Prisma Cloud (formerly Twistlock) step configuration

Scan container images with Prisma Cloud.

You can scan container images and ingest results from Prisma Cloud (formerly Twistlock).

• You can utilize custom STO scan images and pipelines to run scans as a non-root user. For more details, refer Configure your pipeline to use STO images from private registry.

• STO supports three different approaches for loading self-signed certificates. For more information, refer Run STO scans with custom SSL certificates.

NEW PRISMA CLOUD SCAN FIELDS

Harness STO enhances Prisma Cloud (formerly Twistlock) scan results by adding new fields (File Name, Distro, and Distro Release). The File Name field is derived from packagePath to improve vulnerability tracking and accuracy.

If you have previously run Prisma Cloud scans in STO, note the following on the first pipeline re-run after this update:

• All occurrences that now include the File Name field may appear as remediated and reappear as new due to a change in how findings are identified and correlated. This is expected behavior; it reflects improved accuracy (not new vulnerabilities), and subsequent scans will behave normally.

Prisma Cloud step settings for STO

The recommended workflow is to add a PrismaCloud step to a Security or Build stage and then configure it as described below.

Scan

Scan Mode

Scan Configuration

Target

Type

Target and variant detection

Name

Variant

Container image

Type

Domain

Name

Tag/Digest

Access Id

Access Token

Authentication

Domain

Access ID

Access Token

Scan Tool

Use Raw Scanner Severity

Image Name

For Extraction scans, the name of the image that you want to extract from Prisma Cloud.

Ingestion File

Log Level

Additional CLI flags

Use this field to run the twistcli images scan binary with additional flags.

For example, the following argument prevents the scan from publishing results to the Console: --publish FALSE.

Fail on Severity

Settings

Add key-value pairs to Settings (optional) to configure Prisma Cloud scan behavior and labels.

Grace period

Apply Prisma Cloud grace periods during Fail on Severity evaluation. Add GRACE_PERIOD: TRUE to Settings (optional) on the Prisma Cloud scan step to enable grace period support.

• Active grace periods: Harness STO reads grace period metadata from Prisma scan results. Findings with an active grace period are excluded from Fail on Severity for the scanned Target. The pipeline does not fail for those vulnerabilities, even when severity meets or exceeds your threshold. The findings still appear in scan results.

• Expiration: After a grace period ends, Harness STO includes the vulnerability in Fail on Severity evaluation on the next scan. This matches Prisma Cloud Console behavior.

• STO exemptions: An approved issue exemption in Harness STO overrides an active Prisma Cloud grace period for Fail on Severity evaluation.

Scan labels

To add labels such as JOB_NAME to your Prisma Cloud scans, add additional key-value pairs to Settings (optional). These key-value pairs are added as labels in the Prisma Cloud UI when you run the scan.

Additional Configuration

Advanced settings

Proxy settings

View Prisma Cloud compliance rule failures

Prisma Cloud compliance rule failures will appear in scan results as Info severity issues, with the issue type set to EXTERNAL_POLICY. Additionally, you can apply OPA policies in Harness STO to enforce or manage these failures. Additionally, you can apply an OPA policy to fail the pipeline based on the compliance rule failures. This can be achieved using the Security Tests - External Policy Failures policy from the security tests policy samples.

Configure External Policy Failures

You can configure Harness STO to treat external policy failures as vulnerabilities. To do this, navigate to Account Settings, go to the Default Settings page, select Security Test Orchestration, and click the External Policy Failures setting.

Enable the external policy failures setting to map them to a selected severity level — Critical, High, Medium, or Low to treat them as vulnerabilities instead of Info level issues. This setting takes effect from the next pipeline execution.

This feature is behind the Feature flag STO_EXTERNAL_POLICY_FAILURES_AS_VULNS. Contact Harness Support to enable this flag.