> For the complete documentation index, see [llms.txt](https://docs.prismacloud.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.prismacloud.io/admin-guide/33/agentless-scanning/onboard-accounts/onboard-oci.md).
# Onboard OCI Accounts
Agentless scanning lets you inspect the risks and vulnerabilities of a virtual machine without having to install an agent or affecting the execution of the instance. Prisma Cloud gives you the flexibility to choose between agentless and agent-based security using Defenders. Currently, Prisma Cloud supports agentless scanning on Oracle Cloud Infrastructure (OCI) for vulnerabilities and compliance. To learn more about how agentless scanning works, see the [How Agentless Scanning Works?](https://github.com/PaloAltoNetworks/pc-docs-md/tree/main/compute-edition/33/admin-guide/agentless-scanning/agentless-scanning.md)
The procedure shows you how to complete the following tasks.
1. Create an OCI compartment to run the needed instances in OCI that perform the agentless scanning.
2. Create a new OCI user for Prisma Cloud to access OCI.
3. Create an API key in OCI for the new user.
4. Configure the Prisma Cloud console to access the OCI resources.
5. Apply the needed permissions in OCI.
6. Start an agentless scan.
## Create an OCI Compartment
1. Go to the Oracle Cloud console.
2. In the menu, go to **Identity & Security > Compartments**.
3. Click **Create Compartment**.
4. Enter a name and a description for the compartment.
5. Click **Create Compartment**.
To scan all resources across all regions, you must create the resources for the different regions in the compartment. Make sure to create all needed resources with the same name in all regions.
## Create a New OCI User
1. In the menu, go to **Identity & Security > Users**.
2. Click **Create User**.
3. Select **IAM User**.
4. Enter a **Name** and a **Description** for the user.
5. Click **Create**.
## Create an API Access Key
1. On the user page, go to **Resources > API Key**.
2. Select **Generate API Key Pair**.
3. Click **Download Private Key**.
4. Click **Add**.
5. The **Configuration File Preview** opens.
1. Copy the key-value pair for `user` into a text file.
2. Copy the key-value pair for `fingerprint` into a text file.
3. Copy the key-value pair for `tenancy` into a text file.
4. Save the text file.
6. Click **Close**.
## Configure Agentless Scanning
Complete the [agentless scanning configuration](/admin-guide/33/agentless-scanning/onboard-accounts/configure-oci.md#configure-oci-agentless) for your OCI accounts.
## Apply the Permissions in OCI
1. Go to the Oracle Cloud console.
2. Click on the terminal icon on the right hand corner and select **Cloud Shell**.
3. Click the gear icon on the shell, and select **Upload File**.
4. Select the `pcc-apply-permissions.sh` permission template you downloaded from the Prisma Cloud Console.
5. Make the file executable with the following command.
```
chmod +x pcc-apply-permissions.sh
```
6. Apply the permissions with the following command. Replace \ with the name of the created compartment.
```
apply ./pcc-apply-permissions.sh
```
7. Verify that the changed statements for the policy are correct and enter `y` to continue.
8. Enter `y` to dismiss the warning about tags.
9. Once the permissions are applied, you have an OCI user with the needed permissions.
### Agentless Scanning for Cloud Accounts
* **During Onboarding**: When cloud accounts are onboarded to Prisma Cloud with the "Agentless Scanning" option enabled, scanning starts immediately. This provides instant visibility into the vulnerabilities and configurations risks for the account. If this option is disabled before onboarding, Prisma Cloud does not scan the workloads in the account. The account remains unscanned until agentless scanning is enabled.
To modify the scan settings, see [Edit Agentless Scan Settings](#enable-agentless-scan).
* **For existing accounts**: Enabling agentless scanning for existing accounts in Prisma Cloud does not initiate an immediate scan. Instead, these accounts are added to the next scheduled scan cycle, which occurs every 24 hours by default. This ensures that scans are conducted systematically according to the scan cycle, rather than starting immediately upon enabling.
To modify the scan cycle, see [Modify the Agentless Scan Interval](#modifying-the-agentless-scan-interval).
### Account Origin Filter
The **Account Origin** filter on the **Runtime Security > Manage > Cloud Accounts** page categorizes cloud accounts based on their source, making it easier to distinguish them during onboarding and scanning:
* **Local accounts** – Accounts created in Runtime Security only (not present in the Prisma Cloud console).
* **Manually imported accounts** – Accounts manually imported from the Prisma Cloud console to Runtime Security before the **Lagrange release (end of 2022)**.
* **Auto-imported accounts** – Accounts that originated in the Prisma Cloud console and were automatically imported into Runtime Security.
### Edit Agentless Scan Settings
You can safely enable agentless scanning settings for disabled accounts on the **Runtime Security** > **Manage** > **Cloud accounts** page. After enabling agentless scan, the scan will trigger with the correct configuration in place.
To edit agentless scan settings, complete the following steps:
1. Go to **Runtime Security > Manage > Cloud accounts**.
2. Select **Edit Account** icon from the Actions column for the account.
3. In **Account and Agentless setup**, go to **Agentless scanning** section.
4. Modify the agentless configuration options in this section.
5. Select **Save**.
After the configuration is modified, the next scan uses the updated settings.
### Modify the Agentless Scan Interval
By default, agentless scans are triggered every 24 hours.
To change the interval, complete the following steps.
1. Go to **Runtime Security > Manage > System**.
2. Select the **Scan** tab.
3. In the **Scheduling** section, in **Agentless** box, type the new duration for the scan cycle.
4. Select **Save**
### Manually Start Agentless Scanning
To manually start a scan, complete the following steps.
1. Go to **Runtime Security > Manage > Cloud accounts**.
2. In the **Scan in your environment** section, select **Start Agentless scan**.
Note: Scanning starts for all the accounts that have the agentless scanning option enabled.
3. Select the Scan icon in the top-right corner of the console to view the scan status.
4. To view the results, complete the following steps.
1. Go to **Runtime Security > Monitor > Vulnerabilities > Hosts** or **Runtime Security > Monitor > Vulnerabilities > Images**.
2. Select **Filter hosts**.
3. Select the **Scanned by** filter.
4. Select the **Agentless** filter.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://docs.prismacloud.io/admin-guide/33/agentless-scanning/onboard-accounts/onboard-oci.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.