Configure code repository scanning
Table of Contents
Expand all | Collapse all
-
- Getting started
- System Requirements
- Cluster Context
-
- Prisma Cloud Container Images
- Kubernetes
- Deploy the Prisma Cloud Console on Amazon ECS
- Console on Fargate
- Onebox
- Alibaba Cloud Container Service for Kubernetes (ACK)
- Azure Container Service (ACS) with Kubernetes
- Azure Kubernetes Service (AKS)
- Amazon Elastic Kubernetes Service (EKS)
- IBM Kubernetes Service (IKS)
- OpenShift v4
-
- Defender Types
- Manage your Defenders
- Redeploy Defenders
- Uninstall Defenders
-
- Deploy Orchestrator Defenders on Amazon ECS
- Automatically Install Container Defender in a Cluster
- Deploy Prisma Cloud Defender from the GCP Marketplace
- Deploy Defenders as DaemonSets
- VMware Tanzu Application Service (TAS) Defender
- Deploy Defender on Google Kubernetes Engine (GKE)
- Google Kubernetes Engine (GKE) Autopilot
- Deploy Defender on OpenShift v4
-
- Agentless Scanning Modes
-
- Onboard AWS Accounts for Agentless Scanning
- Onboard Azure Accounts for Agentless Scanning
- Configure Agentless Scanning for Azure
- Onboard GCP Accounts for Agentless Scanning
- Configure Agentless Scanning for GCP
- Onboard Oracle Cloud Infrastructure (OCI) Accounts for Agentless Scanning
- Configure Agentless Scanning for Oracle Cloud Infrastructure (OCI)
- Agentless Scanning Results
-
- Rule ordering and pattern matching
- Backup and Restore
- Custom feeds
- Configuring Prisma Cloud proxy settings
- Prisma Cloud Compute certificates
- Configure scanning
- User certificate validity period
- Enable HTTP access to Console
- Set different paths for Defender and Console (with DaemonSets)
- Authenticate to Console with Certificates
- Configure custom certs from a predefined directory
- Customize terminal output
- Collections
- Tags
- Logon settings
- Reconfigure Prisma Cloud
- Subject Alternative Names
- WildFire Settings
- Log Scrubbing
- Clustered-DB
- Permissions by feature
-
- Logging into Prisma Cloud
- Integrating with an IdP
- Integrate with Active Directory
- Integrate with OpenLDAP
- Integrate Prisma Cloud with Open ID Connect
- Integrate with Okta via SAML 2.0 federation
- Integrate Google G Suite via SAML 2.0 federation
- Integrate with Azure Active Directory via SAML 2.0 federation
- Integrate with PingFederate via SAML 2.0 federation
- Integrate with Windows Server 2016 & 2012r2 Active Directory Federation Services (ADFS) via SAML 2.0 federation
- Integrate Prisma Cloud with GitHub
- Integrate Prisma Cloud with OpenShift
- Non-default UPN suffixes
- Compute user roles
- Assign roles
-
- Prisma Cloud Vulnerability Feed
- Scanning Procedure
- Vulnerability Management Policies
- Vulnerability Scan Reports
- Scan Images for Custom Vulnerabilities
- Base images
- Vulnerability Explorer
- CVSS scoring
- CVE Viewer
-
- Configure Registry Scans
- Scan Images in Alibaba Cloud Container Registry
- Scan Images in Amazon Elastic Container Registry (ECR)
- Scan images in Azure Container Registry (ACR)
- Scan Images in Docker Registry v2 (including Docker Hub)
- Scan Images in GitLab Container Registry
- Scan images in Google Artifact Registry
- Scan Images in Google Container Registry (GCR)
- Scan Images in Harbor Registry
- Scan Images in IBM Cloud Container Registry
- Scan Images in JFrog Artifactory Docker Registry
- Scan Images in Sonatype Nexus Registry
- Scan images in OpenShift integrated Docker registry
- Scan Images in CoreOS Quay Registry
- Trigger Registry Scans with Webhooks
- Configure VM image scanning
- Configure code repository scanning
- Malware scanning
- Windows container image scanning
- Serverless Functions Scanning
- VMware Tanzu Blobstore Scanning
- Scan App-Embedded workloads
- Troubleshoot Vulnerability Detection
-
- Compliance Explorer
- Enforce compliance checks
- CIS Benchmarks
- Prisma Cloud Labs compliance checks
- Serverless functions compliance checks
- Windows compliance checks
- DISA STIG compliance checks
- Custom compliance checks
- Trusted images
- Host scanning
- VM image scanning
- App-Embedded scanning
- Detect secrets
- OSS license management
-
- Alert Mechanism
- AWS Security Hub
- Cortex XDR alerts
- Cortex XSOAR alerts
- Email alerts
- Google Cloud Pub/Sub
- Google Cloud Security Command Center
- IBM Cloud Security Advisor
- JIRA Alerts
- PagerDuty alerts
- ServiceNow alerts for Security Incident Response
- ServiceNow alerts for Vulnerability Response
- Slack Alerts
- Splunk Alerts
- Webhook alerts
- API
Configure code repository scanning
Prisma Cloud can scan GitHub repositories and identify vulnerabilities in your software’s dependencies.
Modern apps are increasingly composed of external, open-source dependencies, so it’s important to give developers tools to assess those components early in the development lifecycle.
Repository scanning gives you early insight into the software as it’s being developed, and long before apps are packaged (e.g. as a container) and deployed by CI/CD pipelines.
Currently, Prisma Cloud supports Python, Java, and JavaScript (Node.js).
Prerequisites
Prisma Cloud authenticates with the GitHub API using user-generated API tokens.
The following scopes are required for scanning private repos.
Prisma Cloud doesn’t modify or write to your repos.
