> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/onboard-and-configure/deployment-steps-and-checklist/upgrade-from-prisma-cloud-to-cortex-cloud/migrate-cortex-cli.md).

# Migrate Cortex CLI

To migrate from Prisma Cloud to Cortex Cloud, transition your workflows from your commercial version of **Checkov CLI**, which is used for SCA, Secrets, and IaC scanning in local or build environments, and the **TwistCLI**, which is used for container image scanning, to the Cortex CLI. The Cortex CLI provides a single, consistent command-line interface for scanning across **Cloud Workload Protection** (CWP), **API Security**, and **Cortex Cloud Application Security**.

{% hint style="warning" %}

### Prerequisites

Before you begin, ensure you have the following:

* **Cortex Cloud API key**: An active API key for your Cortex Cloud tenant with associated CLI role permissions. Refer to [Manage API keys](/cortex-cloud-posture-management/onboard-and-configure/deployment-steps-and-checklist/manage-api-keys.md) for more information
* **Install the Cortex CLI**. You can find the installation instructions [here](/cortex-cloud-posture-management/cortex-cli/connect-cortex-cli.md)
  {% endhint %}

### Authentication

The Cortex CLI offers a consistent authentication method across all its supported modules (CWP, Application Security, and API Security). You can authenticate using one of two methods: environment variables or command-line flags.

#### Authenticate via environment variables

Setting environment variables is the recommended method for authentication as it prevents your API credentials from being exposed in your command history and codebase:

1. Create an environment configuration file named `cortex.env`.
2. **Save the cortex.env file in your working directory** → **add your credentials to the file as variables**.

The Cortex CLI uses the following environment variables:

* `CORTEX_API_KEY_ID`: Your unique API key ID
* `CORTEX_API_KEY`: Your API key
* `CORTEX_API_URL`: Your tenant URL (for example <https://api-tenantname.paloaltonetworks.com/>)

#### Authenticate via command-line flags

You can also authenticate by providing your API credentials and base URL directly in the command.

```programlisting
cortexcli code scan --api-base-url <CORTEX_API_BASE_URL> --api-key-id <YOUR_API_KEY_ID> --api-key <YOUR_API_KEY> --directory ./my-app
```

Replace these placeholders:

* `--api-key-id`: Your unique API key ID
* `--api-key`: Your API key
* `--api-base-url`: Your API base URL

### Key changes: commands and functionality

The main change is the command you use to initiate a scan. Instead of the `checkov` or `twistcli` commands, you now use the `cortexcli` command with its subcommands.

| Prisma Cloud command   | Cortex CLI command     | Description                                                  |
| ---------------------- | ---------------------- | ------------------------------------------------------------ |
| `checkov`              | `cortexcli code scan`  | The base command for all code scanning operations            |
| `twistcli images scan` | `cortexcli image scan` | The base command for all container image scanning operations |

### Migrate Checkov to the Cortex CLI

Migrate your existing **Checkov** workflows using the following resources to map your essential commands and flags.

#### Flag references

* For Cortex CLI flags applicable to all supported Cortex Cloud modules, refer to the [Cortex CLI common command line reference guide](/cortex-cloud-posture-management/cortex-cli/cortex-cli-common-command-line-reference-guide.md) documentation
* For specific Cortex Cloud Application Security flags, refer to [Cortex CLI Cortex Cloud Application Security command line reference](/cortex-cloud-posture-management/cortex-cli/cortex-cli-for-code-security/cortex-cli-cortex-cloud-application-security-command-line-reference.md)
* For `checkov` flags, refer to the [CLI Command Reference](https://www.checkov.io/2.Basics/CLI%20Command%20Reference.html)

#### Cortex Cloud Application Security-specific flags

Here are some common Application Security flags to get you started:

* `--directory`: Specifies the directory path to be scanned. This is a required argument for most Application Security scan commands
* `--repo-id`: Identifies the repository being scanned. This command links the scan results to the correct repository within Cortex Cloud
* `--branch`: Specifies the branch of the repository being scanned
* `-upload-mode`: Determines the method for uploading data, with options for upload, no-upload, and no-code

#### Scan output and reporting

The output of a scan can be saved in various formats. The following table maps the output formats and commands.

|                | Checkov                                                                                                                  | Cortex CLI                                                                                 |
| -------------- | ------------------------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------ |
| Output formats | <ul><li>cli</li><li>sarif</li><li>json</li><li>spdx</li><li>Junitxml</li><li>Cyclonedx</li><li>cyclonedx\_json</li></ul> | <ul><li>CSV</li><li>sarif</li><li>Junitxml</li><li>GitLab SAST</li><li>Cyclonedx</li></ul> |
| Output command | `-o [FORMAT]`                                                                                                            | `--output [FORMAT]`                                                                        |

#### Use cases: migrate Checkov to Cortex CLI

**Case #1: Basic directory scan**

To perform a basic scan on a local directory:

* **Checkov**: `checkov --directory`
* **Cortex CLI**: `cortexcli code scan --directory`

**Case #2: Scan and upload to your tenant**

* **Checkov**: By default, scan results are uploaded to your tenant if you have an API token. For example, `checkov -d . --repo-id my-org/my-repo` will upload scan results
* **Cortex CLI**: `cortexcli appsec scan [scan type] --directory . --repo-id my-org/my-repo --branch main --upload-mode upload`

**Case #3: Scan without uploading output**

Get scan results in your terminal without uploading them to your tenant.

* **Checkov**: `checkov -d --skip-results-upload`
* **Cortex CLI**: cortexcli appsec scan --directory . --upload-mode no-upload

#### Advanced use case: CI/CD Pipeline Integration

You can integrate the Cortex CLI directly into your CI/CD pipelines to enable automated code scans by adding code snippets to your build script or pipeline configuration, such as a YAML file (See [here](/application-security/application-security/onboard-data-sources/cli-pipeline-code-snippets.md) for Cortex CLI snippets (such as GitHub Actions, Jenkins and more)).

When updating your CI/CD pipeline, replace the legacy `checkov` step with the new `cortex scan` command.

Docker image limitation: The Cortex CLI does not support SCA scans. You must update your pipelines to download the `corteccli` binary directly if your workflow relies on this functionality.

### Migrate TwistCLI to the Cortex CLI

To help you transition your TwistCLI workflows, this section provides both the necessary flag references and a practical example to guide you in implementing your most common use cases. You can use the following references to map your existing TwistCLI workflows to their Cortex CLI equivalents.

* For TwistCLI flags, refer to [Scan Images with twistcli](https://docs.prismacloud.io/en/enterprise-edition/content-collections/runtime-security/tools/twistcli-scan-images)
* For `cortexcli` flags common to all supported Cortex Cloud modules, refer to [Cortex CLI common command line reference guide](/cortex-cloud-posture-management/cortex-cli/cortex-cli-common-command-line-reference-guide.md)
* For specific Cloud Workload Protection (CWP) flags, refer to [Cloud Workload Protection command line reference](/cortex-cloud-posture-management/cortex-cli/cortex-cli-for-cloud-workload-protection/cloud-workload-protection-command-line-reference.md)

#### Use case: Scan a container image

Here is how you can map your TwistCLI image scan command to the Cortex CLI.

* **Legacy Twistcli command**

  ```programlisting
  ./twistcli images scan \
    --address "your Prisma Cloud Console URL" \
    --user "your_access_key_id" \
    --password "your_secret_key" \
    ubuntu:latest
  ```
* **Cortex CLI command**

  ```programlisting
  cortexcli image scan <container image path>
  ```


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/onboard-and-configure/deployment-steps-and-checklist/upgrade-from-prisma-cloud-to-cortex-cloud/migrate-cortex-cli.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.