Malware scanning

Besides detecting software vulnerabilities (CVEs) and compliance issues (such as images configured to run as root), Prisma Cloud also detects malware in your container images. No special configuration is required to enable this feature.

Malware data is sourced from commercial providers, Prisma Cloud Labs, and open source lists. The image scanner looks for malware in binaries in the image layers, including the base layer.

Malware scanning and detection is supported for Linux container images only. Windows containers are not supported.

Detecting malware

When Prisma Cloud detects malware in an image, it logs the vulnerability in the image scan report.

To review the results of an image scan:

Open Console, then go to Monitor > Vulnerabilities > Images
.

Click on an image to get a detailed report from the last image scan.

In the detailed report, click on the Compliance
tab.

Issues with vulnerability ID 422 means that your image contains a file with an md5 signature of known malware.

What’s next?

Custom malware data can be uploaded to Prisma Cloud. After uploading your data, it is used in all subsequent images scans.

For more information about uploading custom malware data to Console, see Import custom malware data.

Document:Prisma Cloud Administrator’s Guide (Compute)

Malware scanning

Malware scanning

Detecting malware

What’s next?

Recommended For You

Document:Prisma Cloud Administrator’s Guide (Compute)

Malware scanning

Malware scanning

Detecting malware

What’s next?

Recommended For You

Recommended Videos