[](https://www.paloaltonetworks.com/cortex/cloud?ts=markdown) ![x close icon to close mobile navigation](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/x-black.svg) [![Cortex Cloud logo](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/cortexcloud-logo-dark.svg)](https://www.paloaltonetworks.com/cortex/cloud?ts=markdown) ![magnifying glass search icon to open search field](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/search-black.svg) * [](https://www.paloaltonetworks.com/cortex/cloud?ts=markdown) * 用例 ![black arrow pointing left to go back to main navigation](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/arrow-right-black.svg) 用例 用例 * [Cortex Cloud](https://www.paloaltonetworks.cn/cortex/cloud?ts=markdown) 由统一数据、AI 和自动化提供助力的实时云安全 * [应用安全](https://www.paloaltonetworks.cn/cortex/cloud/application-security?ts=markdown) 从源头阻止风险 * [云态势安全](https://www.paloaltonetworks.cn/cortex/cloud/cloud-posture-security?ts=markdown) 快速确定任何云中的风险优先级并进行补救 * [云运行时安全](https://www.paloaltonetworks.cn/cortex/cloud/runtime-security?ts=markdown) 实时预防云攻击 * [安全运营](https://www.paloaltonetworks.cn/cortex?ts=markdown) 检测、调查和应对整个企业和云中的威胁 * 解决方案 ![black arrow pointing left to go back to main navigation](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/arrow-right-black.svg) 解决方案 [应用安全](https://www.paloaltonetworks.cn/cortex/cloud/application-security?ts=markdown) * [应用安全态势管理 (ASPM)](https://www.paloaltonetworks.cn/cortex/cloud/application-security-posture-management?ts=markdown) * [软件供应链安全](https://www.paloaltonetworks.cn/cortex/cloud/software-supply-chain-security?ts=markdown) * [IaC 安全](https://www.paloaltonetworks.cn/cortex/cloud/infrastructure-as-code-security?ts=markdown) * [软件构成分析](https://www.paloaltonetworks.cn/cortex/cloud/software-composition-analysis?ts=markdown) * [机密安全](https://www.paloaltonetworks.cn/cortex/cloud/secrets-security?ts=markdown) * [开放合作伙伴生态系统](https://www.paloaltonetworks.cn/cortex/cloud/appsec-partner-ecosystem?ts=markdown) [云态势安全](https://www.paloaltonetworks.cn/cortex/cloud/cloud-posture-security?ts=markdown) * [云安全态势管理 (CSPM)](https://www.paloaltonetworks.cn/cortex/cloud/cloud-security-posture-management?ts=markdown) * [云基础架构权限管理 (CIEM)](https://www.paloaltonetworks.cn/cortex/cloud/cloud-infrastructure-entitlement-management?ts=markdown) * [数据安全态势管理 (DSPM)](https://www.paloaltonetworks.cn/cortex/cloud/data-security-posture-management?ts=markdown) * [AI 安全态势管理 (AI-SPM)](https://www.paloaltonetworks.cn/cortex/cloud/ai-security-posture-management?ts=markdown) * [漏洞管理](https://www.paloaltonetworks.cn/cortex/cloud/vulnerability-management?ts=markdown) * [云攻击面管理 (ASM)](https://www.paloaltonetworks.cn/cortex/cloud/attack-surface-management?ts=markdown) [云运行时安全](https://www.paloaltonetworks.cn/cortex/cloud/runtime-security?ts=markdown) * [云检测与响应 (CDR)](https://www.paloaltonetworks.cn/cortex/cloud-detection-and-response?ts=markdown) * [容器和 Kubernetes 安全](https://www.paloaltonetworks.cn/cortex/cloud/container-security?ts=markdown) * [云工作负载保护 (CWP)](https://www.paloaltonetworks.cn/cortex/cloud/cloud-workload-protection?ts=markdown) * [API 安全](https://www.paloaltonetworks.cn/cortex/cloud/api-security?ts=markdown) * [Web 应用安全](https://www.paloaltonetworks.cn/cortex/cloud/web-application-security?ts=markdown) [安全运营](https://www.paloaltonetworks.cn/cortex/?ts=markdown) * [Cortex XSIAM](https://www.paloaltonetworks.cn/cortex/cortex-xsiam?ts=markdown) * [Cortex XDR](https://www.paloaltonetworks.cn/cortex/cortex-xdr?ts=markdown) * [Cortex XSOAR](https://www.paloaltonetworks.cn/cortex/cortex-xsoar?ts=markdown) * [Cortex Xpanse](https://www.paloaltonetworks.cn/cortex/cortex-xpanse?ts=markdown) * [Unit 42 托管检测和响应](https://www.paloaltonetworks.cn/cortex/managed-detection-and-response?ts=markdown) * [产品之旅](https://www.paloaltonetworks.com/cortex/cloud/product-tours?ts=markdown) * 资源 ![black arrow pointing left to go back to main navigation](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/arrow-right-black.svg) 资源 学习 * [博客](https://www.paloaltonetworks.com/blog/cloud-security/?lang=zh-hans) * [云研究](https://www.paloaltonetworks.com/cortex/cloud/research) * [Cyberpedia](https://www.paloaltonetworks.cn/cyberpedia?ts=markdown) * [Live Community](https://live.paloaltonetworks.com/) * [互动研讨会](https://www.paloaltonetworks.com/cortex/cloud/interactive-workshops) 产品信息 * [技术文档](https://docs.paloaltonetworks.com/) * [开源项目](https://www.paloaltonetworks.com/cortex/cloud/open-source-projects) * [支持](https://support.paloaltonetworks.com/Support/Index) 资源 * [技术合作伙伴](https://www.paloaltonetworks.com/partners/technology-partners) * [客户成功案例](https://www.paloaltonetworks.cn/customers?ts=markdown) * [资源中心](https://www.paloaltonetworks.cn/resources?ts=markdown) * [事件](https://events.paloaltonetworks.com) * * [申请演示](https://www.paloaltonetworks.cn/cortex/cloud/trial?ts=markdown) ![palo alto networks logo icon](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/logo-default.svg) ![white arrow icon pointing left to return to main Palo Alto Networks site](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/arrow-right-white.svg) [](https://www.paloaltonetworks.com/cortex/cloud?ts=markdown) 搜索 Close search modal *** ** * ** *** # 软件构成分析 通过开发人员集成和情境感知优先级,积极解决开源漏洞和许可证合规问题。 [申请演示](https://www.paloaltonetworks.cn/cortex/cloud/trial?ts=markdown) ![Host Security Hero Front Image](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/cortexcloud/sca/sca-hero-front.png) ![](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/x-white.svg) ![Host Security Hero Front Image](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/cortexcloud/sca/sca-hero-front.png) 重要意义我们的方法功能 * [重要意义](#why) * [我们的方法](#approach) * [功能](#modules) {#why} ## 随着漏洞越来越普遍且难以捉摸,企业需要更快、更轻松和更无缝的方法来化解开源风险。