> For the complete documentation index, see [llms.txt](https://docs.prismacloud.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.prismacloud.io/content-collections/application-security/risk-management/ci-cd-risks.md).
# CI/CD Risks
**CI/CD Risks** are a set of predefined rules that aim to identify vulnerabilities in the CI/CD pipeline by analyzing the security settings and configurations of various systems, as well as their inter-connectivity. The risks are classified based on different security categories, including attack vectors, misconfigurations, and bad practices found throughout the CI/CD pipeline.
Through 'CI/CD Risks', you can view an inventory and description of the CI/CD risks detected in a scan, including their severity and the potential impact of the risk. You can remediate risks events by applying suggested solutions or suppress them if you do not want not to actively address them. In addition you can view a Kill Chain graph, which visualizes the stages of a cyber attack on the repository CI/CD pipeline.
To access **CI/CD Risks**, in **Application Security** select **Home** > **CI/CD Risks**.
The CI/CD Risks page includes the following components:
* **Filters**: Narrow a search for a CI/CD risk by using filters.
* **Dashboard**: Displays charts representing a visual display of CI/CD risks by system and category
* **CI/CD risk inventory table**: A list of all risks detected in your CI/CD pipelines.
## Dashboard
The 'Dashboard' provides a visual display of CI/CD risks categorized by system and category. When you select a value, such as a GitHub Actions in the 'Risks by System' chart, both the 'Risks By System' and the 'Risks By Category' charts will update to show results relevant to your selection. In addition, the inventory table will be filtered to display the risks associated with your selection.
## Filters
The following filters allow you to narrow a search for a CI/cD risk:
* **Status**: Filter by status. Values: 'Open', 'Suppressed'' and 'Fixed'.
* **Severity**: Filter by severity. Values: 'Critical', 'High', 'Medium', 'Low', 'Informative'.
* **Risk Priority**: Filter by the potential impact of the risk and ease of remediation. Risk priority is determined through automatic risk analysis. Values: 1-4.
* **System**: Filter by the type of technologies found in the system, such as VCSs, CI, container registry and so on.
* **Risk**: Filter by a risk detected in the pipeline
* **Category**: Filter by system-based categories detected in your organization
* **Repository**: Filter by a repository in your environment
* **Group By**: For details, see **CI/CD Risk Inventory Details** below
The System filter only displays technologies in which CI/CD risks have been detected.
* **Risk**: Filter by CI/CD risk detected in the organization pipelines.
* **Category**: Filter pipeline risks by system-based categories detected in the organization.
By default, Prisma Cloud assigns a category to a risk. The category cannot be modified.
* **Repository**: Filter by repository which includes detected risks.
## CI/CD Risk Inventory Table
The CI/CD risk inventory table includes the following details.
* **Group By**: Group risks in the table by values corresponding to the inventory table headers. This makes it easier to find and understand specific information, allows for a more systematic analysis of data, and helps identify patterns, trends, and relationships.
* **Risk Name**: The name of the CI/CD risk
* **Open Events**: The number of open events of a risk detected in the CI/CD pipeline. See below for more on open events
An 'event' is a particular instance of a CI/CD risk. For example, if the CI/CD risk: 'Possible command injection attack using crafted Issue user event on \[REPO\_NAME] by \[USER]' (details protected by confidentiality) is detected in your GitLab account, it is considered a single event or instance of the 'Possible command injection detected in user event' risk.
* **Severity**: The severity of the CI/CD risk indicated by a color. Values: 'Critical', 'High', 'Medium', 'Low' and 'Informative'.
CI/CD risk severity levels are set by Prisma Cloud.
* **System**: The system (such as GitHub, Jenkins and so on) containing the CI/CD risk
* **Risk Priority**: For details see the Risk Priority filter description above
* **System**: The system (such as GitHub, Jenkins and so on) containing the CI/CD risk
* **CI/CD Category**: The risk category that the CI/CD risk is assigned to, allowing organizations to focus efforts to secure their CI/CD ecosystem. Includes a link to the [Top 10 Security Risks](https://www.cidersecurity.io/top-10-cicd-security-risks/).
For more on CI/CD risk categories refer to [OWASP Top 10 CI/CD Security Risks](https://owasp.org/www-project-top-10-ci-cd-security-risks/).
