Overview

Palo Alto Networks integrations: SCM Compliance Center, Prisma Cloud CSPM, and Prisma Cloud Compute.

Commands

Command	Description
`regscale panw authenticate`	Authenticate to Prisma Cloud Compute and cache session token. This command authenticates to Prisma Cloud and caches the bearer token locally for the duration specified by prismaTokenCacheMinutes in i
`regscale panw sync_compliance`	Sync Palo Alto Compliance Center results into a RegScale Security Plan. Fetches configuration-compliance check results (per firewall, per Best Practice Check) from Strata Cloud Manager, maps each che
`regscale panw sync_cspm`	Sync Prisma Cloud CSPM assets and vulnerabilities into a RegScale Security Plan. Pulls the cloud asset inventory and vulnerable-asset CVE findings from the Prisma Cloud CSPM API and creates/updates a
`regscale panw sync_hosts`	Sync host assets and vulnerabilities from Prisma Cloud. This command: 1. Authenticates to Prisma Cloud (uses cached token if available) 2. Fetches host scan results from Prisma API 3. Creates/updates
`regscale panw sync_images`	Sync container image assets and vulnerabilities from Prisma Cloud. This command: 1. Authenticates to Prisma Cloud (uses cached token if available) 2. Fetches container image scan results from Prisma
`regscale panw sync_sbom`	Sync SBOM (Software Bill of Materials) data from Prisma Cloud. Two modes: 1. Bulk download (default): Downloads all SBOMs at once using bulk endpoints 2. Individual: Downloads SBOM for specific resou

`regscale panw authenticate`

Authenticate to Prisma Cloud Compute and cache session token.

This command authenticates to Prisma Cloud and caches the bearer token locally for the duration specified by prismaTokenCacheMinutes in init.yaml (default 30 minutes, aligned with the Prisma/Twistlock session timeout). The token will be used automatically by other commands and is refreshed transparently on expiration.

Examples: # Authenticate using init.yaml settings regscale prisma authenticate

console.example.com:8083 \ --username admin --password mypassword

Force refresh of cached token regscale prisma authenticate --force-refresh

regscale panw authenticate [OPTIONS]

Flag	Type	Required	Default	Description
`--console-url`	text	No	—	Prisma Cloud Console URL (e.g., https://console.example.com:8083). Defaults to prismaConsoleUrl from init.yaml.
`--username`	text	No	—	Prisma Cloud username. Defaults to prismaUsername from init.yaml.
`--password`	text	No	—	Prisma Cloud password. Defaults to prismaPassword from init.yaml. If not provided, will prompt.
`--force-refresh`	boolean	No	`false`	Force re-authentication even if cached token exists.

`regscale panw sync_compliance`

Sync Palo Alto Compliance Center results into a RegScale Security Plan.

Fetches configuration-compliance check results (per firewall, per Best Practice Check) from Strata Cloud Manager, maps each check to its framework control, and creates control assessments, control-test results, evidence, and issues in RegScale.

Examples: regscale panw sync_compliance --regscale_ssp_id 123 regscale panw sync_compliance --regscale_ssp_id 123 --product ngfw --cf-id PCF-....

regscale panw sync_compliance [OPTIONS]

Flag	Type	Required	Default	Description
`--regscale_ssp_id, -id, --id, --regscale_id`	integer	Yes	—	The ID number from RegScale of the System Security Plan
`--cf_id, --cf-id`	text	No	—	Specific compliance framework id (defaults to the tenant benchmark).
`--product`	choice	No	—	Product scope to assess; falls back to panwProduct in init.yaml, then 'all'. Choices: `ngfw`, `sase`, `all`
`--framework`	text	No	`NIST800-53R5`	Declared framework token used for control matching (default: NIST800-53R5).
`--base_url, --base-url`	text	No	—	Compliance Center API base URL (overrides init.yaml).
`--token_url, --token-url`	text	No	—	SCM OAuth2 token host (overrides init.yaml).
`--client_id, --client-id`	text	No	—	SCM service-account Client ID (overrides init.yaml).
`--client_secret, --client-secret`	text	No	—	SCM service-account Client Secret (overrides init.yaml); prefer PANW_CLIENT_SECRET or init.yaml over this flag — argv values are visible in shell history and ps.
`--tsg_id, --tsg-id`	text	No	—	Tenant Service Group id (overrides init.yaml); prefer PANW_TSG_ID or init.yaml over this flag.
`--create_issues, --no_create_issues`	boolean	No	`true`	Create issues for failed checks (default: True).
`--update_control_status, --no_update_control_status`	boolean	No	`true`	Update control implementation status from results (default: True).
`--create_poams, --create-poams, -cp`	boolean	No	`false`	Mark created issues as POA&Ms.
`--collect_evidence, --collect-evidence`	boolean	No	`false`	Store the raw benchmark-monitoring CSV as an Evidence record on the SSP.
`--create_control_tests, --no_create_control_tests`	boolean	No	`true`	Create ControlTest / ControlTestResult records per check (default: True).
`--dry-run, -dr`	boolean	No	`false`	Discover item counts without syncing. Returns JSON summary for Orchestration Hub.
`--offset`	integer	No	—	Skip this many items from the start (for parallel job splitting).
`--limit`	integer	No	—	Process at most this many items (for parallel job splitting).

