> For the complete documentation index, see [llms.txt](https://docs.prismacloud.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.prismacloud.io/admin-guide/32/compliance/custom-compliance-checks.md).

# Custom compliance checks

Custom image checks give you a way to write and run your own compliance checks to assess, measure, and enforce security baselines in your environment.

Prisma Cloud lets you implement your custom image checks with simple scripts.

Custom compliance checks are supported for:

* Linux and Windows hosts (Host configured for docker, containerd, or CRI-O)
* Docker images on Linux hosts
* OCI images

Custom compliance checks are not supported for:

* Agentless scanning on Windows hosts
* Linux and Windows containers
* Docker images on Windows hosts
* Tanzu Application Service (TAS) defender
* GKE Autopilot

A custom image check consists of a single script. The script’s exit code determines the result of the check, where "0" stands for pass and "1" stands for fail.

Scripts are executed in the default shell. The most common default shell for Linux is bash, but that’s not always the case. For Windows container images, the default shell is cmd.exe.

If you want to use a specific shell, or if your default shell is in a non-standard location, use the shebang interpreter directive at the top of your compliance check to specify the path to the executable.

For example, `#!/bin/bash` specifies that the Linux Bourne-again (bash) shell should parse and interpret the compliance check.

For containers, Defender runs the compliance checks inside a restricted sandboxed container instantiated from the image being scanned, thus avoiding the unnecessary risk associated with running arbitrary code.

For hosts, Defender runs the compliance checks on the host itself with unrestricted privileges to allow execution of any script. To limit exposure, this feature is disabled by default.

Every compliance check in the system has a unique ID. Custom checks are automatically assigned an ID, starting with the number 9000. As new custom checks are added, they are automatically assigned the next available ID (9001, 9002, and so on).

Prisma Cloud drops the cached compliance and vulnerability scan results for registries, and rescans registry images, whenever:

* A new rule referencing a custom compliance check is added, or
* An existing compliance check referenced by some existing rule is updated, or
* An existing rule is updated with a new custom compliance check.

In a scaled-out environment with large registries, repeated changes to custom compliance checks could adversely impact on the performance of Prisma Cloud.

## Create a new Custom Check

Create a new compliance rule that includes your custom check, and specify the action to take when the check fails (ignore, alert, block).

**Prerequisite**

* Enable custom compliance checks for hosts (By default, this is disabled).
  * Go to **Manage > Defenders > Advanced Settings**.
  * Set **Custom Compliance Checks for hosts** to enabled.
    * Deploy Defenders to your environment. Or if already deployed, [redeploy your Defenders](/admin-guide/32/install/deploy-defender/redeploy-defender.md).

You must redeploy the Defenders everytime you enable **Custom Compliance Checks for hosts**. If you enable the feature, and then later disable it, the disabled state is effective immediately. You don’t have to redeploy Defenders when you switch to the disabled state.

1. Go to **Defend > Compliance > Custom**.
2. Select **Add check**.
   1. Enter a **Name** and a **Description**.
   2. Specify the **Severity** of the compliance issue.
   3. Enter a [script](#example-scripts).
   4. Select **Save**.
3. Update the compliance policy to run your check.
   1. Go to **Defend > Compliance > Containers and Images** for containers or **Defend > Compliance > Hosts** for hosts.
   2. Select **Add rule**.
   3. Enter a **Rule name**, **Notes**, and select the **Scope** for the resources.
   4. Under **Compliance actions**, narrow the compliance checks displayed.

      For containers, on the **All types** drop-down list, select **Custom > Image**.

      For hosts, on the **All types** drop-down list, select **Custom > Custom**.

      You should see a list of custom checks you’ve implemented, starting with ID 9000.
   5. Select an action for your custom check (**Ignore**, **Alert**, or **Block**).
   6. Select **Save**.
4. Validate your setup by reviewing the compliance reports under **Monitor > Compliance**.

## Example scripts

The following example scripts show how to run some basic checks, such as checking file permissions. Use them as starting point for your scripts. Any special utilities or programs required by your script must be installed in the image being evaluated.

### File permissions (Linux)

The following script checks the permissions for the */bin/busybox* file. Assuming busybox is installed in your image, this check should pass.

```sh
if [ $(stat -c %a /bin/busybox) -eq 755 ]; then
     echo 'test permission failure' && exit 1;
fi
```

### File exists (Linux)

The following script checks if */tmp/foo.txt* exists in the container file system. If it doesn’t exist, the check fails.

```bash
if [ ! -f /tmp/foo.txt ]; then
    echo "File not found!"
    exit 1
fi
```

### User exists (Linux)

The following script checks if the user John exists. If the user exists, the check passes. Otherwise, it fails.

```bash
if grep -F "John" /etc/passwd
then
    echo yes
else
    echo "user not found!"
    exit 1
fi
```

### File exists (Windows)

The following script checks if *C:\Users* exists. If it does, the check passes.

```dos
IF EXIST C:\Users Echo test permission failure && exit 1
```

### File does not exist (Windows)

This check is the inverse of the previous check. The script checks if *C:\Users* doesn’t exist. If it doesn’t exist, the check passes.

```dos
IF NOT EXIST C:\Users Echo test permission failure && exit 1
```


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.prismacloud.io/admin-guide/32/compliance/custom-compliance-checks.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.