Alerts for Prisma Cloud compute scans going from good to bad

EGould-Marian — Tue, 02 Jul 2024 18:56:35 GMT

Right now, my team has scans for our images set up as part of our CI/CD pipelines, and the scans are compared against our prefered policies. What we're looking for now though is the ability to know when an image, which previously passed the scan, contains a newly discovered vulnerability. In other words:

1) We deploy an image via our CI/CD pipelines. The scan finds no vulnerabilities that violate our policy.

2) After that date, a new vulnerability is found, which didn't show up in the CI/CD scan since it wasn't known at the time.

3) We get notified that a previously deployed image, which had passed the scan before, is now failing our vulnerability policy.

Is there any way to do this without just re-scanning previously deployed images? We looked at the registry alerts, but that seems like it would produce alerts every day that a particular image is failing the scan (we don't want repeat alerts for the same image/vulnerability).

Re: Alerts for Prisma Cloud compute scans going from good to bad

jmcgrath — Tue, 16 Jul 2024 16:08:18 GMT

Good Day EGould-Marian,

If you are using registry scanning or deployed image scanning both will trigger alert based on scanning timeline. You can disabled the alerts and use a script to pull data from API that you can use to determine which images you would like to alert on or take action.

Thank You,

James McGrath

topic Re: Alerts for Prisma Cloud compute scans going from good to bad in Prisma Cloud Discussions

Alerts for Prisma Cloud compute scans going from good to bad

Re: Alerts for Prisma Cloud compute scans going from good to bad