:topic_type: task

[.task]

== Connect Bitbucket Server  

Integrate Prisma Cloud with your Bitbucket Server to gain visibility into, and monitor the systems, technologies, configurations, and pipelines that make up the Bitbucket Server platform.
This integration enables security scans to identify Infrastructure-as-Code (IaC) misconfigurations, Software Composition Analysis (SCA) vulnerabilities, exposed secrets, license mis-compliance and CI/CD pipeline risks in your Bitbucket environment, allowing you to understand and fix issues as soon as they are detected, resulting in an enhanced security posture for your organization.

NOTE: Integrating with Bitbucket Server extends support for Bitbucket Data Center and Server versions 6.7 and later.

[.procedure]

. Before you begin.
.. Add the Prisma Cloud IP addresses and hostname for Application Security to an xref:../../../../get-started/console-prerequisites.adoc[allow list] to enable access to the Prisma Cloud Console. 
.. Ensure that the provided hostname or IP address is resolvable on public DNS servers.
.. Grant *Administrator* permissions in the relevant Bitbucket organization to the Prisma user integrating Prisma Cloud with Bitbucket.

. On the Prisma Cloud Application Security console.
.. Select *Settings* > *Connect Provider* > *Code & Build Providers*.
+
image::application-security/connect-provider-menu.png[]

.. Select *Bitbucket Server* (under Code Repositories) in the catalog that is displayed.
+
image::application-security/connect-provider.png[]
+
The *Configure Domain* step of the installation wizard (wizard) is displayed.

.. Paste the URL of your Bitbucket Server repository into the provided field > *Register*.
+
NOTE: The *Base URL* must include the *"HTTPS://"* prefix.

. Create and copy a Personal Access Token (PAT) on Bitbucket Server.
.. Access *Bitbucket Server* > *Manage account* > *Account settings* > *Personal access tokens*.
.. Provide a *Token name*.
.. Select the *Permissions* scope.
+
* For Projects: *Read* permissions
* For Repositories: *Administrator* permissions
+
Providing read and write permissions to the necessary repositories enables Prisma Cloud to copy files for scanning, and access repository settings. This, in turn, facilitates the ability to subscribe to pull request (PR) webhooks, allowing for the initiation of fix PRs and comments on open PRs.
+
NOTE: By default,the permissions of the access token are set according to your current access level. It is essential to define two levels of permissions, *Project* and *Repository* permissions. The Repository permissions inherit from Project permissions, requiring Repository permissions to match or exceed Project permissions.

.. Select the *Expire automatically* option.
+
NOTE: For additional security, it is recommended to set an expiry automatically. The expiry date of a token cannot be changed after it is created. You can see the expiry dates for all your tokens on *Profile picture* > *Manage account* > *Personal access tokens*.

.. Select *Create*.
.. Copy the generated token from the dialog.
+
NOTE: See the https://confluence.atlassian.com/bitbucketserver072/personal-access-tokens-1005335924.html[Bitbucket] documentation on how to create a PAT.

. Paste the Bitbucket PAT generated in _step 3_ above in the provided field of the *Create Personal Access Token* step of the wizard > *Register*.
+
The *Select Repositories* step of the wizard is displayed.

. Select which repositories will be scanned. 
+
* *Permit all existing repositories* 
* *Permit all existing and future repositories*.  This is the recommended option to ensure complete coverage and successful operation of all features 
* *Choose from repository list* > Select repositories
The selected repositories associated with the PAT will be scanned

. Select *Next* > *Done* in the *Status* step of the wizard to complete the integration.

. Verify integration.
.. In *Application Security*, select *Home* > *Settings* > *Code & Build Providers*.
.. Confirm that the status of the integrated *Bitbucket Server* repositories displays *Connected* under *Status*.
+
NOTE: It may take up to 3 minutes for the integration status to be updated.

. Next step: Monitor and manage scan results.
+
* View your selected Bitbucket Server repositories on the *Repositories* page. The next Bitbucket Server scan will include these repositories
* To view scan results and resolve issues, in *Application Security* select *Home* > *Projects*. See xref:../../../risk-management/monitor-and-manage-code-build/monitor-and-manage-code-build.adoc[Monitor and Manage Code Build Issues] for more information