`regscale panw sync_cspm`

Sync Prisma Cloud CSPM assets and vulnerabilities into a RegScale Security Plan.

Pulls the cloud asset inventory and vulnerable-asset CVE findings from the Prisma Cloud CSPM API and creates/updates assets, vulnerabilities, and issues in RegScale.

Examples: regscale panw sync_cspm --regscale_ssp_id 123

regscale panw sync_cspm [OPTIONS]

Flag	Type	Required	Default	Description
`--regscale_ssp_id, -id, --id, --regscale_id`	integer	Yes	—	The ID number from RegScale of the System Security Plan
`--base_url, --base-url`	text	No	—	Prisma Cloud CSPM API base URL (overrides init.yaml).
`--access_key, --access-key`	text	No	—	Prisma Cloud access-key id (overrides init.yaml).
`--secret_key, --secret-key`	text	No	—	Prisma Cloud secret key (overrides init.yaml); prefer PANW_CSPM_SECRET_KEY or init.yaml over this flag — argv values are visible in shell history and ps.
`--dry-run, -dr`	boolean	No	`false`	Discover item counts without syncing. Returns JSON summary for Orchestration Hub.
`--offset`	integer	No	—	Skip this many items from the start (for parallel job splitting).
`--limit`	integer	No	—	Process at most this many items (for parallel job splitting).

`regscale panw sync_hosts`

Sync host assets and vulnerabilities from Prisma Cloud.

This command: 1. Authenticates to Prisma Cloud (uses cached token if available) 2. Fetches host scan results from Prisma API 3. Creates/updates assets in RegScale 4. Creates/updates vulnerabilities and findings in RegScale 5. Optionally creates software inventory from SBOM data

Examples: # Basic sync with defaults from init.yaml regscale prisma sync_hosts --regscale_ssp_id 123

Sync with filters regscale prisma sync_hosts --regscale_ssp_id 123 \ --filters '{"collections": ["production"]}'

Sync with software inventory regscale prisma sync_hosts --regscale_ssp_id 123 --enable-software-inventory

Dry run to preview sync regscale prisma sync_hosts --regscale_ssp_id 123 --dry-run

Paginated sync regscale prisma sync_hosts --regscale_ssp_id 123 --offset 100 --limit 50

regscale panw sync_hosts [OPTIONS]

Flag	Type	Required	Default	Description
`--regscale_ssp_id, -id, --id, --regscale_id`	integer	Yes	—	The ID number from RegScale of the System Security Plan
`--filters`	text	No	—	JSON filter string for Prisma API query (e.g., '{"collections": ["prod"]}')
`--enable-software-inventory`	boolean	No	`false`	Create software inventory records from SBOM data for each host.
`--console-url`	text	No	—	Override Prisma Console URL from init.yaml.
`--username`	text	No	—	Override Prisma username from init.yaml.
`--password`	text	No	—	Override Prisma password from init.yaml.
`--use-csv`	boolean	No	`false`	Use CSV download endpoint for bulk data retrieval (faster for large datasets).
`--skip-assets`	boolean	No	`false`	Do not create or update assets; sync vulnerabilities and issues only, matching preloaded assets.
`--dry-run, -dr`	boolean	No	`false`	Discover item counts without syncing. Returns JSON summary for Orchestration Hub.
`--offset`	integer	No	—	Skip this many items from the start (for parallel job splitting).
`--limit`	integer	No	—	Process at most this many items (for parallel job splitting).

`regscale panw sync_images`

Sync container image assets and vulnerabilities from Prisma Cloud.

