Cortex CLI usage

Run Cortex CLI commands for security scans in Cortex XSIAM.

Run a Cortex CLI scan

Run scans with this command structure:

cortexcli [global flags] [module name] scan [module flags]

Place global flags before the module name. Place module flags after scan.

Command components

• cortexcli — The Cortex CLI binary.
• Global flags — Apply across supported modules. Place them between cortexcli and the module name.

  • --api-base-url <value>
  • --api-key <value>
  • --api-key-id <value>

  AppSec and CWP support additional global flags. WAAS does not. See the Cortex CLI common command line reference guide.
• Module name — Select the environment to scan.

  • api — API Security. See Cortex CLI for API Security.
  • image — Cloud Workload Protection (CWP). See Cortex CLI for Cloud Workload Protection.
  • code — Cortex Cloud Application Security. See Cortex CLI for Code Security.
• Module flags — Apply to the selected command.

  • Cortex CLI common command line reference guide
  • Cloud Workload Protection command line reference
  • Cortex CLI API Security command line reference guide
  • Cortex CLI Cortex Cloud Application Security command line reference

Exit codes and error handling

The Cortex Unified CLI uses standardized exit codes to communicate scan results and execution states.

Standard exit codes

• 0 (Success): The scan executed successfully and no blocking security findings were found
• 1 (Scan failed): The scan completed with findings or a general operational failure occurred
• 2 (Execution/usage error): An internal error, version mismatch, or CLI configuration/usage error was encountered

For advanced error handling, suppression flags (--soft-fail), and module-specific exit codes, refer to Exit codes and error handling.

Examples

Global flags

Global flags apply to all modules. Place them between cortexcli and the module name.

# Authenticate and scan with global authentication flags
cortexcli --api-base-url https://api.xdr.us.paloaltonetworks.com --api-key <KEY> --api-key-id <KEY_ID> code scan --directory .

Global flags for AppSec and CWP

Upload mode, exit-code handling, and log output are not supported by WAAS.

# Run an AppSec scan in no-upload mode with soft-fail and log output
cortexcli --upload-mode no-upload --soft-fail --no-fail-on-crash --log code scan --directory .

Cortex Cloud Application Security scan

Scan source code for IaC misconfigurations, SCA vulnerabilities, and secrets:

# Scan a repository directory and filter results to critical and high severity
cortexcli --upload-mode no-upload code scan --directory /path/to/repo --severity critical,high

See Cortex CLI usage for Cortex Cloud Application Security.

Cloud Workload Protection scan

Scan a container image for vulnerabilities:

# Scan a container image with soft-fail enabled
cortexcli --soft-fail image scan --image myapp:latest

See Cortex CLI for Cloud Workload Protection.

API Security scan

Scan APIs for security issues. Global flags (other than authentication) are not supported:

# Run an API Security scan
cortexcli api scan --api-spec /path/to/openapi.yaml

See Cortex CLI for API Security.