topic Re: Add labels to twistcli scan results in Prisma Cloud Discussions

Add labels to twistcli scan results

EGould-Marian — Tue, 19 Nov 2024 16:48:04 GMT

We're currently running scans on our containers in our Jenkins CI/CD pipelines, running twistcli on the command line. When we view the scan results for these images on the Prisma Cloud site (Monitor > Vulnerabilities > Images > CI or Monitor > Compliance > Images > CI.), the "Labels" tab of the scan result shows things like JOB_NAME and NODE_NAME, which it appears to be getting from the Jenkins pipeline that ran twistcli.

Is there any way to add additional labels? For example, we'd like to be able to add some metadata like the git commit hash or the Jenkins job number as well.

I did see there was a "--custom-labels" option for twistcli, but can't see any examples or explanation that would indicate if this is what I'm looking for. Thanks.

Re: Add labels to twistcli scan results

CGWeatherall — Fri, 21 Feb 2025 19:22:32 GMT

@EGould-Marian did you ever get any traction on this? I am looking into the same thing right now.

Re: Add labels to twistcli scan results

pjha1 — Mon, 24 Feb 2025 20:41:43 GMT

Yes, you can add additional labels to your container scan results using the --custom-labels option in twistcli. This allows you to include metadata such as the git commit hash or Jenkins job number in the scan results.

Here is a step-by-step guide on how to use the --custom-labels option with twistcli:

Determine the Metadata to Include: Decide on the metadata you want to add as labels. For example, GIT_COMMIT and BUILD_NUMBER.
Modify your Jenkins Pipeline: Update your Jenkins pipeline script to include these labels. Below is an example of how you might modify your twistcli scan command to include the --custom-labels option:
Run the Pipeline: Execute your Jenkins pipeline. The twistcli command will include the custom labels in the scan results, and they will be visible in the Prisma Cloud Console under the "Labels" tab.
Verify Labels in Prisma Cloud Console: After the scan is completed, navigate to the Prisma Cloud Console (Monitor > Vulnerabilities > Images > CI or Monitor > Compliance > Images > CI) and check the "Labels" tab for the scan results. You should see the additional labels (e.g., GIT_COMMIT and BUILD_NUMBER) you included.

By following these steps, you can add custom metadata labels to your container scan results, making it easier to track and manage your scans based on specific criteria like git commit hashes and Jenkins job numbers.

Re: Add labels to twistcli scan results

pjha1 — Mon, 24 Feb 2025 20:43:10 GMT

pipeline { agent any environment { GIT_COMMIT = sh(script: 'git rev-parse HEAD', returnStdout: true).trim() BUILD_NUMBER = env.BUILD_NUMBER } stages { stage('Scan with twistcli') { steps { script { sh """ twistcli images scan --address <PRISMA_CLOUD_CONSOLE_ADDRESS> --user <PRISMA_CLOUD_USER> --password <PRISMA_CLOUD_PASSWORD> --custom-labels GIT_COMMIT=${GIT_COMMIT},BUILD_NUMBER=${BUILD_NUMBER} <IMAGE_NAME> """ } } } } }

In this example:

GIT_COMMIT is set to the current git commit hash.
BUILD_NUMBER is set to the Jenkins build number.
These values are then passed to the twistcli images scan command using the --custom-labels option.

Re: Add labels to twistcli scan results

pjha1 — Mon, 24 Feb 2025 20:52:26 GMT

Please let me know if that helps or not.

Re: Add labels to twistcli scan results

CGWeatherall — Tue, 25 Feb 2025 00:59:54 GMT

Excellent, I will pass this along to my build team and let you know, thanks!.

Re: Add labels to twistcli scan results

CGWeatherall — Thu, 06 Mar 2025 19:17:22 GMT

We have not been able to run this successfully..

pipeline { agent any environment { GIT_COMMIT = sh(script: 'git rev-parse HEAD', returnStdout: true).trim() BUILD_NUMBER = env.BUILD_NUMBER } stages { stage('Scan with twistcli') { steps { script { sh """ twistcli images scan --address <PRISMA_CLOUD_CONSOLE_ADDRESS> --user <PRISMA_CLOUD_USER> --password <PRISMA_CLOUD_PASSWORD> --custom-labels GIT_COMMIT=${GIT_COMMIT},BUILD_NUMBER=${BUILD_NUMBER} <IMAGE_NAME> """ } } } } }

We're getting an error that it "failed to find image" then it points to GIT_COMMIT" as if it is the image, rather than the actual image name. The variation here being that we are trying to directly define the GIT_COMMIT=author-name rather than defining in the environment variables

Should the <IMAGE_NAME> be directly after --custom-labels or are the custom labels not being seen, because they aren't being defined in the environment variables of the pipeline?

Re: Add labels to twistcli scan results

pjha1 — Wed, 19 Mar 2025 13:55:36 GMT

Hi if you can try below script and let me know if it works or not :

pipeline {
agent any
environment {
GIT_COMMIT = sh(script: 'git rev-parse HEAD', returnStdout: true).trim()
BUILD_NUMBER = env.BUILD_NUMBER
PRISMA_CLOUD_CONSOLE_ADDRESS = 'your_prisma_cloud_console_address'
PRISMA_CLOUD_USER = 'your_prisma_cloud_user'
PRISMA_CLOUD_PASSWORD = 'your_prisma_cloud_password'
IMAGE_NAME = 'your_image_name'
}
stages {
stage('Scan with twistcli') {
steps {
script {
sh """
twistcli images scan --address ${PRISMA_CLOUD_CONSOLE_ADDRESS} --user ${PRISMA_CLOUD_USER} --password ${PRISMA_CLOUD_PASSWORD} ${IMAGE_NAME} --custom-labels GIT_COMMIT=${GIT_COMMIT},BUILD_NUMBER=${BUILD_NUMBER}
"""
}
}
}
}
}

Re: Add labels to twistcli scan results

JessicaSattler — Tue, 30 Sep 2025 04:22:11 GMT

Hi there, I've been working on this for a while with no success yet. Did you ever get the custom labels working, is so , how? Was it expecting key value pairs or is custom labels a boolean? Any help is appreciated.

Re: Add labels to twistcli scan results

JessicaSattler — Tue, 30 Sep 2025 04:24:41 GMT