> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/kubernetes-security/manage-kubernetes-connector-instances/run-an-on-demand-kubernetes-cluster-scan.md).

# Run an on-demand Kubernetes cluster scan

On-demand scanning applies to individual Kubernetes clusters managed by an active Cortex Cloud KSPM connector. On-demand scanning does not replace scheduled scan cycles and does not support bulk operations across multiple clusters simultaneously.

{% hint style="info" %}
**Prerequisites**

Before requesting an on-demand scan, verify the following:

* A KSPM connector is deployed on the target cluster. If no connector is deployed, the context menu displays a **Deploy connector** option instead of **Request scan**.
* Ensure the Kubernetes connector for the target cluster is active and sends heartbeats to Cortex Cloud every 15 minutes.
* The KSPM connector is running version 2.0 or later. This version includes redefined cluster-level RBAC permissions that enhance security by restricting access to specific namespaces where possible.
  {% endhint %}

{% hint style="info" %}
If the Kubernetes connector for the target cluster sent a heartbeat more than 15 minutes ago, the Kubernetes Cluster Scan Now dialog displays the message: Action temporarily unavailable. The connector connectivity cannot currently be verified.
{% endhint %}

The Request scan option is available to all Cortex Cloud users with access to the Kubernetes Clusters inventory. No additional role-based permissions are required to request a scan.

### Scan types

The Request scan dialog provides the following scan types:

| Scan type            | Description                                                                                            | Cooldown period |
| -------------------- | ------------------------------------------------------------------------------------------------------ | --------------- |
| Inventory            | Collects and updates the full inventory of Kubernetes resources in the cluster.                        | 1 hour          |
| Nodes and containers | Scans all nodes in the cluster, including container images, for vulnerabilities and misconfigurations. | 6 hours         |

{% hint style="warning" %}
The nodes and containers scan is both CPU and memory-intensive. Run the scan no more than once every six hours to avoid performance degradation on the target cluster.
{% endhint %}

Each scan type enforces a cooldown period after a successful request. When a scan type is in cooldown, the corresponding checkbox is disabled, and a countdown badge indicates when the next scan request becomes available.

### Request an on-demand scan

The Request scan option is available from two locations in the Cortex Cloud console:

{% stepper %}
{% step %}

#### Open the Request scan dialog

1. Go to **Kubernetes Asset Inventory** → **Kubernetes Clusters**.
2. Right-click the target Kubernetes cluster row and select **Request scan**. Alternatively, open the asset detail panel and select **Request scan** from the actions menu.
   {% endstep %}

{% step %}

#### Select scan types

1. In the **Request scan** dialog, review the cluster details: cluster name, cluster distribution (EKS, AKS, GKE, OpenShift, or Kubernetes), cloud account name, and cloud provider.
2. Under **Select scan type**, select one or both scan types: **Inventory scan** and **Nodes & containers scan**.
3. Select **Request**.
   {% endstep %}
   {% endstepper %}

{% hint style="info" %}
If the connector version is earlier than 2.0, the Request scan option appears as Request scan (Update required) and is disabled. Upgrade the Kubernetes connector to version 2.0 or later to enable on-demand scanning.
{% endhint %}

### Results

After a successful request, Cortex Cloud displays the Scan Requested confirmation, followed by one of the following messages:

* An Inventory scan was successfully requested
* A Nodes and Containers scan was successfully requested
* The connector is inactive (no heartbeat received in the last 15 minutes).

### Known limitations

* The scan executes after the next connector heartbeat (approximately 30 seconds), not immediately upon request.
* Bulk scan requests across multiple clusters simultaneously are not supported.
* Customization of cooldown periods is not available through the Cortex Cloud console.
* A historical audit log of on-demand scan requests is not available.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/kubernetes-security/manage-kubernetes-connector-instances/run-an-on-demand-kubernetes-cluster-scan.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.