> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/cloud-security-and-posture-management-permissions/application-security-permissions/application-security-scans-permissions.md).
# Application Security - Scans permissions
Configure the following permission for Application Security Scans:
* [Periodic scans](#periodic-scans)
* [PR scans](#pr-scans)
* [CI/CD scans](#cicd-scans)
Requires the Application Security add-on, in addition to a foundational Cloud Posture Security, Cloud Runtime Security, or Cortex XSIAM Premium license.
### Periodic scans
Branch Periodic Scans are scheduled, automated scans of repository branches. They run on a configurable schedule to continuously monitor the security posture of your codebase. Results show findings per branch, including IaC misconfigurations, vulnerabilities, secrets, and other issue types. To access Branch Periodic scans, go to Modules → Application Security → Scans → Branch Periodic Scans.
| Permission | Description | Roles Example |
| ---------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| None | No access to Periodic Scans. | SOC Tier-1 and 2 Analysts: Scan results are not typically needed for case investigation at this tier. |
| View | Read-only access to periodic scan results. Users can view scan history, filter results, and view scan details. They cannot configure scan schedules, trigger manual scans, or modify scan configurations. | - SOC Tier-3 Analyst: May need to verify scan coverage and results during advanced investigations.
- Threat Hunter: Reviews scan coverage to identify gaps in security monitoring.
|
| View/Edit | Full access to configure and manage periodic scans. Includes all View capabilities plus: configure scan schedules, trigger manual scans, modify scan configurations, enable/disable scans, and configure scan scope. | Security Engineer: Configures scan schedules, triggers manual scans, and manages scan scope. |
### PR scans
Pull Request Scans are event-driven scans triggered on PR creation or update. They provide inline security feedback to developers during the code review process, enabling shift-left security. Results are tied to specific pull requests and show new findings introduced by the PR. To access PR scans, go to Modules → Application Security → Scans → Pull Request Scans.
| Permission | Description | Roles Example |
| ---------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| None | No access to PR scans. | SOC Tier-1 and 2 Analysts: PR-level scan data is rarely needed for case investigation |
| View | Read-only access to PR scan results. Users can view PR scan history, filter results, and view scan details. They cannot configure PR scan settings or modify scan behavior. | - SOC Tier-3 Analyst: May need to trace a security issue back to a specific PR during forensic analysis.
- Threat Hunter: May review PR scan data to understand how vulnerabilities were introduced.
|
| View/Edit | Full access to configure and manage PR scans. Includes all View capabilities plus: configure PR scan triggers, modify scan settings, and manage PR scan behavior. | Security Engineer: Configures PR scan triggers and manages shift-left security enforcement. |
### CI/CD scans
CI/CD Scans are scans integrated into CI/CD pipelines that run during pipeline execution. They provide security gates within the build and deployment process, enabling automated security checks before code reaches production. Results are tied to specific pipeline runs. To access CI/CD scans, go to Modules → Application Security → Scans → CI Scans.
| Permission | Description | Roles Example |
| ---------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| None | No access to CI/CD Scans. | SOC Tier-1 and 2 Analysts: CI/CD scan data is rarely needed for case investigation at this tier |
| View | Read-only access to CI/CD scan results. Users can view CI/CD scan history, filter results, and view scan details. They cannot configure CI/CD scan settings or modify pipeline integrations. | - SOC Tier-3 Analyst: May need to review pipeline scan results during supply chain attack investigations.
- Threat Hunter: Reviews CI/CD scan data to identify supply chain risks and pipeline vulnerabilities.
|
| View/Edit | Full access to configure and manage CI/CD scans. Includes all View capabilities plus: configure CI/CD scan settings, modify pipeline integrations, and manage scan behavior. | Security Engineer: Configures CI/CD scan settings and manages pipeline security integrations. |
Required and recommended permissions
Consider adding the following permissions:
| Permission | Permission Level | Reason |
| ------------ | ----------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Data Sources | View or View/Edit | - CI/CD View: Strongly recommended for all scans. View connected repositories, CI/CD systems, and pipeline configurations.
- View/Edit: Strongly recommended. Configure CI/CD pipeline connections.
|
| Integrations | View | Strongly recommended for CI/CD system integration status, and for PR Scans to view VCS webhook and PR integration status. Recommended for Periodic scans to view VCS integration status for scan connectivity. |
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/cloud-security-and-posture-management-permissions/application-security-permissions/application-security-scans-permissions.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.