1. Home
    2. Prisma
    3. Prisma Cloud
    4. Prisma Cloud Compute Edition Administrator’s Guide
    5. Vulnerability management
    6. VMware Tanzu blobstore scanning

    VMware Tanzu blobstore scanning

    Prisma Cloud for TAS can scan the droplets in your blobstores for vulnerabilities. Prisma Cloud can be configured to scan your blobstores periodically. Defenders are the entities that perform the scanning.
    When you install Tanzu Application Service (TAS) Defender in your environment, it automatically scans the running apps and hosts in your environment without any special configuration required.
    Tanzu stores large binary files in blobstores. Blobstores are roughly equivalent to registries. One type of file stored in the blobstore is the droplet.
    Droplets are archives that contain ready to run applications. They are roughly equivalent to container images. Droplets contain the OS stack, a buildpack (which contains the languages, libraries, and services used by the app), and custom app code. Before running an app on your infrastructure, the Cloud Controller stages it for delivery by combining the OS stack, buildpack, and source code into a droplet, then storing the droplet in a blobstore.
    The twistcli command line tool also lets you scan droplet files directly. You can integrate twistcli into your CLI to pass or fail builds based on vulnerability thresholds.

    Configure Prisma Cloud to scan a blobstore

    Prisma Cloud can scan both internal and external blobstores, and blobstores configured to use the Fog Ruby gem or WebDAV protocol.
    Prequisite:
     You’ve already installed TAS Defender in your environment.
    1. Log into Prisma Cloud Console.
    2. Go to
      Defend > Vulnerabilities > VMware Tanzu blobstore
      .
    3. Click
      Add blobstore
      .
    4. In
      Blobstore location
      , select if scanning is Local or Remote.
      Prisma Cloud allows you to scan a blobstore by a Defender within the same TAS environment, or to scan it by a Defender in a remote TAS environment. If the Defender (the Scanner) runs in the same TAS environment as the blobstore, select
      Local
      . If you want a Defender to scan a blobstore in a differnet TAS environment, select
      Remote
      .
    5. In
      Blobstore’s cloud controller
      , specify the cloud controller address of the blobstore you want to scan.
    6. For
      Remote
       scanning:
      1. (Optional) In
        Foundation
        , specify the foundation of the blobstore to scan. The foundation name will then be added as a label to the droplets scanned on this blobstore, which allows you to use it as a criteria for Collections.
      2. In
        Credentials
        , enter the credentials required to access the remote blobstore. If the credentials have already been created in the Prisma Cloud credential store, select it. If not, click
        Add
         to create new credentials.
        The user role of the credentials you use should be one of the following: Admin, Admin Read-Only, Global Auditor, Org Manager, Space Auditor, Space Developer, or Space Manager. For non-admin users, the cloud_controller.read scope is also required.
      3. (Optional) In
        CA certificate
        , enter a CA certificate in PEM format.
      4. In
        Scanner’s cloud controlles
        , specify the cloud controller address of the TAS environment where the scanning Defender is located.
    7. In
      Scanner
      , specify a Defender to execute the scanning.
      Prisma Cloud lists all the agentIDs where Defender is installed. To correlate the agentID to the Diego cell’s IP address, and determine which host runs a Defender, log into any Diego cell, and inspect