* **Last Event**: The latest instance of the CI/CD risk detected in your environment
Selecting a CI/CD risk in the inventory opens the **resource explorer**, displaying additional information about the selected risk.
* The **Overview** tab opens as the default view, displaying metadata about the CI/CD risk, including a detailed description, severity, graph view of the location of the risk in the delivery chain, the status of the CI/CD risk events (the number of open, closed or suppressed instances of the risk),the system and category in which they were detected, and when last calculated. In addition, remediation is provided through **Steps to Solve**. See [Suggested Fixes](#suggested-fixes) for more on remediation
* The **Open Events** tab provides a list and details of the open events, including the name and description of the event, and when detected. You can suppress an event (see [Suppress Events](#suppress-events) below for more on suppressing events). In addition, you can access the kill chain graph, when applicable to the event by selecting the icon under **Actions**. See [Kill Chain Graph](#kill-chain-graph) below for more.
* The **Suppressed Events** tab provides a list and details of suppressed events, including an option to unsuppress an event.
* The **Fixed Events** tab provides a list and details of fixed events
## Kill Chain Graph
The Kill Chain graph visualizes the stages of a cyber attack on the CI/CD pipeline, from the initial reconnaissance phase to the final objective of the attack, resulting from multiple misconfigurations across various systems. The graph is used to illustrate the various steps that an attacker takes to penetrate the pipeline, and can help to identify potential vulnerabilities in the pipeline.
The Kill Chain graph currently supports the **Direct Poisoned Pipeline Execution** and **Direct Poisoned Pipeline Execution by external collaborators** CI/CD security risk categories. For more on CI/CD security risk categories, see [OWASP Top 10 CI/CD Security Risks](https://owasp.org/www-project-top-10-ci-cd-security-risks/).
To view the kill chain graph for a risk, select a risk > **Open Events**.
The Kill Chain graph includes nodes and edges, describing the connections between them.
For more actions that you can take on the graph refer to the [Repository Application Graph.](/content-collections/application-security/visibility/repositories.md)
## Suggested Fixes
Prisma Cloud provides suggested solutions to fix instances of CI/CD risks detected in your system: Select a risk from the inventory > in the **Details** tab, scroll down to **Steps to Solve**.
### Suppress Events
An 'event' represents a particular instance of a CI/CD risk. By suppressing an event, you intentionally choose not to actively address the event. This can be useful if the error is known and does not require immediate attention or if the error is expected and does not impact the functionality or stability of the system in which it was detected.
To suppress events, select a risk from the inventory table > choose the required events under the **Open Events** tab of the resource explorer > **Suppress**. The selected events will be removed and displayed under the **Suppressed Events** tab.
Risks that have all events suppressed can be located by filtering using the **Suppressed** option in the **Status** filter.
### Unsuppress Events
Unsuppress an event or multiple events in order to take action on it when the event requires attentions.
To unsuppress an event, select the risk from the inventory table > choose the required events under the **Suppressed Events** tab > **Unsuppress**. The status of the selected events will be restored as 'Open', and will be displayed under the **Open Events** tab.
## Global Suppression
Disable policies globally to exclude calculating issues (risks) detected during a scan in order to reduce overall scan time, to prevent unnecessary policies being scanned, and to help reduce false positives:
1. On the Prisma Cloud console, select **Governance**.
2. Select the relevant policy > in the **Status** column, toggle **OFF**.
If the "Status" column is missing, you can add it by accessing the table menu and selecting **Status**.
3. Click **Confirm** in the **Confirm Disabling Policy Status** popup that is displayed.
Disabling policies automatically resolves open events. You cannot re-enable the policy for the next 4 hours.
For more information on disabling policies, refer to [Manage Prisma Cloud Policies](/content-collections/governance/manage-prisma-cloud-policies.md).
## Export CI/CD Risk Data
You can export all CI/CD risk data or the data relating to an open, suppressed or fixed event, as a CSV file:
* To export **all** CI/CD risk data: Select the **Download** icon found on the top right of the CI/CD risk inventory.
* To export open, suppressed or fixed event data: Select the **Download** icon found in a corresponding sidecar tab when selecting a risk in the inventory table.
When applying filters, the generated data will include filtered data only.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://docs.prismacloud.io/content-collections/application-security/risk-management/ci-cd-risks.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.