> For the complete documentation index, see [llms.txt](https://docs.prismacloud.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.prismacloud.io/admin-guide/configure/configure-scan-intervals.md). # Configure scan intervals You can specify how often Prisma Cloud scans your environment for vulnerabilities and compliance issues. By default, Prisma Cloud scans your environment every 24 hours. Images are re-scanned when changes are detected. For example, pulling a new image triggers a scan. Prisma Cloud scans for vulnerabilities and/or compliance issues in: * Images * VMware Tanzu blobstores * Containers * Serverless functions * Hosts * Cloud platforms * Registries * VM images Scan intervals can be separately configured for each type of object. ## Configuring scan intervals The scan frequency is configurable. By default, Prisma Cloud scans your environment every 24 hours. 1. Open Console. 2. Go to **Manage > System > Scan**. 3. Scroll down to the **Scheduling** section. 4. Set the scan intervals for each type according to your requirements. Scan intervals are specified in hours. 5. Scroll to the bottom of the page, and click **Save**. ## Last scan time Console reports the last time Defender scanned your environment. Go to **Manage > Defenders > Manage**, and click a row in the table to get a detailed status report for each deployed Defender. The sidecar shows the last time Defender scanned the containers and images on the host where it runs. ## Scan performance Scanning for malware in archives in container images consumes a lot of resources. The scanner unpacks each archive to search for malicious software. Checksums must be individually calculated for each file. Because of the performance impact and the way containers tend to be used, malware in archives is an unlikely threat. As such, **Scan for malware within archives in images** is disabled by default. If this option is enabled, Prisma Cloud supports the following archive file types. * ZIP * GZ * TAR * WAR * JAR * EAR If the archive is over 512Mb, Prisma Cloud will not scan it. ## Scan Running Images The scan Running Images toggle optimizes resource usage by limiting scans to images tied to active containers. This is especially useful in production environments, where many images on a host may never be executed, making their scanning unnecessary. * When enabled, Defenders will scan only images linked to currently running containers. * When disabled, Defenders will scan all images on the host, regardless of their container status. In dynamic environments, it’s possible for images that were recently running to still be scanned, even if they are no longer active at the time of the scan. This may give the impression that non-running images are being scanned. ## Scan JavaScript components in manifest but not on disk The purpose of this option is to show vulnerabilities in dependencies that might not exist on disk (which are often development dependencies). Most Node.js packages contain a package.json that lists all of its dependencies (both dependencies, and devDependencies). When parsing a Node.js package discovered during a scan, if this option is enabled, Prisma Cloud appends the all packages found in each package.json to the list of packages to be assessed for vulnerabilities. This option isn’t recommended for production scenarios because it can generate a significant number of false positives. If this option is disabled (default), Prisma Cloud only evaluates the packages that are actually found on disk during scan. This is the recommended setting for production scenarios. * When scanning images with twistcli, use `--include-js-dependencies` to enable this option. * For agentless scanning, this option is enabled by default and cannot be disabled. The agentless scan includes all JavaScript package dependencies listed in the `package.json` file, which may result in identifying vulnerabilities in dependencies that are not physically present on the disk. This can lead to differences in reported vulnerabilities compared to other scanning methods. ## Unrated vulnerabilities When **Show vulnerabilities that are of negligible severity** is enabled, the scanner reports CVEs that aren’t scored yet or have a negligible severity. Negligible severity vulnerabilities don’t pose a security risk, and are often designated with a status of "will not fix" or similar labels by the vendor. They are typically theoretical, require a very special (unlikely) situation to be exploited, or cause no real damage when exploited. By default, this setting is disabled to strip unactionable noise from your scan reports. ## Orchestration Kubernetes and other orchestrators have control plane components implemented as containers. By default, Prisma Cloud doesn’t scan orchestrator utility containers for vulnerability and compliance issues. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.prismacloud.io/admin-guide/configure/configure-scan-intervals.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.