> For the complete documentation index, see [llms.txt](https://developer.harness.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://developer.harness.io/security-testing-orchestration/3.0/use-sto/sto-scanner-configuration/prisma-cloud-scanner-reference.md).

# Prisma Cloud (formerly Twistlock) step configuration

You can scan container images and ingest results from [Prisma Cloud](https://docs.prismacloud.io/en) (formerly Twistlock).

{% hint style="info" %}

* You can utilize custom STO scan images and pipelines to run scans as a non-root user. For more details, refer [Configure your pipeline to use STO images from private registry](/security-testing-orchestration/3.0/troubleshooting-and-resources/sto-use-cases/set-up-sto-pipelines/configure-pipeline-to-use-sto-images-from-private-registry.md).
* STO supports three different approaches for loading self-signed certificates. For more information, refer [Run STO scans with custom SSL certificates](/security-testing-orchestration/3.0/troubleshooting-and-resources/sto-use-cases/secure-sto-pipelines/ssl-setup-in-sto.md#supported-workflows-for-adding-custom-ssl-certificates).
  {% endhint %}

{% hint style="info" %}
**NEW PRISMA CLOUD SCAN FIELDS**

Harness STO enhances **Prisma Cloud** (formerly Twistlock) scan results by adding new fields (`File Name`, `Distro`, and `Distro Release`). The `File Name` field is derived from `packagePath` to improve vulnerability tracking and accuracy.

If you have previously run Prisma Cloud scans in STO, note the following on the first pipeline re-run after this update:

* All occurrences that now include the `File Name` field may appear as remediated and reappear as new due to a change in how findings are identified and correlated. This is expected behavior; it reflects improved accuracy (not new vulnerabilities), and subsequent scans will behave normally.
  {% endhint %}

### Prisma Cloud step settings for STO <a href="#prisma-cloud-step-settings-for-sto" id="prisma-cloud-step-settings-for-sto"></a>

The recommended workflow is to add a PrismaCloud step to a Security or Build stage and then configure it as described below.

#### Scan <a href="#scan" id="scan"></a>

**Scan Mode**

**Scan Configuration**

#### Target <a href="#target" id="target"></a>

**Type**

**Target and variant detection**

**Name**

**Variant**

#### Container image <a href="#container-image" id="container-image"></a>

**Type**

**Domain**

**Name**

**Tag/Digest**

**Access Id**

**Access Token**

#### Authentication <a href="#authentication" id="authentication"></a>

**Domain**

**Access ID**

**Access Token**

#### Scan Tool <a href="#scan-tool" id="scan-tool"></a>

**Use Raw Scanner Severity**

**Image Name**

For Extraction scans, the name of the image that you want to extract from Prisma Cloud.

#### Ingestion File <a href="#ingestion-file" id="ingestion-file"></a>

#### Log Level <a href="#log-level" id="log-level"></a>

#### Additional CLI flags <a href="#additional-cli-flags" id="additional-cli-flags"></a>

Use this field to run the [twistcli images scan binary](https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-admin-compute/tools/twistcli_scan_images) with additional flags.

For example, the following argument prevents the scan from publishing results to the Console: `--publish FALSE`.

#### Fail on Severity <a href="#fail-on-severity" id="fail-on-severity"></a>

#### Settings <a href="#settings" id="settings"></a>

Add key-value pairs to **Settings (optional)** to configure Prisma Cloud scan behavior and labels.

**Grace period**

Apply Prisma Cloud grace periods during **Fail on Severity** evaluation. Add `GRACE_PERIOD: TRUE` to **Settings (optional)** on the Prisma Cloud scan step to enable grace period support.

* **Active grace periods:** Harness STO reads grace period metadata from Prisma scan results. Findings with an **active** grace period are excluded from **Fail on Severity** for the scanned Target. The pipeline does not fail for those vulnerabilities, even when severity meets or exceeds your threshold. The findings still appear in scan results.
* **Expiration:** After a grace period ends, Harness STO includes the vulnerability in **Fail on Severity** evaluation on the next scan. This matches Prisma Cloud Console behavior.
* **STO exemptions:** An approved [issue exemption](/security-testing-orchestration/3.0/use-sto/sto-exempt-issues/exemption-workflows.md) in Harness STO overrides an active Prisma Cloud grace period for **Fail on Severity** evaluation.

**Scan labels**

To add labels such as `JOB_NAME` to your Prisma Cloud scans, add additional key-value pairs to **Settings (optional)**. These key-value pairs are added as labels in the Prisma Cloud UI when you run the scan.

#### Additional Configuration <a href="#additional-configuration" id="additional-configuration"></a>

#### Advanced settings <a href="#advanced-settings" id="advanced-settings"></a>

### Proxy settings <a href="#proxy-settings" id="proxy-settings"></a>

### View Prisma Cloud compliance rule failures <a href="#view-prisma-cloud-compliance-rule-failures" id="view-prisma-cloud-compliance-rule-failures"></a>

Prisma Cloud compliance rule failures will appear in scan results as `Info` severity issues, with the issue type set to `EXTERNAL_POLICY`. Additionally, you can apply OPA policies in Harness STO to enforce or manage these failures. Additionally, you can apply an OPA policy to fail the pipeline based on the compliance rule failures. This can be achieved using the [Security Tests - External Policy Failures](/security-testing-orchestration/3.0/use-sto/enforce-sto-policies-for-governance/create-opa-policies.md#block-the-pipeline-based-on-external-policy-failures) policy from the [security tests policy samples](/security-testing-orchestration/3.0/use-sto/enforce-sto-policies-for-governance/create-opa-policies.md#security-test-policy-samples).

### Configure External Policy Failures <a href="#configure-external-policy-failures" id="configure-external-policy-failures"></a>

You can configure Harness STO to treat external policy failures as vulnerabilities. To do this, navigate to Account Settings, go to the Default Settings page, select Security Test Orchestration, and click the External Policy Failures setting.

Enable the external policy failures setting to map them to a selected severity level — `Critical`, `High`, `Medium`, or `Low` to treat them as vulnerabilities instead of `Info` level issues. This setting takes effect from the next pipeline execution.

{% hint style="info" %}
This feature is behind the Feature flag `STO_EXTERNAL_POLICY_FAILURES_AS_VULNS`. Contact [Harness Support](mailto:support@harness.io) to enable this flag.
{% endhint %}