云原生基础架构和应用层之间的模糊界限可嵌入到 DevOps 工具中,提供了在源头保护代码的机会。通过同时采用开源安全性和合规性,企业可以最大限度地减少误报,确定调查结果的优先级,并提升保护代码安全的速度。 ### 云原生应用依赖开源 开源软件是云原生应用的一个巨大组成部分,让开发人员在构建新功能时可以先行一步,而不必浪费时间做无用功。然而,尽管第三方开源软件有诸多好处,但也带来了安全和合规性风险,这些风险需要作为任何云原生安全计划的一部分来加以解决。 ### 依赖性不断增长会滋生风险 开源软件中包含许多层数据包依赖关系,导致难以了解开源软件在应用堆栈中的位置和使用方式。此外,漏洞常常隐藏在可传递的数据包中。跟踪这些漏洞和许可证需要持续和集成的方法。 ### 孤立的安全工具会导致覆盖漏洞 如果没有应用基础架构的完整情境,就很难确定已识别的漏洞是否在应用中暴露,或者是否存在低风险。通过将应用和基础架构安全发现联系起来,漏洞会在整个代码库的上下文中浮出水面,从而可以更好地确定优先级并更快地修复。 ## Cortex^®^ Cloud 可帮助开发人员轻松消除开源风险,而无需降低开发速度。 通过集成到 DevOps 工具以及代码、构建、部署和运行时,Cortex Cloud 可主动扫描开源软件包的漏洞和许可证合规性问题。Cortex Cloud 的数据模型将代码级基础架构和应用程序弱点、完整的依赖性推断和细粒度版本碰撞修复联系在一起,使其有别于其他 SCA 解决方案。 * 互联基础架构和应用风险的单一视图 * 集成到开发人员工具和工作流程中 * 数据包和容器映像的全生命周期安全性 * ![Icon Built on trusted sources](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/cortexcloud/icons/ico-access-control.svg) 基于可信来源 * ![Icon Developer-friendly integrations](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/cortexcloud/icons/NDR.svg) 开发者友好的集成 * ![Icon Limitless dependency tree scanning](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/cortexcloud/icons/cns-microsegmentation.svg) 无限依赖关系树扫描 * ![Icon Version bump remediations](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/cortexcloud/icons/AutomateAdapt.svg) 版本碰撞修复 * ![Icon License analysis and audit reporting](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/cortexcloud/icons/icon-oss-license-compliance-74x74.svg) 许可分析和审核报告 * ![Icon Custom enforcement rules](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/cortexcloud/icons/InlineMachineLearning.svg) 自定义执行规则 {#approach} 解决方案 ## 软件构成分析的开发人员优先、情境感知方案 ### 高度精准、情境感知 Cortex Cloud 软件构成分析 (SCA) 建立在知名的漏洞数据库之上,并与业界最强大的基础架构策略数据库相连接,通过开发人员了解风险和快速实施修复所需的情境来揭示漏洞。Cortex Cloud 为您提供所需的开放源代码覆盖范围和深度,让您能够及时阻止下一个重大漏洞的出现: * #### 以无与伦比的精确度扫描语言和数据包管理程序 识别支持所有最常见语言和 30 多种上游数据源的开源软件包中的漏洞,以最大限度地减少误报。 \* #### 利用业界领先的资源,在开源安全方面获得十足的信心 Cortex Cloud 可随时随地扫描开放源代码依赖关系,并将其与 NVD 和 Cortex Cloud Intelligence Stream 等公共数据库进行比较,以识别漏洞并提供重要的修复信息。 \* #### 关联基础架构和应用风险 缩小代码库中实际暴露的漏洞范围,以消除误报并加快确定修复优先级的速度。 \* #### 识别任何依赖详情中的漏洞 Cortex Cloud 可摄取软件包管理器的数据,将依赖关系树推断到最远层,以识别隐藏在视线之外的开源风险。 \* #### 可视化软件供应链并为其编目 供应链图提供了管道和代码的合并清单。通过所有连接的可视性以及生成软件物料清单 (SBOM) 的功能,可以更轻松地跟踪应用风险并了解攻击面。 [![基础架构感知](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/cortexcloud/sca/sca-highly-accurate-and-context-aware.png)](#prismastickyimagecomapproach1_prisma-custom-background_prismacustombackgrou_14379965_cleanParsys_software-composition-analysis_cloud_cortex_zh_CN_pan_content_) ### 与灵活的修复进行全面集成 只有开发人员了解开源库的使用方式和使用位置的全部情境,因此,向他们提供反馈是修补漏洞的最佳方式。利用 Cortex Cloud 的原生开发人员工具集成和 CLI 工具的可扩展性,SCA 完全集成到开发人员工作流程中,因此,漏洞会在正确的时间出现在正确的位置: * #### 将开源安全性集成到开发人员工具和工作流程中 通过 IDE 和 VCS 提取/合并请求提供实时漏洞反馈,让开发人员有信心将新的数据包集成到他们的代码库中。 \* #### 在整个生命周期中创建并执行自定义策略 集成漏洞管理以扫描存储库、注册表、CI/CD 管道和运行时环境,并确定阻止或允许哪些软件。 \* #### 在不进行重大更改的情况下修复问题 获取推荐的最少更新以修复直接和可传递依赖项中的漏洞,而不会有破坏关键功能的风险。通过为每个数据包选择精细版本的灵活性,一次修复多个问题。 \* #### 建立软件物料清单 Cortex Cloud 将在存储库中定位依赖项并构建软件物料清单 (SBOM) 和基础架构物料清单 (IBOM),并以标准格式导出。 [![与灵活的修复进行全面集成](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/cortexcloud/sca/GHSCA.png)](#prismastickyimagecomapproach2_prisma-custom-background_prismacustombackgrou_14379965_cleanParsys_software-composition-analysis_cloud_cortex_zh_CN_pan_content_) ### OSS 许可证合规性 不要等到手动合规性审查后才发现开源代码库不符合您的许可证使用要求。Cortex Cloud 对依赖关系的开源许可证进行编目,并可根据可定制的许可证策略提醒或阻止部署: * #### 避免代价高昂的开源许可证违规 尽早提供反馈并阻止基于开源数据包许可证违规的构建行为,为所有常用语言和数据包管理程序提供支持。 \* #### 利用基于标准行业用途的默认策略 开箱即用的策略为通用许可证类型提供了"顽固"的严重性级别,并为非标准许可证类型语言提供了模式匹配,以简化确定可接受用途的过程。 \* #### 创建自定义策略以实施内部合规性要求 基于许可证类型设置规则,以匹配非盈利版权和准许许可证的内部要求。通过 DevOps 工具集成尽早阻止违反策略的行为,企业可避免日后处理许可证不合规问题时的麻烦。 [![OSS 许可证合规性](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/cortexcloud/sca/OSS-License-Compliance-Checkov-Placeholder.png)](#prismastickyimagecomapproach4_prisma-custom-background_prismacustombackgrou_14379965_cleanParsys_software-composition-analysis_cloud_cortex_zh_CN_pan_content_) {#modules} ## 更多应用程序安全功能 ### 基础架构即代码安全 嵌入到开发人员工作流程中的自动化 IaC 安全性 [了解更多](https://www.paloaltonetworks.cn/cortex/cloud/infrastructure-as-code-security?ts=markdown) ### 应用安全态势管理 防止风险影响生产,从源头快速修复问题。 [了解更多](https://www.paloaltonetworks.cn/cortex/cloud/application-security-posture-management?ts=markdown) ### 软件供应链安全 强化您的 CI/CD 管道、减少攻击面并保护您的应用程序开发环境。 [了解更多](https://www.paloaltonetworks.cn/cortex/cloud/software-supply-chain-security?ts=markdown) ### 机密安全 存储库和管道中的全栈、多维机密内容扫描。 [了解更多](https://www.paloaltonetworks.cn/cortex/cloud/secrets-security?ts=markdown) {#footer} ## 产品和服务 * [实时人工智能驱动的网络安全](https://www.paloaltonetworks.cn/network-security?ts=markdown) * [Secure AI by Design](https://www.paloaltonetworks.cn/precision-ai-security/secure-ai-by-design?ts=markdown) * [Prisma AIRS](https://www.paloaltonetworks.cn/prisma/prisma-ai-runtime-security?ts=markdown) * [AI Access Security](https://www.paloaltonetworks.cn/sase/ai-access-security?ts=markdown) * [云交付的安全服务](https://www.paloaltonetworks.cn/network-security/security-subscriptions?ts=markdown) * [高级威胁预防](https://www.paloaltonetworks.cn/network-security/advanced-threat-prevention?ts=markdown) * [Advanced URL Filtering](https://www.paloaltonetworks.cn/network-security/advanced-url-filtering?ts=markdown) * [Advanced WildFire](https://www.paloaltonetworks.cn/network-security/advanced-wildfire?ts=markdown) * [Advanced DNS Security](https://www.paloaltonetworks.cn/network-security/advanced-dns-security?ts=markdown) * [企业数据丢失防护](https://www.paloaltonetworks.cn/sase/enterprise-data-loss-prevention?ts=markdown) * [Enterprise IoT Security](https://www.paloaltonetworks.cn/network-security/enterprise-iot-security?ts=markdown) * [Medical