Repository: bridgecrewio/checkov

Issue:
Prisma Policy Labels not working
**Description**

At the company I work at we are using Checkov together with Prisma Cloud Code Security, and I'm having trouble using the policy labels in Prisma to filter checks.

On Prisma's side, I've added a label to the "Default namespace is used" policy check called "mikko-testaa".
![image](https://user-images.githubusercontent.com/35505856/188586726-f6b34b89-58fd-425a-8927-954af6fe7222.png)

Filtering on Prisma via this label works, as it only shows the namespace policy check.
![image](https://user-images.githubusercontent.com/35505856/188586865-2bcbec64-178f-46df-92d8-45025864267b.png)

**Execution and Results**

With that in mind these are the checkov commands that I used both locally and on Jenkins;
checkov -d . --framework helm -o json --output-file-path . --prisma-api-url [PRISMAURL] --bc-api-key [PRISMAUSER::PRISMAKEY]] --policy-metadata-filter policy.label=mikko-testaa

I tried running as-is and also running via a config file, both returning the same result;
![image](https://user-images.githubusercontent.com/35505856/188587531-7377bffb-65e6-4f8c-8518-4dccbb18672e.png)

Have I misunderstood the policy-metadata-filter parameter? What am I doing wrong?

**Version**
Checkov version 2.1.179


Discussion:
The fact that the Available options: shows empty makes me think there is something wrong with getting policies from prisma?
Hey @MikkoMyllyniemi I haven't been able to reproduce this issue. I applied a similar label to the poicy and it worked as expected. 
```
❯ ckv -l --policy-metadata-filter policy.label=kartik-test --bc-api-key "$PC_ACCESS_KEY::$PC_SECRET_KEY"
|    | Id         | Type     | Entity                            | Policy                    | IaC       |
|----|------------|----------|-----------------------------------|---------------------------|-----------|
|  0 | CKV_K8S_21 | resource | kubernetes_config_map             | Default namespace is used | Terraform |
|  1 | CKV_K8S_21 | resource | kubernetes_cron_job               | Default namespace is used | Terraform |
|  2 | CKV_K8S_21 | resource | kubernetes_daemonset              | Default namespace is used | Terraform |
|  3 | CKV_K8S_21 | resource | kubernetes_deployment             | Default namespace is used | Terraform |
|  4 | CKV_K8S_21 | resource | kubernetes_ingress                | Default namespace is used | Terraform |
|  5 | CKV_K8S_21 | resource | kubernetes_job                    | Default namespace is used | Terraform |
|  6 | CKV_K8S_21 | resource | kubernetes_pod                    | Default namespace is used | Terraform |
|  7 | CKV_K8S_21 | resource | kubernetes_replication_controller | Default namespace is used | Terraform |
|  8 | CKV_K8S_21 | resource | kubernetes_role_binding           | Default namespace is used | Terraform |
|  9 | CKV_K8S_21 | resource | kubernetes_secret                 | Default namespace is used | Terraform |
| 10 | CKV_K8S_21 | resource | kubernetes_service                | Default namespace is used | Terraform |
| 11 | CKV_K8S_21 | resource | kubernetes_service_account        | Default namespace is used | Terraform |
| 12 | CKV_K8S_21 | resource | kubernetes_stateful_set           | Default namespace is used | Terraform |


---
```

Can you please share debug logs? You can enable debug logging by setting the env var `LOG_LEVEL=DEBUG`. Please be sure to redact any sensitive data from the logs. 
Never mind, I found the issue. It appears that  `GET https://api.prismacloud.io/filter/policy/suggest` returns only "recently used" filters and therefore a new label may or may not be returned. I'll fix this to use this method instead https://prisma.pan.dev/api/cloud/cspm/policy#operation/get-policy-filter-options

Resolving patch:
diff --git a/checkov/common/bridgecrew/platform_integration.py b/checkov/common/bridgecrew/platform_integration.py
--- a/checkov/common/bridgecrew/platform_integration.py
+++ b/checkov/common/bridgecrew/platform_integration.py
@@ -630,6 +630,7 @@ def get_prisma_policy_filters(self) -> Dict[str, Dict[str, Any]]:
             logging.debug(f'Prisma filter URL: {self.prisma_policy_filters_url}')
             request = self.http.request("GET", self.prisma_policy_filters_url, headers=headers)  # type:ignore[no-untyped-call]
             policy_filters: dict[str, dict[str, Any]] = json.loads(request.data.decode("utf8"))
+            logging.debug(f'Prisma filter suggestion response: {policy_filters}')
             return policy_filters
         except Exception:
             logging.warning(f"Failed to get prisma build policy metadata from {self.platform_run_config_url}", exc_info=True)
@@ -637,6 +638,9 @@ def get_prisma_policy_filters(self) -> Dict[str, Dict[str, Any]]:
 
     @staticmethod
     def is_valid_policy_filter(policy_filter: dict[str, str], valid_filters: dict[str, dict[str, Any]] | None = None) -> bool:
+        """
+        Validates only the filter names
+        """
         valid_filters = valid_filters or {}
 
         if not policy_filter:
@@ -646,10 +650,7 @@ def is_valid_policy_filter(policy_filter: dict[str, str], valid_filters: dict[st
         for filter_name, filter_value in policy_filter.items():
             if filter_name not in valid_filters.keys():
                 logging.warning(f"Invalid filter name: {filter_name}")
-                return False
-            elif filter_value not in valid_filters[filter_name].get('options', []):
-                logging.warning(f"Invalid filter value: {filter_value}")
-                logging.warning(f"Available options: {valid_filters[filter_name].get('options')}")
+                logging.warning(f"Available filter names: {', '.join(valid_filters.keys())}")
                 return False
             elif filter_name == 'policy.subtype' and filter_value != 'build':
                 logging.warning(f"Filter value not allowed: {filter_value}")


Test patch:
diff --git a/tests/common/test_platform_integration.py b/tests/common/test_platform_integration.py
--- a/tests/common/test_platform_integration.py
+++ b/tests/common/test_platform_integration.py
@@ -151,8 +151,6 @@ def test_is_valid_policy_filter(self):
                                                         valid_filters=mock_prisma_policy_filter_response()))
         self.assertFalse(instance.is_valid_policy_filter(policy_filter={'policy.label': 'CODE', 'not': 'allowed'},
                                                         valid_filters=mock_prisma_policy_filter_response()))
-        self.assertFalse(instance.is_valid_policy_filter(policy_filter={'policy.label': ['A', 'B']},
-                                                         valid_filters=mock_prisma_policy_filter_response()))
         self.assertFalse(instance.is_valid_policy_filter(policy_filter={},
                                                          valid_filters=mock_prisma_policy_filter_response()))
         self.assertFalse(instance.is_valid_policy_filter(policy_filter={'policy.label': ['A', 'B']}, valid_filters={}))