This command: 1. Authenticates to Prisma Cloud (uses cached token if available) 2. Fetches container image scan results from Prisma API 3. Creates/updates container image assets in RegScale 4. Creates/updates vulnerabilities and findings in RegScale 5. Optionally creates software inventory from SBOM data

Examples: # Basic sync with defaults from init.yaml regscale prisma sync_images --regscale_ssp_id 123

Sync with filters regscale prisma sync_images --regscale_ssp_id 123 \ --filters '{"collections": ["production"]}'

Sync with software inventory regscale prisma sync_images --regscale_ssp_id 123 --enable-software-inventory

Dry run to preview sync regscale prisma sync_images --regscale_ssp_id 123 --dry-run

Paginated sync regscale prisma sync_images --regscale_ssp_id 123 --offset 50 --limit 25

regscale panw sync_images [OPTIONS]

Flag	Type	Required	Default	Description
`--regscale_ssp_id, -id, --id, --regscale_id`	integer	Yes	—	The ID number from RegScale of the System Security Plan
`--filters`	text	No	—	JSON filter string for Prisma API query (e.g., '{"collections": ["prod"]}')
`--enable-software-inventory`	boolean	No	`false`	Create software inventory records from SBOM data for each image.
`--console-url`	text	No	—	Override Prisma Console URL from init.yaml.
`--username`	text	No	—	Override Prisma username from init.yaml.
`--password`	text	No	—	Override Prisma password from init.yaml.
`--use-csv`	boolean	No	`false`	Use CSV download endpoint for bulk data retrieval (faster for large datasets).
`--skip-assets`	boolean	No	`false`	Do not create or update assets; sync vulnerabilities and issues only, matching preloaded assets.
`--dry-run, -dr`	boolean	No	`false`	Discover item counts without syncing. Returns JSON summary for Orchestration Hub.
`--offset`	integer	No	—	Skip this many items from the start (for parallel job splitting).
`--limit`	integer	No	—	Process at most this many items (for parallel job splitting).

`regscale panw sync_sbom`

Sync SBOM (Software Bill of Materials) data from Prisma Cloud.

Two modes: 1. Bulk download (default): Downloads all SBOMs at once using bulk endpoints 2. Individual: Downloads SBOM for specific resource (requires --resource-id and --no-bulk-download)

Based on Platform One (P1) customer feedback, bulk download mode is recommended as it resolves HTTP 404 errors encountered with individual SBOM endpoints.

Examples: # Bulk download all host SBOMs (recommended) regscale prisma sync_sbom --regscale_ssp_id 123 --resource-type host

Bulk download all image SBOMs with software inventory creation regscale prisma sync_sbom --regscale_ssp_id 123 --resource-type image \ --enable-software-inventory

Download all SBOMs (hosts + images) regscale prisma sync_sbom --regscale_ssp_id 123 --resource-type all

Individual SBOM download (legacy mode, may return 404) regscale prisma sync_sbom --regscale_ssp_id 123 --resource-type host \ --resource-id "web-server-01.example.com" --no-bulk-download --asset-id 456

regscale panw sync_sbom [OPTIONS]

Flag	Type	Required	Default	Description
`--regscale_ssp_id, -id, --id, --regscale_id`	integer	Yes	—	The ID number from RegScale of the System Security Plan
`--resource-type`	choice	No	`all`	Resource type to sync SBOMs for: host, image, or all (default: all). Choices: `host`, `image`, `all`
`--resource-id`	text	No	—	Specific resource identifier (optional for bulk download). Required when --no-bulk-download is used.
`--bulk-download`	boolean	No	`true`	Use bulk download endpoints for all SBOMs (recommended, default: True). Based on P1 customer feedback, this resolves HTTP 404 errors.
`--asset-id`	integer	No	—	RegScale Asset ID to associate software inventory with. If not provided, will search for asset by identifier.
`--enable-software-inventory`	boolean	No	`false`	Create software inventory records from SBOM data.
`--attach-evidence`	boolean	No	`false`	Attach SBOM JSON as evidence to the asset (requires --enable-software-inventory).
`--create-missing-assets`	boolean	No	`false`	Create RegScale assets for SBOMs that have no matching asset in the Security Plan. Also creates software inventory on new assets (no separate --enable-software-inventory needed).
`--console-url`	text	No	—	Override Prisma Console URL from init.yaml.
`--username`	text	No	—	Override Prisma username from init.yaml.
`--password`	text	No	—	Override Prisma password from init.yaml.
`--dry-run, -dr`	boolean	No	`false`	Discover item counts without syncing. Returns JSON summary for Orchestration Hub.
`--offset`	integer	No	—	Skip this many items from the start (for parallel job splitting).
`--limit`	integer	No	—	Process at most this many items (for parallel job splitting).