Package Registries
Integrate private registries to gain visibility into packages of your private registry, to provide precise dependency trees, and to scan for and fix vulnerabilities affecting images or harmful elements that have entered the registry through the software supply chain.
Currently, Prisma Cloud Application Security supports one Artifactory integration, one registry per package manager and is limited to Maven, Gradle, NPM, Yarn, and Pip.
Before you begin.
Add the Prisma Cloud IP addresses and hostname for Application Security to an allow list to enable access to the Prisma Cloud console.
Grant Administrator permissions from Artifactory to the Prisma user integrating Prisma Cloud with your registry. However, a read-only permission of an Artifactory will not impact the scan results on the console.
On the Prisma Cloud Application Security console.
In Application Security, select Home > Settings > Connect Provider > Code & Build Providers.
Select Artifactory (under Private Registries) in the catalog that is displayed.
The Select a Registry step of the integration wizard is displayed.
Enter your Public Artifactory URL, Username and Password in the provided fields.
The URL must include the suffix
/artifactory. For example,https://artifactory.org-name.io/artifactoryThe permissions associated with the username determine the scope of the scan results for private registries
Select Next.
The Setup Package Managers step of the wizard is displayed.
Select a package manager to configure a registry as private instead of the default public registry.
Package managers not listed will default to the public registry.
Select a Registry that is compatible with the package managers in use.
NOTES * NPM requires you to define your repository as Private.
For Maven, you can select Mirror Registry if the repository is a mirror of an existing repository.
Optionally, select Add Package to set up an additional package manager.
Select Next and then select Done.
Verify integration.
In Application Security, select Home > Settings > Private Registries tab.
View integrations and their connection under the Status column.
Additionally, you can view the dependency tree of the private packages dependency trees in the Supply Chain.
Remediation
You can remediate vulnerabilities detected on private registries in Application Security through Home > Projects > Vulnerabilities.
Manage Integrations
For each integration you can perform additional actions through Actions.
Edit integration
Delete integration: If an integration has multiple registries, you can choose to delete it.
Delete entire integration
Optionally, you can choose to delete a private registry integration through the console. In * Application Security*, select Home > Settings > Repositories > Add Repository > Private Registries > Artifactory and then select Delete in the Select a Registry step of the wizard.
After integrating a private registry, the registry becomes the default reference for package versions on the console. If a private fix version for the registry is not available, the console will recommend a public fix version.
Last updated
Was this helpful?