Cortex CLI usage ↗

Run a Cortex CLI scan

Run scans with this command structure:

cortexcli [global flags] [module name] scan [module flags]

Place global flags before the module name. Place module flags after scan.

Command components

• cortexcli — The Cortex CLI binary.

• Global flags — Apply across supported modules. Place them between cortexcli and the module name.

  • --api-base-url <value>
  • --api-key <value>
  • --api-key-id <value>

  AppSec and CWP support additional global flags. WAAS does not. See the Cortex CLI common command line reference guide.

• Module name — Select the environment to scan.
  • api — API Security. See Cortex CLI for API Security.
  • image — Cloud Workload Protection (CWP). See Cortex CLI for Cloud Workload Protection.
  • code — Cortex Cloud Application Security. See Cortex CLI for Code Security.
• Module flags — Apply to the selected command.
  • Cortex CLI common command line reference guide
  • Cloud Workload Protection command line reference
  • Cortex CLI API Security command line reference guide
  • Cortex CLI Cortex Cloud Application Security command line reference

Examples

Global flags

Global flags apply to all modules. Place them between cortexcli and the module name.

# Authenticate and scan with global authentication flags
cortexcli --api-base-url https://api.xdr.us.paloaltonetworks.com --api-key <KEY> --api-key-id <KEY_ID> code scan --directory .

Global flags for AppSec and CWP

Upload mode, exit-code handling, and log output are not supported by WAAS.

# Run an AppSec scan in no-upload mode with soft-fail and log output
cortexcli --upload-mode no-upload --soft-fail --no-fail-on-crash --log code scan --directory .

Cortex Cloud Application Security scan

Scan source code for IaC misconfigurations, SCA vulnerabilities, and secrets:

# Scan a repository directory and filter results to critical and high severity
cortexcli --upload-mode no-upload code scan --directory /path/to/repo --severity critical,high

See Cortex CLI usage for Cortex Cloud Application Security.

Cloud Workload Protection scan

Scan a container image for vulnerabilities:

# Scan a container image with soft-fail enabled
cortexcli --soft-fail image scan --image myapp:latest

See Cortex CLI for Cloud Workload Protection.

API Security scan

Scan APIs for security issues. Global flags (other than authentication) are not supported:

# Run an API Security scan
cortexcli api scan --api-spec /path/to/openapi.yaml

See Cortex CLI for API Security.