IoT Security](https://www.paloaltonetworks.cn/network-security/medical-iot-security?ts=markdown) * [工业 OT 安全](https://www.paloaltonetworks.cn/network-security/industrial-ot-security?ts=markdown) * [SaaS Security](https://www.paloaltonetworks.cn/sase/saas-security?ts=markdown) * [新一代防火墙](https://www.paloaltonetworks.cn/network-security/next-generation-firewall?ts=markdown) * [硬件防火墙](https://www.paloaltonetworks.cn/network-security/hardware-firewall-innovations?ts=markdown) * [软件防火墙](https://www.paloaltonetworks.cn/network-security/software-firewalls?ts=markdown) * [Strata Cloud Manager](https://www.paloaltonetworks.cn/network-security/strata-cloud-manager?ts=markdown) * [SD-WAN for NGFW](https://www.paloaltonetworks.cn/network-security/sd-wan-subscription?ts=markdown) * [PAN-OS](https://www.paloaltonetworks.cn/network-security/pan-os?ts=markdown) * [Panorama](https://www.paloaltonetworks.cn/network-security/panorama?ts=markdown) * [Secure Access Service Edge](https://www.paloaltonetworks.cn/sase?ts=markdown) * [Prisma SASE](https://www.paloaltonetworks.cn/sase?ts=markdown) * [应用加速](https://www.paloaltonetworks.cn/sase/app-acceleration?ts=markdown) * [自主数字体验管理](https://www.paloaltonetworks.cn/sase/adem?ts=markdown) * [Enterprise DLP](https://www.paloaltonetworks.cn/sase/enterprise-data-loss-prevention?ts=markdown) * [Prisma Access](https://www.paloaltonetworks.cn/sase/access?ts=markdown) * [Prisma Browser](https://www.paloaltonetworks.cn/sase/prisma-browser?ts=markdown) * [Prisma SD-WAN](https://www.paloaltonetworks.cn/sase/sd-wan?ts=markdown) * [远程浏览器隔离](https://www.paloaltonetworks.cn/sase/remote-browser-isolation?ts=markdown) * [SaaS Security](https://www.paloaltonetworks.cn/sase/saas-security?ts=markdown) * [基于 AI 的安全运营平台](https://www.paloaltonetworks.cn/cortex?ts=markdown) * [Cloud Security](https://www.paloaltonetworks.cn/cortex/cloud?ts=markdown) * [Cortex Cloud](https://www.paloaltonetworks.cn/cortex/cloud?ts=markdown) * [Application Security](https://www.paloaltonetworks.cn/cortex/cloud/application-security?ts=markdown) * [云态势安全](https://www.paloaltonetworks.cn/cortex/cloud/cloud-posture-security?ts=markdown) * [Cloud Runtime Security](https://www.paloaltonetworks.cn/cortex/cloud/runtime-security?ts=markdown) * [Prisma Cloud](https://www.paloaltonetworks.cn/prisma/cloud?ts=markdown) * [人工智能驱动的 SOC](https://www.paloaltonetworks.cn/cortex?ts=markdown) * [Cortex XSIAM](https://www.paloaltonetworks.cn/cortex/cortex-xsiam?ts=markdown) * [Cortex XDR](https://www.paloaltonetworks.cn/cortex/cortex-xdr?ts=markdown) * [Cortex XSOAR](https://www.paloaltonetworks.cn/cortex/cortex-xsoar?ts=markdown) * [Cortex Xpanse](https://www.paloaltonetworks.cn/cortex/cortex-xpanse?ts=markdown) * [Unit 42 托管检测和响应](https://www.paloaltonetworks.cn/cortex/managed-detection-and-response?ts=markdown) * [Managed