Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Code Repo Scanning deprecated in O'Neal #588

Open
wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Code Repo Scanning deprecated in O'Neal #588

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
232 changes: 9 additions & 223 deletions ...compute-edition/32/admin-guide/vulnerability-management/code-repo-scanning.adoc
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,231 +1,17 @@
== Configure code repository scanning
This feature has been deprecated in version 32.02 (O’Neal Update 2). This feature has been moved to the Application Security module. To continue using this feature, it is required to replace twistcli with the Checkov utility for IaC scanning

Prisma Cloud can scan GitHub repositories and identify vulnerabilities in your software's dependencies.
Modern apps are increasingly composed of external, open-source dependencies, so it's important to give developers tools to assess those components early in the development lifecycle.
Repository scanning gives you early insight into the software as it's being developed, and long before apps are packaged (e.g. as a container) and deployed by CI/CD pipelines.
Refer to the links below for the Application Security Module in Prisma Cloud Enterprise

Currently, Prisma Cloud supports Python, Java, JavaScript (Node.js), and Go.
Getting Started - https://docs.prismacloud.io/en/enterprise-edition/content-collections/application-security/get-started/get-started

Enable Application Security - https://docs.prismacloud.io/en/enterprise-edition/content-collections/application-security/get-started/enable-application-security

=== Prerequisites

Prisma Cloud authenticates with the GitHub API using user-generated API tokens.
The following scopes are required for scanning private repos.
Prisma Cloud doesn't modify or write to your repos.

* repo -- Full control of private repositories
** repo:status -- Access commit status
** repo_deployment -- Access deployment status
** public_repo -- Access public repositories
** repo:invite -- Access repository invitations
** security_events -- Read and write security events

If you’re scanning public repos only, select just the public_repo scope.
The benefit of creating an access token for scanning public repos is that GitHub grants you a higher rate limit to their API, which Prisma Cloud utilizes for scanning.


=== Deployment

Prisma Cloud selects the repositories to scan according to a user-defined _scope_.
For example, you might want to scan all repositories in your organization or just a subset of them.
For each repo in scope, Prisma Cloud searches for well-known package manifest files, and enumerates the dependencies listed in them.
Those dependencies are assessed against the latest threat data in the Intelligence Stream.

Code repository scans are handled by Console.

The following table lists the manifest files known to the scanner.

[cols="1,1a", options="header"]
|===
|Package manager
|File name

|Go
|go.sum

|Java (Gradle)
|build.gradle, build.gradle.kts, gradle.properties

|Java (Maven)
|pom.xml

|JavaScript (NPM)
|package.json, package-lock.json, npm-shrinkwrap.json, bower.json

|Python (pip)
|req{asterisk}.txt

|===

Finally, Prisma Cloud can continuously monitor your code repositories for vulnerabilities by rescanning on every push event.
Prisma Cloud integrates with GitHub using webhooks, which notify the scanner when there are changes in the repository.

NOTE: Prisma Cloud uses the GitHub API.
The GitHub API is https://developer.github.com/v3/#rate-limiting[rate-limited].
For unauthenticated requests, which can be used to scan public repositories, the cap is very low (60 requests/hour).
Here the rate limit is gauged by IP address.
For authenticated requests, which can scan either public or private repositories, the cap is 5000 requests/hour.
Here the rate limit is gauged per account.


[.task]
=== Set up your credentials

Generate a personal access token in GitHub, and then save it in the Prisma Cloud Credentials Store so that the scanner can access your repositories for scanning.

[.procedure]

. Generate a GitHub access token.

.. Log into your GitHub account.

.. Go to *Settings > Developer Settings > Personal access tokens*.

.. Click *Generate new token*.

.. Set the scope to *repo*.
+
image::code_repo_scanning_creds.png[width=700]
+
If you're scanning public repos only, select just the *public_repo* scope.

.. Click *Generate token*.
If your account requires SSO, enable it.

.. Copy the generated token.
+
image::code_repo_scanning_token.png[width=550]

. Save the token in Prisma Cloud's credentials store.

.. Log into Prisma Cloud Console.

.. Go to *Manage > Authentication > Credentials Store*.

.. Click *Add Credential*.

.. Enter a *Name* for the credential.