- repo — Full control of private repositories
- repo:status — Access commit status
- repo_deployment — Access deployment status
- public_repo — Access public repositories
- repo:invite — Access repository invitations
- security_events — Read and write security events
If you’re scanning public repos only, select just the public_repo scope.
The benefit of creating an access token for scanning public repos is that GitHub grants you a higher rate limit to their API, which Prisma Cloud utilizes for scanning.
Deployment
Prisma Cloud selects the repositories to scan according to a user-defined scope.
For example, you might want to scan all repositories in your organization or just a subset of them.
For each repo in scope, Prisma Cloud searches for well-known package manifest files, and enumerates the dependencies listed in them.
Those dependencies are assessed against the latest threat data in the Intelligence Stream.
Code repository scans are handled by Console.
The following table lists the manifest files known to the scanner.
Package manager | File name |
---|---|
Go | go.sum |
Java (Gradle) | build.gradle, build.gradle.kts, gradle.properties |
Java (Maven) | pom.xml |
JavaScript (NPM) | package.json, package-lock.json, npm-shrinkwrap.json, bower.json |
Python (pip) | req*.txt |
Finally, Prisma Cloud can continuously monitor your code repositories for vulnerabilities by rescanning on every push event.
Prisma Cloud integrates with GitHub using webhooks, which notify the scanner when there are changes in the repository.
Prisma Cloud uses the GitHub API.
The GitHub API is rate-limited.
For unauthenticated requests, which can be used to scan public repositories, the cap is very low (60 requests/hour).
Here the rate limit is gauged by IP address.
For authenticated requests, which can scan either public or private repositories, the cap is 5000 requests/hour.
Here the rate limit is gauged per account.
Set up your credentials
Generate a personal access token in GitHub, and then save it in the Prisma Cloud Credentials Store so that the scanner can access your repositories for scanning.
- Generate a GitHub access token.
- Log into your GitHub account.
- Go toSettings > Developer Settings > Personal access tokens.
- ClickGenerate new token.
- Set the scope torepo.If you’re scanning public repos only, select just thepublic_reposcope.
- ClickGenerate token. If your account requires SSO, enable it.
- Copy the generated token.
- Save the token in Prisma Cloud’s credentials store.
- Log into Prisma Cloud Console.
- Go toManage > Authentication > Credentials Store.
- ClickAdd Credential.
- Enter aNamefor the credential.
- InType, select 'GitHub Cloud' or 'GitHub Enterprise Server' access token.For GitHub Enterprise Server, specify the Server URL. If you use a self-signed certificate, specify it, or choose 'Skip Verify' to skip certificate validation.
- InAccess Token, paste the access token you generated in GitHub.
- ClickSave.
Configure the repos to scan
Specify the repositories to scan.
If your repository specifies dependencies in non-standard package manifest files, specify them here so the scanner can parse them.
If there are manifests the scanner should ignore, specify them here as well.
- Open Console.
- Go toDefend > Vulnerabilities > Code Repositories.
- ClickAdd Scope. If this is your first repository, clickAdd the first item.Each scope spec has the following parameters:FieldDescriptionProviderSelect the appropriate GitHub deployment. GitHub Cloud and GitHub Enterprise are currently the only supported providers.For other Git repositories, use twistcli’s coderepo scan optionTypeTo scan all repos in an organization, including both public and private repos, set the type toPrivate. You’ll need to set up an access token so that Prisma Cloud can access your repos.To scan public repositories not related to your account or organization, set the type toPublic. When type isPublic, credentials are not required, although API access to GitHub is capped to a very low value. Even if you’re only scanning public repos, we recommend that you set up an access token for authenticated access.CredentialSpecify credentials for the repository owner. If the credentials have already been created in the Prisma Cloud credentials store, select it. If not, clickAdd New.RepositoriesSpecify the repositories to scan in the format: owner/name When you’ve selected a credential, the drop-down lists all repositories in the owner’s account.Wildcards are supported when the repo type isPrivate. They aren’t supported when the type isPublic.Excluded manifest pathsSpecify paths to be excluded for analysis. Wildcards are supported. For example, to exclude all files under data/data/ sub-directory use data/data/*, or to exclude a specific file use data/data/<filename.extension>.Advanced settings > Explicit manifest namesSupported for Python only. Specify any additional file names that should be included for analysis. If you have a custom naming scheme for your manifest files, specify them here so that the scanner can find and parse them.Advanced settings > Python versionFor a more accurate analysis of your app’s dependencies, specify the version of Python you deploy in production. Otherwise, the scanner assumes the latest available version of Python.
- ClickAdd.
- ClickSave.
Scan repos on push events
Configure GitHub webhooks to rescan your repositories on push events.
- Open Console.
- Go toDefend > Vulnerabilities > Code Repositories.
- InWebhook settings, select the publicly accessible name or IP address GitHub will use to notify Prisma Cloud that a push event occurred.
- Copy the URL.
- Configure GitHub.
- Log into GitHub, select a repo, and go toSettings > Webhooks.
- ClickAdd webhook.
- InPayload URL, paste the URL you copied from Prisma Cloud Console.
- InContent type, selectapplication/json.
- SelectDisable SSL verification.For Compute Edition, you can enable SSL verification if your Console runs under a domain with a valid certificate signed by a known authority.For Prisma Cloud Enterprise Edition, selectEnable SSL verification.
- Leave all other settings in their default state.
- ClickAdd webhook.
- Verify that the ping webhook was delivered successfully.
Policy
Prisma Cloud ships with a default rule that alerts on vulnerabilities.
In
Defend > Vulnerabilities > Code Repositories
, create vulnerability rules to tailor what’s reported.Additional scan settings can be found under
Manage > System > Scan
, where you can set the scan interval.
By default, it’s 24 hours.