XSIAM](https://www.paloaltonetworks.cn/cortex/managed-xsiam?ts=markdown) * [威胁情报和事件响应服务](https://www.paloaltonetworks.cn/unit42?ts=markdown) * [主动评估](https://www.paloaltonetworks.cn/unit42/assess?ts=markdown) * [事故响应](https://www.paloaltonetworks.cn/unit42/respond?ts=markdown) * [安全策略转型](https://www.paloaltonetworks.cn/unit42/transform?ts=markdown) * [发现威胁情报](https://www.paloaltonetworks.cn/unit42/threat-intelligence-partners?ts=markdown) ## 公司 * [关于我们](https://www.paloaltonetworks.cn/about-us?ts=markdown) * [人才招聘](https://jobs.paloaltonetworks.com/en/) * [联系我们](https://www.paloaltonetworks.cn/company/contact-sales?ts=markdown) * [企业责任](https://www.paloaltonetworks.com/about-us/corporate-responsibility) * [客户](https://www.paloaltonetworks.cn/customers?ts=markdown) * [投资者关系](https://investors.paloaltonetworks.com/) * [位置](https://www.paloaltonetworks.com/about-us/locations) * [新闻资讯](https://www.paloaltonetworks.cn/company/newsroom?ts=markdown) ## 热门链接 * [博客](https://www.paloaltonetworks.com/blog/?lang=zh-hans) * [社区](https://www.paloaltonetworks.com/communities) * [内容库](https://www.paloaltonetworks.cn/resources?ts=markdown) * [网络百科](https://www.paloaltonetworks.com/cyberpedia) * [事件中心](https://events.paloaltonetworks.com/) * [管理电子邮件首选项](https://start.paloaltonetworks.com/preference-center) * [产品清单](https://www.paloaltonetworks.cn/products/products-a-z?ts=markdown) * [产品认证](https://www.paloaltonetworks.com/legal-notices/trust-center/compliance) * [报告漏洞](https://www.paloaltonetworks.com/security-disclosure) * [网站地图](https://www.paloaltonetworks.cn/sitemap?ts=markdown) * [技术文档](https://docs.paloaltonetworks.com/) * [Unit 42](https://unit42.paloaltonetworks.com/) * [请勿出售或分享我的个人信息](https://panwedd.exterro.net/portal/dsar.htm?target=panwedd) ![PAN logo](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/pan-logo-dark.svg) * [隐私](https://www.paloaltonetworks.com/legal-notices/privacy) * [信任中心](https://www.paloaltonetworks.com/legal-notices/trust-center) * [使用条款](https://www.paloaltonetworks.com/legal-notices/terms-of-use) * [文档](https://www.paloaltonetworks.com/legal) 版权所有 © 2025 Palo Alto Networks。保留所有权利 * [![](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/youtube-black.svg)](https://www.youtube.com/user/paloaltonetworks) * [![](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/twitter-x-black.svg)](https://twitter.com/PaloAltoNtwks) * [![](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/facebook-black.svg)](https://www.facebook.com/PaloAltoNetworks/) * [![](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/linkedin-black.svg)](https://www.linkedin.com/company/palo-alto-networks) * [![](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/icons/podcast.svg)](https://unit42.paloaltonetworks.com/unit-42-threat-vector-podcast/) * CN Select your language