model-security scan \
--security-group-uuid "12345678-1234-1234-1234-123456789012" \
--model-uri "<model_uri>" \
--model-name "production-classifier" \
--model-author "ml-team" \
--model-version "v2.1" \
-l env=production
Scan using Python SDK
from model_security_client.api import ModelSecurityAPIClient
# Initialize the client
client = ModelSecurityAPIClient(
base_url="https://api.sase.paloaltonetworks.com/aims"
)
result = client.scan(
security_group_uuid="12345678-1234-1234-1234-123456789012",
model_uri="<model_uri>",
model_name="production-classifier",
model_author="ml-team",
model_version="v2.1",
labels={ "env": "production" }
)
The model_uri parameter must use the format of supported cloud
storage platforms:
- Amazon S3 (s3://)
- Google Cloud Storage (gs://)
- Azure Blob Storage
(https://[account].blob.core.windows.net/)
- JFrog Artifactory (https://[instance].jfrog.io/)
- GitLab Model Registry
(https://[gitlab-instance]/-/ml/models/)
The CLI shows scan results in real-time as they finish. Each scan tests the model
against all active rules in your Security Group. The output shows whether the model
passes or fails based on your rule configuration.
A model fails if any blocking rule detects a violation. Non-blocking rules record
findings without preventing the model from being approved.
