Enforcement
Prisma Cloud provides default parameters for each code category scanned in your repositories, based on best practices. Through Enforcement, you can efficiently manage enforcement strategies across your code reviews by customizing how violations, failures and comments are handled before repositories are scanned or integrated. This capability helps reduce unnecessary noise, allowing you to focus on the most critical issues.
The scans are applied across code categories, leading to the enforcement of three run rules:
Hard fail: A repository scan result fails when Prisma Cloud detects a violation or a vulnerability.
Soft fail: A repository scan result passes, but a notification is displayed on the console when Prisma Cloud detects a violation or a vulnerability.
Comment bot: A repository scan result displays issues with suggested fixes as comments within Pull Requests on the VCS (Version Control System).
Prisma Cloud scans the following code categories to detect vulnerabilities and violations unique to each category.
Vulnerabilities
SCA vulnerabilities found in open source packages
Infrastructure as Code (IaC)
Misconfiguration issues found in IaC files
Licenses
License compliance issues found in open source packages and container images
Secrets
Secret leaks across code files that might hinder access to information, services or assets
Default Enforcement Rules
The following table displays the default enforcement rules associated with each code category, determined by severity level. These rules apply to all repositories by default.
In the table, 'Vulnerability' scans result in a hard fail when detecting critical issues, a soft fail for low severity issues, and trigger a comment bot for medium severity issues.
Info
Low
Medium
High
Critical
Vulnerabilities
Not Supported
Hard Fail
Not Supported
Soft Fail
Not Supported
Comments Bot
Licenses
Not Supported
Hard Fail
Not Supported
Soft Fail
Not Supported
Comments Bot
IaC
Hard Fail
Soft Fail
Comments Bot
Secrets
Hard Fail
Soft Fail
Comments Bot
Manage Enforcement
You can modify the default Enforcement configurations, add an exception, and disable run rules or review pull request scans and suggested vulnerability fixes on your VCS (Version Control System). You can modify the default parameters for any code category. However, each time a default configuration is modified, the modified parameters will be applied across all integrated repositories.
The severity configurations for a code category in Soft Fail must be lower than the configurations in Hard Fail. For example, if a code category has a critical severity, it cannot be configured for a soft fail if a hard fail is configured for a medium severity.
Permissions Required to Configure Enforcement
Refer to Prisma Cloud Administrator Permissions for information about the user roles and permissions allowed to configure Enforcement rules.
Access Enforcement
In Application Security, select Settings > Application Security under 'Configure' in the left side menu > Enforcement Rules.
Optionally, you can access Enforcement through Projects: In Application Security select Projects > Action menu > Enforcement.
Modify Default Enforcement Configurations
Default enforcement configurations can be modified for any code category. These changes will be applies universally to all integrated repositories.
Default enforcement configurations cannot be deleted.
Access Enforcement settings.
In a code category, drag the threshold rule arrow (Hard fail, Soft fail, Comments bot) to your required severity.
In this example for the 'Vulnerabilities' code category, a Hard fail has been downgraded from 'Critical' to' High' vulnerability detection.
Optional: Add a label. see Add Labels below for more information about labels.
Select Save.
Add Labels
You can add labels to both default and custom policies. After applying labels, you can create enforcement rules that target specific policy labels and severity thresholds. When PR scans run, only policies matching these criteria will trigger PR comments or cause PR failures. The Projects Enforcement Level filter allows you to focus on relevant findings. Removing these filters will display all findings, regardless of enforcement rule criteria.
NOTES:
To view labels assigned to Application Security policies: On the Prisma Cloud console, select Governance, policy type: config, policy subtype Build. View the label associated to a policy under the Labels column in a row corresponding to the policy
To add labels while creating policies, refer to Custom Build Policies
Access Enforcement settings.
Click on the Label field > select a label from the drop-down menu > Save.
Add an Exception
To ensure focus on critical issues and receive violation notifications for important repositories, add exceptions to Enforcement rules. You can add an exception for each code category that is applicable. The exception configuration runs in addition to the default enforcement configurations.
Configuring an exception includes defining the scope of the exception, and specifying the repositories code categories and run rules that the exception will apply to.
Access Enforcement settings.
Before you begin, ensure that you have the relevant permissions on the repository to add exceptions.
Select Add Exception.
Add a Description for the new exception.
Select the repositories you want to add the exception for.
You will only view repositories that you own.
Modify the severity threshold corresponding to the required code category/ categories.
Select Save.
EXAMPLE
All exceptions are listed on the Enforcement configuration pop-up.
Editing or Deleting an Exception
To edit an exception, hover over an exception > select Edit to edit configure the parameters > Save.
To delete an exception, select Edit > select an exception> Delete this exception.
Disable Enforcement Rules
Global disable: You can disable enforcement rules globally: Uncheck the Enable default thresholds for soft-fail, hard-fail and comments bot in your code reviews setting
Specific disable: You can disable the severity threshold for a specific code category
Disable a run rule for a code category
You can disable one or more run rules (Hard-fail, Soft-fail, Comment-bot) for code categories. This applies to both a default configuration or to an exception.
Disabling a run rule in a code category prevents running a scan for the selected rule.
Select a code category.
Select Off corresponding to the category rule > Save.
Last updated
Was this helpful?