.. In *Type*, select 'GitHub Cloud' or 'GitHub Enterprise Server' access token.
+
NOTE: For GitHub Enterprise Server, specify the Server URL.
If you use a self-signed certificate, specify it, or choose 'Skip Verify' to skip certificate validation.

.. In *Access Token*, paste the access token you generated in GitHub.

.. Click *Save*.

Onboard Code Repositories - https://docs.prismacloud.io/en/enterprise-edition/content-collections/application-security/get-started/connect-code-and-build-providers/connect-code-and-build-providers

[.task]
=== Configure the repos to scan
Integrate IDE - https://docs.prismacloud.io/en/enterprise-edition/content-collections/application-security/get-started/connect-code-and-build-providers/ides/ides

Specify the repositories to scan.
If your repository specifies dependencies in non-standard package manifest files, specify them here so the scanner can parse them.
If there are manifests the scanner should ignore, specify them here as well.

[.procedure]
. Open Console.

. Go to *Defend > Vulnerabilities > Code Repositories*.

. Click *Add Scope*.
If this is your first repository, click *Add the first item*.
+
Each scope spec has the following parameters:
+
[cols="20%,80%a", options="header"]
|===
|Field
|Description

|Provider
|Select the appropriate GitHub deployment.
GitHub Cloud and GitHub Enterprise are currently the only supported providers.

NOTE: For other Git repositories, use twistcli's xref:../tools/twistcli-scan-code-repos.adoc[coderepo scan] option

|Type
|To scan all repos in an organization, including both public and private repos, set the type to *Private*.
You'll need to set up an access token so that Prisma Cloud can access your repos.

To scan public repositories not related to your account or organization, set the type to *Public*.
When type is *Public*, credentials are not required, although API access to GitHub is capped to a very low value.
Even if you're only scanning public repos, we recommend that you set up an access token for authenticated access.

|Credential
|Specify credentials for the repository owner.
If the credentials have already been created in the Prisma Cloud credentials store, select it.
If not, click *Add New*.

|Repositories
|Specify the repositories to scan in the format: owner/name
When you've selected a credential, the drop-down lists all repositories in the owner's account.

Wildcards are supported when the repo type is *Private*.
They aren't supported when the type is *Public*.


|Excluded manifest paths
|Specify paths to be excluded for analysis.
Wildcards are supported. For example, to exclude all files under `data/data/` sub-directory use `data/data/*`, or to exclude a specific file use `data/data/<filename.extension>`.

|Advanced settings > Explicit manifest names
|Supported for Python only.
Specify any additional file names that should be included for analysis.
If you have a custom naming scheme for your manifest files, specify them here so that the scanner can find and parse them.

|Advanced settings > Python version
|For a more accurate analysis of your app's dependencies, specify the version of Python you deploy in production.
Otherwise, the scanner assumes the latest available version of Python.

|===

. Click *Add*.

. Click *Save*.


[.task]
=== Scan repos on push events

Configure GitHub webhooks to rescan your repositories on push events.

[.procedure]
. Open Console.

. Go to *Defend > Vulnerabilities > Code Repositories*.

. In *Webhook settings*, select the publicly accessible name or IP address GitHub will use to notify Prisma Cloud that a push event occurred.

. Copy the URL.

. Configure GitHub.

.. Log into GitHub, select a repo, and go to *Settings > Webhooks*.

.. Click *Add webhook*.

.. In *Payload URL*, paste the URL you copied from Prisma Cloud Console.

.. In *Content type*, select *application/json*.

.. Select *Disable SSL verification*.
+
For Compute Edition, you can enable SSL verification if your Console runs under a domain with a valid certificate signed by a known authority.
+
For Prisma Cloud Enterprise Edition, select *Enable SSL verification*.

.. Leave all other settings in their default state.

.. Click *Add webhook*.

.. Verify that the ping webhook was delivered successfully.


=== Policy

Prisma Cloud ships with a default rule that alerts on vulnerabilities.
In *Defend > Vulnerabilities > Code Repositories*, create vulnerability rules to tailor what's reported.
=== Prerequisites

Additional scan settings can be found under *Manage > System > Scan*, where you can set the xref:../configure/configure-scan-intervals.adoc#[scan interval].
By default, it's 24 hours.
* Application Security Module
* Checkov utility