> For the complete documentation index, see [llms.txt](https://docs.prismacloud.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.prismacloud.io/content-collections/application-security/risk-management/monitor-and-manage-code-build/suppress-code-issues.md). # Suppress Code Issues Suppression allows you to suppress issues specifically or globally. You can selectively ignore or suppress specific issues or violations detected during a scan while leaving the overall policy active. This means you can target and ignore the specific code issue for that individual source within the broader scope of the policy, reducing noise and enabling you to focus on critical issues that require attention within the broader scope of the policy. Global suppression disables a policy or rule for all cases within the scope it applies to. ## Guidelines * Suppressions applied to the default branch dictate suppression behavior for both pull request (PR) comments and CI/CD runs * When a suppression is added to a PR, it will not take effect in the periodic scan until the PR is merged * When a PR containing a suppression is merged into the default branch, the suppression specific to that asset is applied to the default branch. As a result, subsequent pull requests and periodic scans will no longer flag the suppressed issue * Best Practice (**Mandatory** for SCA vulnerability suppression) when suppressing through **Checkov CLI**: Run Checkov within your current working directory (\). It’s recommended to use the absolute file path. Ensure that the **--repo-id** parameter includes the `/` structure, with the `` matching the exact name of the directory. Example: Suppose the present working directory is `Users/test/`. In this case, the **--repo-id** parameter must be: `--repo-id /`, ensuring that `` precisely matches the directory name within the structure. ## Permissions The table below describes suppression permissions for predefined permission groups. | Predefined Permission Group | Disable Policy | Suppress | | ------------------------------------ | -------------- | --------------------------------------------------------------------------------------------------------------------- | | System Admin | Yes | Yes | | Account Group Admin | Yes | Yes | | Cloud Provisioning Admin | No | No | | Account and Cloud Provisioning Admin | Yes | Yes | | Build and Deploy Security | No | No | | Account group read-only | No | Yes | | Developer | No |

No
NOTE: To enable Developer suppressions see Developer Inline Suppressions

| | AppSec | No | Yes | Granular Role-Based Access Control (GRBAC) does not provide support for suppression permissions. ## Types of Suppressions The following table describes the different types of suppressions available for various types of scans. | Scan Type | Suppress By | Description | | -------------------- | -------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | IaC misconfiguration | Resource | Suppress issues associated with specific resources. The selected finding for the selected resource will be excluded from future scans | | Repositories | Suppress issues across repositories. The identified issue will be excluded from the scope of the selected repository scans | | | Tag | Any resource with this tag will be excluded from findings of this policy in future scans | | | SCA vulnerabilities | CVE | The CVE vulnerability for the specific package and file will be excluded from the scope of future scans | | CVE’s in Accounts | The detected CVE vulnerability will be excluded from the scope of future scans in the selected repository | | | SAST weaknesses | Finding | The detected code issue will be excluded from the scope of future scans in the selected finding | | File | All detected code issues of this type will be excluded from the scope of future | | | Repositories | The detected code issue will be excluded from the scope of future scans in the selected repository | | | Secrets | Secret | The detected secret will be excluded from the scope of future scans | | Licenses | License Types Packages | The detected license will be excluded from the scope of future scans globally All license compliance issues for this package and version globally will be excluded from future scans | | VCS Pull Requests | | The detected issue will be excluded from the scope of future pull request scans | | CI/CD Runs | | The issue detected in the CI/CD Run will be excluded from the scope of future scans of the resource | ## Manage Suppressions on Prisma Cloud Console You can view and take action on issues detected in scans, including the ability to suppress them, from the **Projects** page in the Prisma Cloud console. For more on code issues refer to [Monitor Code Build Issues](/content-collections/application-security/risk-management/monitor-and-manage-code-build/monitor-code-build-issues.md). ### Suppress Issues through the Console To suppress issues through the console: 1. In **Application Security**, select **Projects**. By default, the **Overviews** tab is displayed, listing all the types of code issues detected in a scan.
