Scan code repos with twistcli
Prisma Cloud ships a command-line scanner for scanning code repos. It is supported on Linux, macOS, and Windows.
twistcli scans repositories locally and sends a bill of materials to Console for evaluation. Console assesses the components in the BoM against the latest threat data, and replies back to twistcli with the scan results.
The policy Console uses to assess a code repo is set in Defend > Vulnerabilities > Code repositories > CI and Defend > Compliance > Code repositories > CI.
By default, twistcli publishes scan results to Console. Scan results can viewed in Console under Monitor > Vulnerabilities > Code repositories > CI.
Many developers don’t have access to Prisma Cloud directly, but may want to run twistcli to evaluate a repo before code is submitted and a build job is initiated. twistcli has can print detailed results locally and optionally suppress publishing scan results to Console (which they might not be able to access anyway).
The basic command format is as follows:
twistcli coderepo scan <REPO_PATH> --repository <REPO_NAME>
REPO_PATH can be an absolute or relative path
REPO_NAME is the unique key that Console to identify the repo. If
--repositoryisn’t specified, the repository’s path is used as the repository name.
Detailed result contain all dependencies files and a vulnerability distribution summary. For each dependency file that has any vulnerabilities, a table with information about the vulnerability is printed.
twistcli coderepo scan <REPO_PATH> --repository rowan --details
To exclude files from the scan, use the
Attach only a single value to the argument.
The value should be a relative path from the root of the repository.
To exclude a file:
twistcli coderepo scan <REPO_PATH> --repository rowan --excluded-paths <PATH1>
To exclude multiple files, specify the
--excluded-paths argument multiple times:
twistcli coderepo scan <REPO_PATH> --repository rowan --excluded-paths <PATH1> --excluded-paths <PATH2>
To explicitly scan files scan use the
Specify one file per argument.
For multiple files, specify multiple