Onboard JFrog Artifactory

Follow the steps below to configure the connection to your JFrog Artifactory instance.

Prerequisites

• Cortex Cloud

  • User permissions: Ensure you have View/Edit permissions for Data Sources and Integrations (RBAC: AppSec Admin or Instance Administrator)
  • Egress path: Create an egress path to establish the designated route for outbound data transmission from Cortex Cloud to third party services. For more information about configuring egress paths, rrefer to Egress configurations
• JFrog permissions:

  • User permissions: The permissions associated with the user configured during the onboarding process determine the scope of scan results. Only repositories and artifacts the user can access are included

    Repository access: The Artifactory user must have Read access to the specific repositories you want to scan

Onboarding steps

1. Navigate to Settings → Data Sources & Integrations → + Add New.
2. Hover over JFrog Artifactory and click Add or Add Another Instance if an instance is already onboarded.
3. Select Package resolution for code scanning as the integration type.
4. Provide an instance name → Enable access by IPs (optional) → Next.

   Note

   To authorize the scanner to connect through your firewall, select Enable access by IPs, and copy the displayed source IPs to your organization's allowlist.
5. Fill in the provided fields and click Next.

   • Registry URL: Enter your JFrog Artifactory URL.

     Example 2. Examples

     • For JFrog SaaS integrations: https://example.jfrog.io
     • For JFrog on-premises integrations: https://artifactory.example.com, where <artifactory.example.com> is your server domain or IP address
   • Username (required): Your JFrog user name
   • Password (required): Your JFrog password
6. Select a package manager to configure a registry as private instead of the default public registry.

   Note

   For Maven:

   • Select Mirror Registry when the repository mirrors an external registry
   • Use Mirror Of to define the mirror scope:

     • * mirrors all requests
     • A specific value, such as central, mirrors only matching requests

   Package managers not listed use the public registry. Select at least one package manager to continue.
7. (Optional): Select Add a package manager to set up an additional package manager.
8. Click Save.
9. Verify integration: Verify integration and confirm that the your integrated JFrog Artifactory instance is Connected.

   1. Navigate to Settings → Data Sources & Integrations.
   2. Filter the table by Provider=JFrog.
   3. Select the resulting displayed instance.
   4. On the Data Source side panel, verify that the Status displays Connected.

Manage the integration

Instance-level actions

1. Navigate to Settings → Data Sources & Integrations and search for JFrog Artifactory.
2. Select the matching result.
3. Locate your instance, right-click it, then select an option:

   • Edit instance: Opens the onboarding wizard, where you can change the instance configuration.
   • Delete instance: Deletes the instance and previous scan data.
   • Copy entire row: Copies all row values to the clipboard.

Repository-level actions

Right-click a connected repository to Set Scanned Branches, run a manual scan through Scan Repository, modify the Scan Configuration, or Remove Repository. You can toggle specific scanners and manage pull request behavior in Scan Configuration.

1. Locate your instance. See Instance-level actions.
2. Select the instance. A list of connected repositories appears.
3. Right-click a repository, select the required action, then click Save.