> For the complete documentation index, see [llms.txt](https://docs.prismacloud.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.prismacloud.io/admin-guide/32/compliance/oss-license-management.md).

# OSS license management

Prisma Cloud can detect licenses for package dependencies in code repositories. It can scan code repos hosted by service providers (currently GitHub only). It can also scan build folders constructed by CI build jobs.

A license policy defines the criticality of a license. For example, you might specify consider any package with a GPL license as a critical issue. Depending on your license policy, Prisma Cloud can raise alerts and block builds.

## Create a license compliance policy

Compliance policies consist of one or more rules.

Prisma Cloud ships with a default rule named **Default - alert all components**. This rule ships with alerts disabled, so the policy is effectively disabled. As a starting point, consider cloning this rule, and reconfiguring it for your own purposes. Set a threshold, and declare licenses you consider critical. Rule order is important, so be sure your custom rule sits above the default rule.

1. Open Console.
2. Go to **Defend > Compliance > Code repositories**.
3. Choose the target of your policy.

   If your policy targets GitHub, go to the **Repositories** tab.

   If your policy targets your CI pipeline, go to the **CI** tab.
4. Click **Add rule**.
5. Specify a rule name.
6. In **Scope**, select one or more collections to apply your policy to specific repos.

   Use the default **All** collection to apply it to all repos.
7. Set the rule thresholds.
8. Specify the severity of each license of interest.

   Each field offers SPDX license identifiers as suggestions. Pattern-matching expressions are supported (e.g., `GPL-*`).

## Scan with twistcli

To scan a folder with twistcli, use the following command:

```
twistcli coderepo scan [FOLDER_PATH] --details
```

Contents of the repo are assessed according to the policy in **Defend > Compliance > Code repositories > CI**. Scan results are published in **Monitor > Compliance > Code repositories > CI**

For CI only, a status column indicates if twistcli passed or failed the build according to the defined policy.

## Review scan results.

Go to **Monitor > Compliance > Code repositories**. Each row in the results table has a meter which shows the number of compliance issues at each severity level. Click on a row to drill into the details of the scan report.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.prismacloud.io/admin-guide/32/compliance/oss-license-management.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.