Jenkins

Integrate Prisma Cloud with your Jenkins system to allow dynamic, automated, and context-specific scans within your development workflow. This includes continuous scanning of your workflow whenever changes are pushed or triggered, integrating security checks, and catching issues as soon as they are introduced. Additionally, it automates shift-left actions such as notifying developers or creating tickets, based on scan results.

1. Before you begin.

   1. Generate and copy the Prisma Cloud access key to enable access to Prisma Cloud. The access key includes a key ID and secret.
   2. Add the Prisma Cloud IP addresses and hostname for Application Security to an allow list to enable access to the Prisma Cloud Console.
   3. Grant the Prisma user integrating Prisma Cloud with Jenkins Administrator user permissions.
2. Add your Prisma Cloud access key ID and secret generated in step 1.1 above to the Jenkins credential store.
3. On the Prisma Cloud Application Security console.

   1. In Application Security, select Home > Settings > Connect Provider > Code & Build Providers.

      
   2. Select Jenkins (under CI/CD Runs) in the catalog that is displayed.

      
   3. Enter the URL of the repository to be scanned in the Set Repository step of the integration wizard > Next.
4. Copy and paste the following code from the Configure Subscription step of the integration wizard into your Jenkins pipeline.

   pipeline {
       agent any
   
       environment {
           PRISMA_API_URL="https://api2.prismacloud.io"
       }
   
       stages {
           stage('Checkout') {
             steps {
                 git branch: 'main', url: 'https:// sss.com'
                 stash includes: '**/*', name: 'source'
             }
           }
           stage('Checkov') {
               steps {
                   withCredentials([string(credentialsId: 'PC_USER', variable: 'pc_user'),string(credentialsId: 'PC_PASSWORD', variable: 'pc_password')]) {
                       script {
                           docker.image('bridgecrew/checkov:latest').inside("--entrypoint=''") {
                             unstash 'source'
                             try {
                                 sh 'checkov -d . --use-enforcement-rules -o cli -o junitxml --output-file-path console,results.xml --bc-api-key ${pc_user}::${pc_password} --repo-id  / sss.com --branch main'
                                 junit skipPublishingChecks: true, testResults: 'results.xml'
                             } catch (err) {
                                 junit skipPublishingChecks: true, testResults: 'results.xml'
                                 throw err
                             }
                           }
                       }
                   }
               }
           }
       }
       options {
           preserveStashes()
           timestamps()
       }
   }

   Replace the placeholder strings in the code with your Prisma Cloud access key ID and secret generated in step 1.1 above.
5. Select Done.
6. Verify integration: In Application Security, select Home > Settings > CI/CD Runs tab.

   Your integrated Jenkins repositories will be displayed. You may have to wait for up to three minutes before the status of the integration is updated.
7. Next step: Monitor and manage scan results.

   • The next Jenkins scan will automatically include the selected repositories
   • To view scan results and resolve issues, in Application Security select Home > Projects. See Monitor and Manage Code Build Issues for more information

Jenkins Freestyle Projects

The following example demonstrates how to integrate Prisma Cloud code scanning into your Jenkins UI based project using a 'shell' step to streamline IaC, SCA, and Secrets security testing, and to ensure compliance.

export PRISMA_API_URL="https://app.ca.prismacloud.io"
export BC_API_KEY="${PC_USER}::${PC_PASSWORD}"
Docker pull bridgecrew/checkov:latest
docker run --rm -v $(pwd):/src -w /src bridgecrew/checkov:latest -d . --use-enforcement-rules -o cli -o junitxml --output-file-path console,test_results.xml --prisma-api-url "\${PRISMA_API_URL}" --bc-api-key "\${BC_API_KEY}" --repo-id GitHubOrgGroup/mule-test-app --branch dev