> For the complete documentation index, see [llms.txt](https://docs.prismacloud.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.prismacloud.io/admin-guide/32/vulnerability-management/vmware-tanzu-blobstore.md). # Configure VMware Tanzu Blobstore Scanning Prisma Cloud for TAS can scan the droplets in your blobstores for vulnerabilities. Prisma Cloud can be configured to scan your blobstores periodically. Defenders are the entities that perform the scanning. When you install Tanzu Application Service (TAS) Defender in your environment, it automatically scans the running apps and hosts in your environment without any special configuration required. Tanzu stores large binary files in blobstores. Blobstores are roughly equivalent to registries. One type of file stored in the blobstore is the droplet. Droplets are archives that contain ready to run applications. They are roughly equivalent to container images. Droplets contain the OS stack, a buildpack (which contains the languages, libraries, and services used by the app), and custom app code. Before running an app on your infrastructure, the Cloud Controller stages it for delivery by combining the OS stack, buildpack, and source code into a droplet, then storing the droplet in a blobstore. The *twistcli* command line tool also lets you scan droplet files directly. You can integrate *twistcli* into your CLI to pass or fail builds based on vulnerability thresholds. ## Configure Prisma Cloud to scan a blobstore Prisma Cloud can scan both internal and external blobstores, and blobstores configured to use the Fog Ruby gem or WebDAV protocol. **Prequisite:** You’ve already [installed TAS Defender](/admin-guide/32/install/deploy-defender/orchestrator/install-tas-defender.md) in your environment. 1. Log into Prisma Cloud Console. 2. Go to **Defend > Vulnerabilities > VMware Tanzu blobstore**. 3. Click **Add blobstore**. 4. In **Blobstore location**, select if scanning is Local or Remote. Prisma Cloud allows you to scan a blobstore by a Defender within the same TAS environment, or to scan it by a Defender in a remote TAS environment. If the Defender (the Scanner) runs in the same TAS environment as the blobstore, select **Local**. If you want a Defender to scan a blobstore in a different TAS environment, select **Remote**. 5. In **Blobstore’s cloud controller**, specify the cloud controller address of the blobstore you want to scan. 6. For **Remote** scanning: 1. (Optional) In **Foundation**, specify the foundation of the blobstore to scan. The foundation name will then be added as a label to the droplets scanned on this blobstore, which allows you to use it as a criteria for [Collections](/admin-guide/32/configure/collections.md). 2. In **Credentials**, enter the credentials required to access the remote blobstore. If the credentials have already been created in the Prisma Cloud credential store, select it. If not, click **Add** to create new credentials. The user role of the credentials you use should be one of the following: Admin, Admin Read-Only, Global Auditor, Org Manager, Space Auditor, Space Developer, or Space Manager. For non-admin users, the *cloud\_controller.read scope* is also required. 3. (Optional) In **CA certificate**, enter a CA certificate in PEM format. 4. In **Scanner’s cloud controlles**, specify the cloud controller address of the TAS environment where the scanning Defender is located. 7. In **Scanner**, specify a Defender to execute the scanning. Prisma Cloud lists all the agentIDs where Defender is installed. To correlate the agentID to the Diego cell’s IP address, and determine which host runs a Defender, log into any Diego cell, and inspect */var/vcap/instance/dns/records.json*. This file shows the correlation between agentID and host IP address. 8. In **Application name**, specify the droplets to scan. Wildcards are supported only at the beginning and at end of the application name. To scan all droplets, enter a single wildcard (`*`). 9. In **Cap**, specify the maximum number of droplets to scan. To scan all droplets, enter 0. 10. Click **Add**. 11. Click **Save**. ## Review scan reports Scan reports show all vulnerabilities found in the droplets in your blobstores. By default, droplets are rescanned every 24 hours. A droplet, which is an artifact of the app staging process, contains the minimum required data to specify an app (binaries/libraries). Droplets are stored in blobstores. Review scan reports for droplets in **Monitor > Vulnerabilities > VMware Tanzu blobstore**. When an application is run in a Diego cell, it’s run on top of a stack, currently cflinuxfs3, which is derived from Ubuntu Bionic 18.04. Defender automatically scans all running applications (buildpack and docker). Review the scan reports for running apps in **Monitor > Vulnerabilities > Images**. If you compare the findings for a buildpack app in **Monitor > Vulnerabilities > VMware Tanzu blobstore** and **Monitor > Vulnerabilities > Images**, you’ll notice a difference in the number of findings. Remember that **Monitor > Vulnerabilities > Images** reports any additional findings in the app’s underlying stack that would not be found in the droplet alone. When TAS stages Docker-based apps, it doesn’t stage an associated droplet in the blobstore. Therefore, blobstore scanning alone won’t cover Docker-based apps. If you’re running Docker containers in TAS, and you want to scan the images before they run, then configure Prisma Cloud to [scan the container registry](/admin-guide/32/vulnerability-management/registry-scanning/scan-docker-registry-v2.md). 1. Log into Prisma Cloud Console. 2. Go to **Monitor > Vulnerabilities > VMware Tanzu blobstore** to see a list of summary reports for each droplet. 3. To drill into a specific scan report, click on a row in the table. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.prismacloud.io/admin-guide/32/vulnerability-management/vmware-tanzu-blobstore.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.