suppression type tabs project
2. Select a tab corresponding to the type of issue you want to suppress. Options: 'IaC misconfigurations', 'Vulnerabilities' (for SCA), 'Secrets', 'Licenses, 'Weaknesses', 'VCS Pull Requests', 'CI/CD Runs'. 3. Select an issue from the table > Click on the **Issues** tab in the **Resource Explorer**.
suppress issues1.0
4. Scroll down the issue content and select **Suppress**.
suppress tab
The **Suppress** rule modal opens.
suppress create rule
5. Fill in the provided fields: * Provide a justification for suppressing the issue * Optional: Provide an **expiration date**. After this date, the rule will no longer be valid, and will be ignored * Select the type of suppression. Refer to [Types of Suppressions](#suppress-types) above for more information 6. Click **Save**. ### View Suppressed Issues You can view suppressed issues on the **Projects** page: Select **Suppressed** from the **Issue Status** filter. Use category filters (such as IaC) to quickly find suppressed issues relating to a specific category. ## Developer Inline Suppressions Developers can use in-line code comments or annotations to skip specific scans for a particular resource. When these suppressions are applied, any subsequent scans will disregard the issues identified in the code. This can be helpful during development to avoid noise from known issues you’re actively working on. Before using developer inline suppressions, you must enable this functionality through the Prisma Cloud console settings: 1. In **Application Security**, select **Settings** > **Application Security** under 'Configure' in the left menu. 2. Scroll down to **Developer Suppressions** > **Enable**. You can override or ignore all developer suppressions by disabling **Developer Suppressions**, ensuring that the related resource undergoes scanning even when developer suppressions are in place.
suppressions dev
For development workflows, inline suppressions can be applied directly from the CLI or your IDE. ## Inline Suppressions through an IDE You can suppress issues directly in your IDE while coding, which adds an inline suppression comment in your code.
suppress ide
The scope of suppression varies depending on the scan type. For Infrastructure as Code (IaC), it applies per resource, while for Software Composition Analysis (SCA) and Static Application Security Testing (SAST), it applies to the entire file. Before using file-scoped suppression, ensure that [Developer suppressions](#in-line-suppress) are enabled. For more information on Prisma Cloud Code Security’s capabilities to address security issues directly in the IDE, refer to the [Prisma Cloud IDE documentation](https://github.com/PaloAltoNetworks/pc-docs-md/tree/main/enterprise-edition/content-collections/application-security/ides/ides.md). ## Inline Suppressions through a CLI The CLI supports Checkov scan capabilities, offering the flexibility to suppress individual checks for each resource or to explicitly choose to run or skip specific checks entirely. You can use inline code comments or annotations to skip individual checks for a particular resource. You can also fine-tune which checks run or do not run for the overall scan. Example usage: To skip a check on a given Terraform definition block or CloudFormation resource, apply the following comment pattern inside its scope: `checkov:skip=:`. For more information on suppressing code issues through your CLI, refer to the [Checkov CLI Suppression](https://www.checkov.io/2.Basics/Suppressing%20and%20Skipping%20Policies.html) documentation. ## Global Suppression Disable policies globally to exclude calculating issues detected during a scan in order to reduce overall scan time, to prevent unnecessary policies being scanned, and to help reduce false positives: 1. On the Prisma Cloud console, select **Governance**. 2. Select the relevant policy > in the **Status** column, toggle **OFF**.
suppression global disable policy1.1
If the "Status" column is missing, you can add it by accessing the table menu and selecting **Status**. 3. Click **Confirm** in the **Confirm Disabling Policy Status** popup that is displayed. Disabling policies automatically resolves open events. You cannot re-enable the policy for the next 4 hours. For more information on disabling policies, refer to [Manage Prisma Cloud Policies](/content-collections/governance/manage-prisma-cloud-policies.md). --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.prismacloud.io/content-collections/application-security/risk-management/monitor-and-manage-code-build/suppress-code-issues.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.