Suppress Code Issues
Suppression allows you to suppress issues specifically or globally. You can selectively ignore or suppress specific issues or violations detected during a scan while leaving the overall policy active. This means you can target and ignore the specific code issue for that individual source within the broader scope of the policy, reducing noise and enabling you to focus on critical issues that require attention within the broader scope of the policy. Global suppression disables a policy or rule for all cases within the scope it applies to.
Guidelines
Suppressions applied to the default branch dictate suppression behavior for both pull request (PR) comments and CI/CD runs
When a suppression is added to a PR, it will not take effect in the periodic scan until the PR is merged
When a PR containing a suppression is merged into the default branch, the suppression specific to that asset is applied to the default branch. As a result, subsequent pull requests and periodic scans will no longer flag the suppressed issue
Best Practice (Mandatory for SCA vulnerability suppression) when suppressing through Checkov CLI: Run Checkov within your current working directory (<current_directory_path>). It’s recommended to use the absolute file path. Ensure that the --repo-id parameter includes the
<custom_text>/<repo_name>structure, with the<repo_name>matching the exact name of the directory.Example: Suppose the present working directory is
Users/test/<repo_name>. In this case, the --repo-id parameter must be:--repo-id <repo_owner_name>/<repo_name>, ensuring that<repo_name>precisely matches the directory name within the structure.
Permissions
The table below describes suppression permissions for predefined permission groups.
Predefined Permission Group
Disable Policy
Suppress
System Admin
Yes
Yes
Account Group Admin
Yes
Yes
Cloud Provisioning Admin
No
No
Account and Cloud Provisioning Admin
Yes
Yes
Build and Deploy Security
No
No
Account group read-only
No
Yes
AppSec
No
Yes
Granular Role-Based Access Control (GRBAC) does not provide support for suppression permissions.
Types of Suppressions
The following table describes the different types of suppressions available for various types of scans.
Scan Type
Suppress By
Description
IaC misconfiguration
Resource
Suppress issues associated with specific resources. The selected finding for the selected resource will be excluded from future scans
Repositories
Suppress issues across repositories. The identified issue will be excluded from the scope of the selected repository scans
Tag
Any resource with this tag will be excluded from findings of this policy in future scans
SCA vulnerabilities
CVE
The CVE vulnerability for the specific package and file will be excluded from the scope of future scans
CVE’s in Accounts
The detected CVE vulnerability will be excluded from the scope of future scans in the selected repository
SAST weaknesses
Finding
The detected code issue will be excluded from the scope of future scans in the selected finding
File
All detected code issues of this type will be excluded from the scope of future
Repositories
The detected code issue will be excluded from the scope of future scans in the selected repository
Secrets
Secret
The detected secret will be excluded from the scope of future scans
Licenses
License Types Packages
The detected license will be excluded from the scope of future scans globally All license compliance issues for this package and version globally will be excluded from future scans
VCS Pull Requests
The detected issue will be excluded from the scope of future pull request scans
CI/CD Runs
The issue detected in the CI/CD Run will be excluded from the scope of future scans of the resource
Manage Suppressions on Prisma Cloud Console
You can view and take action on issues detected in scans, including the ability to suppress them, from the Projects page in the Prisma Cloud console. For more on code issues refer to Monitor Code Build Issues.
Suppress Issues through the Console
To suppress issues through the console:
In Application Security, select Projects.
By default, the Overviews tab is displayed, listing all the types of code issues detected in a scan.
Select a tab corresponding to the type of issue you want to suppress.
Options: 'IaC misconfigurations', 'Vulnerabilities' (for SCA), 'Secrets', 'Licenses, 'Weaknesses', 'VCS Pull Requests', 'CI/CD Runs'.
Select an issue from the table > Click on the Issues tab in the Resource Explorer.
Scroll down the issue content and select Suppress.
The Suppress rule modal opens.
Fill in the provided fields:
Provide a justification for suppressing the issue
Optional: Provide an expiration date. After this date, the rule will no longer be valid, and will be ignored
Select the type of suppression. Refer to Types of Suppressions above for more information
Click Save.
View Suppressed Issues
You can view suppressed issues on the Projects page: Select Suppressed from the Issue Status filter. Use category filters (such as IaC) to quickly find suppressed issues relating to a specific category.
Developer Inline Suppressions
Developers can use in-line code comments or annotations to skip specific scans for a particular resource. When these suppressions are applied, any subsequent scans will disregard the issues identified in the code. This can be helpful during development to avoid noise from known issues you’re actively working on. Before using developer inline suppressions, you must enable this functionality through the Prisma Cloud console settings:
In Application Security, select Settings > Application Security under 'Configure' in the left menu.
Scroll down to Developer Suppressions > Enable.
You can override or ignore all developer suppressions by disabling Developer Suppressions, ensuring that the related resource undergoes scanning even when developer suppressions are in place.
For development workflows, inline suppressions can be applied directly from the CLI or your IDE.
Inline Suppressions through an IDE
You can suppress issues directly in your IDE while coding, which adds an inline suppression comment in your code.
The scope of suppression varies depending on the scan type. For Infrastructure as Code (IaC), it applies per resource, while for Software Composition Analysis (SCA) and Static Application Security Testing (SAST), it applies to the entire file. Before using file-scoped suppression, ensure that Developer suppressions are enabled.
For more information on Prisma Cloud Code Security’s capabilities to address security issues directly in the IDE, refer to the Prisma Cloud IDE documentation.
Inline Suppressions through a CLI
The CLI supports Checkov scan capabilities, offering the flexibility to suppress individual checks for each resource or to explicitly choose to run or skip specific checks entirely. You can use inline code comments or annotations to skip individual checks for a particular resource. You can also fine-tune which checks run or do not run for the overall scan.
Example usage: To skip a check on a given Terraform definition block or CloudFormation resource, apply the following comment pattern inside its scope: checkov:skip=<check_id>:<suppression_comment>.
For more information on suppressing code issues through your CLI, refer to the Checkov CLI Suppression documentation.
Global Suppression
Disable policies globally to exclude calculating issues detected during a scan in order to reduce overall scan time, to prevent unnecessary policies being scanned, and to help reduce false positives:
On the Prisma Cloud console, select Governance.
Select the relevant policy > in the Status column, toggle OFF.
If the "Status" column is missing, you can add it by accessing the table menu and selecting Status.
Click Confirm in the Confirm Disabling Policy Status popup that is displayed.
Disabling policies automatically resolves open events. You cannot re-enable the policy for the next 4 hours.
For more information on disabling policies, refer to Manage Prisma Cloud Policies.
Last updated
Was this helpful?