Application Asset Query Examples

Learn how to build and analyze Application Asset queries.

Query Example #1

Find all code repositories that have a CODEOWNER file but the repository’s branch protection rule is not using it. Utilizing the CODEOWNER file in branch protection rules can improve security and code quality since any pull request that modifies code owned by a code owner must be approved by that code owner before the pull request can be merged into the protected branch.

1. Select Application Asset from Find.
2. In Type select VCS repository, which represents a repository.
3. In WHERE, select Has Code Owner > is > true.
4. Select a branch protection rule attribute: Add > That Contains VCSBranchProtectionRule.

   The VCSBranchProtectionRule is displayed in the [THAT CONTAINS] field.
5. Select a rule. In WHERE: Add > Is Code Owner Reviews Required > is > false.
6. Select the branch: Add > That Protects VCSBranchPattern > Name > is > main.
7. Select Search.

   The query results are displayed.

   

Query Example #2

Find all VCS deploy keys that have write permissions.

To minimize the risk of a stolen deploy key being used by an attacker, it is recommended to reduce the level of permissions of all deploy keys to read-only when write permissions are not necessary for the pipeline to function properly.

Query Example #3

Find all private code repositories that can be forked.

An attacker could use a fork to create a pull request that triggers a pipeline, which could then be used to deploy malicious code to your production environment. If you do not need to allow forks, it is best to disable fork permission for each repository, preferably at the organization level.

Query Example #4

Find all code repositories that import packages infected with the CVE-2017-20165 vulnerability through package files.

1. Select Investigate on the Prisma Cloud console.
2. Select Application Asset from the Select a Query Type field.
3. Under Type, select VCSRepository, which represents a repository.
4. Add clauses:

   1. Click + Add > That Contains PackageFile.
   2. Click + Add > That Depends On Package.
   3. Click + Add > That Has Vulnerability
   4. Click + Add > id > is > CVE-2017-20165.