Jenkins for CI/CD pipeline scans

Integrate Cortex Cloud Application Security CI/CD Security with your Jenkins servers to enable automated and continuous scanning of your CI/CD pipelines. This integration provides proactive security checks, triggered by pipeline events or configuration changes, ensuring security issues are detected and remediated throughout the entire deployment lifecycle.

Pipeline scans are executed using the Cortex CLI, and include automated actions based on scan results to enforce security policies and prevent vulnerable deployments.

Note

Jenkins onboarding offers both code and CI/CD scanning. A single integrated instance supports either code or CI scanning, but not both. If you require both code and CI scanning for your Jenkins servers, you must create two separate integrations, selecting the appropriate scanning type for each. To onboard Jenkins for code scans, refer to Jenkins for code scans.

Prerequisites

Before you begin:

• Cortex Cloud user permissions: Ensure you have View/Edit permissions for Data Sources and Integrations (RBAC: AppSec Admin or Instance Administrator)
• In Jenkins:

  • To install and configure the Cortex plugin in Jenkins, you must be a Jenkins Administrator with Overall/Administer permissions
  • Ensure the build server allows outbound HTTPS (Port 443 traffic to the Cortex API URL

Onboarding steps

1. On the Cortex Cloud console:

   1. Select Settings → Data Sources & Integrations → + Add New.
   2. Search for and hover over Jenkins and click Add, or Add Another Instance if an instance is already onboarded.
2. On the Select Integration step of the wizard, select CI/CD System Scan → Next.
3. On the Create Instance step of the integration wizard: Provide a Jenkins plugin connector name → Next.
4. On the Plugin installation step of the wizard:

   1. Click Download to download the Cortex Cloud Application Security Jenkins Cortex.Cloud.hpi plugin file.
   2. Copy and save the generated JWT token.
   3. Click Save.

      Note

      Verification pending: The integration is added on the console but integration is pending, and will only be completed after completing step 5 below. You can view the pending integration on the Jenkins Instances page: Select Data Sources → Jenkins → View Details. The type of integration is Pipeline Risks
5. Install and configure the Cortex Cloud plugin on your Jenkins server:

   1. Open Jenkins and select: Manage Jenkins → Plugins (under System Configuration) → Advanced settings.
   2. Select Choose File (under the Deploy Plugin section) → browse for the Cortex.Cloud Plugin.hpi file → Upload → Deploy.
   3. Configure the plugin:

      1. Open Jenkins → Select Manage Jenkins → System (under System Configuration) → Cortex Cloud.
      2. Fill in the provided fields:

         • Cortex JWT Token: Paste the JWT token copied in step 4b above.
         • Cortex Reports Recurrence Period (Value: minutes): The frequency with which reports are generated. We recommend that you do not change the default value
      3. Click Save.

         The Cortex Cloud Application Security plugin is integrated with your Jenkins system.

Verify integration

On Data Sources & Integrations, search for Jenkins → select the resulting data source → confirm your instance status is Connected.

Next steps

View scan results and mitigate issues.

Manage the integration

Instance-level actions

1. Navigate to Settings → Data Sources & Integrations and search for Jenkins.
2. Select the matching result.
3. Locate your instance from the displayed list. Right-click it, then select an option:

   • Edit instance: Opens the onboarding wizard, where you can change the instance configuration.
   • Delete instance: Deletes the instance and previous scan data.
   • Copy entire row: Copies all row values to the clipboard.

Repository-level actions

Right-click a connected repository to Set Scanned Branches, run a manual scan through Scan Repository, or Remove Repository.

1. Locate your instance. See Instance-level actions.
2. Select the instance. A list of connected repositories appears.
3. Right-click a repository, select the required action, then select Save.