Jenkins for code scans

Integrate Cortex Cloud Application Security with your Jenkins server to allow dynamic, automated, and context-specific code scans across your codebase. This integration provides continuous scanning of your workflows, triggered by code changes or pipeline events, ensuring security checks are performed and issues are detected as early as possible.

Code scans are executed using the Cortex CLI, and include automated shift-left actions based on scan results.

Note

Jenkins onboarding offers both code and CI/CD scanning. A single integrated instance supports either code or CI scanning, but not both. If you require both code and CI scanning for your Jenkins servers, you must create two separate integrations, selecting the appropriate scanning type for each. To onboard Jenkins for CI/CD scans, refer to Jenkins for CI/CD pipeline scans.

Prerequisite

• Grant Administrator permissions to the user integrating Cortex Cloud Application Security with Jenkins
• Egress path: Create an egress path to establish the designated route for outbound data transmission from Cortex Cloud to third party services. For more information about configuring egress paths, refer to Egress configurations

Onboarding steps

1. On the Cortex Cloud console:

   1. Navigate to Settings → Data Sources & Integrations → + Add New.
   2. Search for and hover over Jenkins and click Add, or Add Another Instance if an instance is already onboarded.
2. On the Select Integration step of the Jenkins integration, select Code Scan → Next.
3. On the Add Environment Variables step of the wizard.

   1. Select Generate API key.

      The API key secret and API key ID values are generated and populate their respective fields.
   2. Select your system architecture.
   3. Click Next.
4. Store your Cortex Cloud API Key and API ID in the Jenkins Credentials store.

   Warning

   • For Cortex Cloud Application Security CI tools, you must store secrets in Jenkins Credentials for use in your Jenkins pipelines using either of these methods:

     • Plain text storage: Store secrets directly as plain text in Jenkins Credentials. Access them in your pipeline using the credentials function, which retrieves the secret directly as plain text
     • Credentials Binding Plugin: Use the withCredentials function (requires installing the Credentials Binding Plugin) to securely bind credentials to environment variables within your pipeline
   • The variable names CORTEX_API_KEY and CORTEX_API_KEY_ID must be used exactly as provided. They are part of a predefined system and cannot be changed without causing errors

   • If you have an API key:

     1. Copy the CORTEX_API_KEY and CORTEX_API_KEY_ID variable names from their respective fields in the wizard.
     2. Add the CORTEX_API_KEY and CORTEX_API_KEY_ID names and their corresponding values as separate environment variables (secrets) to the Jenkins Credentials store.
   • If you do not have an API key:

     1. Click Generate API key → Copy the CORTEX_API_KEY and CORTEX_API_KEY_ID and their corresponding values from their respective fields.
     2. Add the CORTEX_API_KEY and CORTEX_API_KEY_ID names and their corresponding values as separate environment variables (secrets) to the Jenkins Credentials store.
5. On the Set repository step of the wizard: (Optional): Add the URL of the repository to be scanned, or skip this step if you are adding code scanning to an existing pipeline → Next.

   Note

   • This step is only required for new pipelines
   • For private repositories, ensure the necessary credentials are configured in Jenkins Credentials
6. On the Configure Subscription step of the integration wizard.

   1. Copy and paste the code from the Configure Subscription step of the integration wizard into your Jenkins pipeline.
   2. In the labels property of your Jenkins configuration file, enter the label of a Jenkins node that is configured with Docker.

      Note

      This ensures your build runs within a Docker environment. If a node without Docker is used, the build will fail.
   3. Optional: The provided code assumes that your Cortex Cloud access key and ID are stored as plain text in Jenkins Credentials. You can replace this method with your preferred secret management solution (such as the withCredentials function).
   4. Click Done.
7. Verify you receive the confirmation message on the last step of the wizard → Close.

Verify integration

1. On the Data Sources & Integrations page, search for Jenkins in the search bar.
2. Hover over and select the resulting entry.
3. Locate and verify that the status of your instance is Connected.

Next steps

View scan results and mitigate issues.

Jenkins code scan workflow templates

Choose a workflow template for your Jenkins configuration:

• Reference A: Without checkout
• Reference B: With checkout

Manage the integration

Instance-level actions

1. Navigate to Settings → Data Sources & Integrations and search for Jenkins.
2. Select the matching result.
3. Locate your instance from the displayed list. Right-click it, then select an option:

   • Edit instance: Opens the onboarding wizard, where you can change the instance configuration.
   • Delete instance: Deletes the instance and previous scan data.
   • Copy entire row: Copies all row values to the clipboard.

Repository-level actions

Right-click a connected repository to Set Scanned Branches, run a manual scan through Scan Repository, modify the Scan Configuration, or Remove Repository. In Scan Configuration, you can toggle scanners and manage pull request behavior.

1. Locate your instance. See Instance-level actions.
2. Select the instance. A list of connected repositories appears.
3. Right-click a repository, select the required action, then select Save.