Cortex CLI usage

To execute a Cortex CLI scan, run:

cortexcli [global flags] [module name] scan [module flags]

Command breakdown

cortexcli:

The Cortex CLI binary - a global option. Establishes the execution environment for all subsequent commands

Global flags:

Flags that apply across all supported modules. Place global flags between cortexcli and the module name

• --api-base-url <value>
• --api-key <value>
• --api-key-id <value>

Additional global flags are supported by the AppSec and CWP modules, but not the WAAS module. Refer to Cortex CLI common command line reference guide for more information.

Module name:

Select the module (environment) to be scanned:

• api — API Security. For more information about API Security scans, refer to Cortex CLI for API Security
• image — CWP. For more information about CWP scans, refer to Cortex CLI for Cloud Workload Protection
• code — Application Security. For more information about Application Security refer to Cortex CLI for Code Security

Module flags:

The flags available for the selected command:

• For flags common to all environments, refer to Cortex CLI common command line reference guide
• For flags specific to CWP refer to Cloud Workload Protection command line reference
• For flags specific to API Security, refer to Cortex CLI API Security command line reference guide
• For flags specific to Application Security, refer to Cortex CLI Application Security command line reference

Examples

Global flags:

Apply to all modules. Place between cortexcli and the module name:

# Authenticate and scan with global authentication flags
cortexcli --api-base-url https://api.xdr.us.paloaltonetworks.com --api-key <KEY> --api-key-id <KEY_ID> code scan --directory .

Global flags common to AppSec and CWP:

Upload mode, exit code handling, and log output. Not supported by WAAS:

# Run an AppSec scan in no-upload mode with soft-fail and log output
cortexcli --upload-mode no-upload --soft-fail --no-fail-on-crash --log code scan --directory .

AppSec scan:

Scan source code for IaC misconfigurations, SCA vulnerabilities, and secrets:

# Scan a repository directory and filter results to critical and high severity
cortexcli --upload-mode no-upload code scan --directory /path/to/repo --severity critical,high

CWP scan:

Scan a container image for vulnerabilities:

# Scan a container image with soft-fail enabled
cortexcli --soft-fail image scan --image myapp:latest

API Security scan:

Scan APIs for security issues. Global flags (other than authentication) are not supported:

# Run an API Security scan
cortexcli api scan --api-spec /path/to/openapi.yaml

Note

• For more information about CLI usage for CWP, refer to Cortex CLI for Cloud Workload Protection
• For more information about CLI usage for API Security, refer to Cortex CLI for API Security
• For more information about CLI usage for Application Security, refer to Cortex CLI usage for Application Security