Visual Studio (VS) Code and VS Code compatible IDEs

Integrate the Cortex Cloud code security plugin with your Visual Studio (VS) Code or any VS Code-compatible IDEs (such as Cursor, VSCodium, or Windsurf) to enhance security during development. The plugin scans for security policy violations using both default and custom policies, enabling you to identify and resolve issues before committing code, reducing the risk of pull request failures caused by undetected problems.

Supported scan categories

The plugin scans these code security categories:

• Secrets: Identifies sensitive data embedded in code, such as API keys, encryption keys, OAuth tokens, certificates, PEM files, passwords, and pass-phrases
• IaC misconfigurations in IaC templates such as Kubernetes and Terraform. For supported frameworks, see Cortex CLI Cortex Cloud Application Security command line reference.
• SCA vulnerabilities: Includes security issues in both direct and transitive open-source dependencies
• Licenses: Software license noncompliance
• Package Integrity: Assesses the operational risk and potential impact of each package in your codebase

Prerequisites

Before you begin, ensure these requirements are met for VS Code and compatible IDEs:

• Permissions: CLI Read only permissions. Refer to Cortex CLI for more information about permissions.
• Environment setup

  • macOS and Windows: Install Python versions 3.9.x to 3.12.x
  • Install Node.js version 22 and above for SCA scans (such as vulnerabilities scans)
• API key and URL: Generate an API access key and retrieve your URL for authentication. See Retrieve your API key and URL.

Retrieve your API key and URL

Step 1

Generate and copy a Cortex Cloud access key to enable access to Cortex Cloud. The access key includes a key ID and secret:

1. Navigate to Settings → Configurations → API Keys (under Integrations) → + New Key.
2. Copy and save the key.
3. Retrieve your API Key ID from the ID column.

Important

When generating an API key, ensure you select the Standard security level. IDE and CLI scans will fail if the security level of the API key is set to Advanced.

For more information about API keys, see Get started with Cortex XSIAM APIs.

For more information about Application Security APIs, see the ASPM, CI/CD, and Application Security Overview.

Step 2

Retrieve your Cortex Cloud API URL: Navigate to Settings → Configurations → API Keys (under Integration) → click Copy API URL.

Installation

You can install the plugin directly from your IDE extensions panel or though the Visual Studio Marketplace (for VS Code) or the Open VSX Registry (for compatible IDEs). After completing any installation method, your IDE will activate the extension. Restart your IDE if prompted to ensure the necessary Cortex CLI components initialize correctly.

Install VS Code

VS Code IDE

1. Go to Activity Bar → Extensions.
2. Search for Cortex Cloud.
3. Select Install.

Visual Studio Marketplace

1. Open the Cortex Cloud extension in Visual Studio Marketplace.
2. Select Install → Open Visual Studio Code.app.

   VS Code opens the Cortex Cloud extension.
3. Select Install.

Install VS Code compatibles

Compatible IDE

1. Select the Extensions icon (represented by four squares) in the IDE's Activity Bar (usually on the far left).

   Tip

   You can access Extensions using the keyboard shortcuts Ctrl+Shift+X (Windows) or Cmd+Shift+X (macOS).
2. Search the Registry: Enter Cortex Cloud in the search field at the top of the Extensions view.

   The search results will pull the extension listing from the Open VSX Registry.
3. Click the Cortex Cloud extension in the search results.
4. Select Install.

Open VSX Registry

1. Download the extension package.

   1. Open the Open VSX Registry.
   2. Select Download to save the .vsix extension file locally.
2. Install it through the IDE Command Palette.

   1. Open your compatible IDE.
   2. Press Ctrl+Shift+P (Windows/Linux) or Cmd+Shift+P (macOS).
   3. Type or select Install from VSIX.

      The name can vary, such as Extensions: Install from VSIX....
   4. Select the .vsix file you downloaded.

      The IDE processes the package and activates the extension.

Configure plugin settings

The configuration process depends on whether you’re using the open-source or proprietary version. For the proprietary version, you will need your Cortex Cloud API Key, API Key ID and and tenant URL to establish a secure connection between your environment and Cortex Cloud. These details authenticate you to your tenant. The open-source project does not require these settings.

Note

Enforcement rules and CA certificates are not applicable to the open-source project.

1. Access the Cortex Cloud extension settings in one of these ways:

   • Select Extensions → Cortex Cloud → navigate to the bottom menu bar of your VS Code editor → select the Cortex Cloud tab
   • Select Extensions → Cortex Cloud → click the Settings (cogwheel) icon → Settings
2. Fill in the provided fields:

   • API Key ID (required): The Cortex Cloud access key ID. See Prerequisites.
   • API Key (required): The Cortex Cloud secret key. See Prerequisites.
   • Platform URL (required): Your Cortex Cloud URL. See Prerequisites.

     Danger

     You must insert your API key and API ID values into the Settings before providing the tenant URL.
   • CLI Version: Leave blank to use the latest CLI version (or enter 'latest'), or specify a version
   • CLI Path: Specifies the path to the CLI scanner. Recommended: Leave empty to let the extension manage the scanner installation
   • Disable Error Message Popups: Hide error message popups. You can view errors in the logs via the Open Cortex Cloud Log command
   • Certificate: Add your Cortex Cloud CA certificate. Format: .pem file

     Example 1. Example

     • macOS/Linux: /Users/your_username/Documents/cacert.pem or ~/Documents/cacert.pem
     • Windows: C:\Users\your_username\Documents\cacert.pem
   • Ignore Gitignore files: Selected by default. Files that belongs to paths included in the • gitignore file will not be scanned when opened or saved
   • External Checks Directory: Provide the path to a folder containing custom security checks
   • Specific Frameworks: Scan specific frameworks such as ARM. You can add multiple frameworks using spaces between the values in the command. Refer to Cortex CLI Cortex Cloud Application Security command line reference for more information about framework flags.
   • Environment Variables: Define specific environment variables and their values that will be accessible to the security scanner while it performs its analysis

     • To add variables, select Add item → provide the variable key/value pairs → OK
     • To edit or delete a variable: Select the edit or delete icons next to a variable in the table