Prisma Cloud Integration Guide

Integrate Prisma Cloud with Vulnetix. Use twistcli to scan container images for vulnerabilities. Export SARIF and JSON results and upload to Vulnetix.

Run Prisma Cloud in CI

Scan on every push and upload the report as a workflow artifact:

- name: Prisma Cloud scan
  id: scan
  uses: PaloAltoNetworks/prisma-cloud-scan@v1.5
  with:
    pcc_console_url: ${{ secrets.PCC_CONSOLE_URL }}
    pcc_user: ${{ secrets.PCC_USER }}
    pcc_pass: ${{ secrets.PCC_PASS }}
    image_name: myapp:${{ github.sha }}

- name: Upload report
  if: ${{ !cancelled() }}
  uses: actions/upload-artifact@v6
  with:
    name: prisma-cloud
    path: ${{ steps.scan.outputs.sarif_file }}
    if-no-files-found: warn

Then one publish job hands every artifact in the run to Vulnetix, recorded under Prisma Cloud's own name and version. Written once per workflow, however many scanners you run:

publish:
  name: Publish to Vulnetix
  runs-on: ubuntu-latest
  needs: [scan]        # every scanner job, or its report is never published
  if: always()         # or one failing scanner suppresses all the others
  permissions:
    contents: read
    actions: read      # required to list the run's artifacts
  env:
    VULNETIX_ORG_ID: ${{ secrets.VULNETIX_ORG_ID }}
    VULNETIX_API_KEY: ${{ secrets.VULNETIX_API_KEY }}
  steps:
    - uses: actions/checkout@v5
    - name: Install Vulnetix CLI
      run: |
        curl -fsSL https://cli.vulnetix.com/install.sh | sh -s -- --install-dir "$HOME/.local/bin"
        echo "$HOME/.local/bin" >> "$GITHUB_PATH"
    - name: Publish scanner reports
      env:
        GITHUB_TOKEN: ${{ github.token }}
      run: vulnetix gha upload --org-id "$VULNETIX_ORG_ID" --json

After the run, vulnetix gha status reports what was actually recorded.

How Vulnetix compares: better together

Vulnetix does not replace Prisma Cloud. Keep running it. Vulnetix sits on top of Prisma Cloud (and every other scanner you already own) turning disconnected tool outputs into one prioritised, fixable queue.

Prisma Cloud is strongest at its core category and also carries features in Container & Image Scanning, IaC & Cloud Configuration, Secret Scanning, SCA, SAST, License Compliance, SBOM Generation, Network & Vulnerability Scanners, just as Vulnetix spans categories.

✓ full · ~ partial · ✗ not covered

What Prisma Cloud does well

• Full CNAPP breadth in one platform: CSPM + CWPP + CIEM + DSPM + code security + cloud network + WAAS
• twistcli scans container images and serverless functions for OS + open-source package vulns, plus runtime protection
• Checkov-powered IaC and secrets scanning across SCM commits/PRs, with 100+ compliance frameworks (CIS, PCI, HIPAA, SOC2)
• Runtime cloud workload protection and posture monitoring at scale that shift-left-only tools cannot provide

Where Vulnetix adds to it: Prisma Cloud is a cloud-runtime + CNAPP heavyweight; Vulnetix does not replace its cloud/runtime engines but ingests its output and adds vendor-neutral cross-scanner dedup, exploit-intel scoring (EPSS/KEV/ESS/LEV), reachability, immutable versioned VEX + audit, EOL and SSVC on the code/dependency supply-chain side.

No migration, no rip-and-replace. Prisma Cloud keeps doing what it does best; Vulnetix adds the orchestration, exploit-intelligence prioritisation and remediation layer built for the way AppSec works today.

Centralise Prisma Cloud results in Vulnetix

Upload Prisma Cloud SARIF, JSON output to the Vulnetix platform to deduplicate findings, prioritise them with EPSS, CISA KEV and Coalition ESS exploit intelligence, and track remediation across every scanner in a single queue.

Prisma Cloud documentation ↗

Wire Prisma Cloud into your CI/CD pipeline →