> For the complete documentation index, see [llms.txt](https://docs.prismacloud.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.prismacloud.io/public-sector/release-findings/methodology.md). # Methodology Every release of Prisma Cloud Compute we perform an SCAP scan of the Console and Defender images and post the results here. This process is based upon the U.S. Air Force’s Platform 1 ["Repo One" OpenSCAP scan](https://repo1.dso.mil/ironbank-tools/ironbank-pipeline/-/blob/master/stages/scanning/oscap-compliance-run.sh) of the Prisma Cloud Compute images. We then compare the scan results to [IronBank’s](https://ironbank.dso.mil/about) latest approved UBI8-minimal scan findings, any discrepancies are addressed or justified and the results are posted here. The scanning process is as follows: 1. Build RedHat Enterprise Linux server 2. Install openscap-utils package 3. Pull the latest SCAP content from the [Compliance as Code](https://github.com/ComplianceAsCode/content/releases) GitHub repository. Download the most current binary archive from the repository releases page, eg - the `scap-security-guide-.tar.bz2` or `scap-security-guide-.zip` files. The source file archives require additional build steps before they can be used to scan an image. Once the archive file has been downloaded, expand it to create the subdirectory `scap-security-guide-`. For example, if the current version is `0.1.67`, the files will be unpacked to `scap-security-guide-0.1.67`. 4. Scan the Console and Defender images ``` oscap-podman xccdf eval \ --fetch-remote-resources \ --profile xccdf_org.ssgproject.content_profile_stig \ --report scan_report_name.html scap-security-guide-/ssg-rhel8-ds.xml ``` * The text `` should be replaced by the ID of the target image of the SCAP scan * The text `scap-security-guide-` should be replaced by path to the directory where the archive was unpackage, eg - `scap-security-guide-0.1.67` in the example given above. * The report file name, eg - `scan_report.html` in the command, is arbitrary and can be customized as desired. 5. Compare findings against the IronBank daily issued [UBI8-minimal image.](https://ironbank.dso.mil/repomap/redhat/ubi) --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.prismacloud.io/public-sector/release-findings/methodology.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.