud Console.
    2. Go to
      Monitor > Vulnerabilities > VMware Tanzu blobstore
       to see a list of summary reports for each droplet.
    3. To drill into a specific scan report, click on a row in the table.