> For the complete documentation index, see [llms.txt](https://docs.prismacloud.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.prismacloud.io/admin-guide/32/install/deploy-defender/orchestrator/install-tas-defender.md).

# VMware Tanzu Application Service (TAS) Defender

Prisma Cloud deploys the Defender on the VMware Tanzu Application Service (TAS) as add-on software, which works similarly to a Daemon set in Kubernetes. This approach co-locates the Defender on every Diego cell VM. The "Prisma Cloud for TAS" tile in the Tanzu Ops Manager allows you to configure the Defender across your TAS environment. When you deploy full coverage Defenders for TAS, they perform blobstore scanning alongside compliance, vulnerability, and runtime protection. If you have a large-scale environment, you can choose to deploy blobstore scanning Defenders as dedicated VMs that focus exclusively on scanning your blobstores.

Tanzu Application Service (TAS) Defender supports the following functions:

* Vulnerability scanning for running apps.
* Vulnerability and compliance scanning for the underlying Diego cell hosts.
* Blobstore scanning for Linux droplets.
* Runtime protection: Linux TAS Defenders support runtime protection for process, networking, and file system. Windows TAS Defenders support runtime protection for process.

The Prisma Cloud Console lets you deploy Defender to multiple TAS environments. TAS Defender supports the prevent action because it doesn’t require controlling the app lifecycle. The TAS Defenders don’t support the block action for runtime rules, vulnerability rules, and compliance rules because the Defenders cannot block running apps. The TAS framework controls the app lifecycle, including stopping the containers as required by the block action.

## Install the TAS Defender

1. Get the Prisma Cloud tile.
   1. Log in to the Prisma Cloud console.
   2. Select **Manage > Defender > Deployed Defenders**.
   3. Click **Manual deploy**.
   4. Select the **Orchestrator** deployment method.
   5. Under **Orchestrator type**, select one of the following options:
      * Tanzu Application Service Defender - Linux
      * Tanzu Application Service Defender - Windows
   6. On the sidebar, click the **Download** button to get the TAS tile.

      Alternatively, you can download the **VMWare Tanzu tile** from under **Manage > System > Utilities**.
2. Import the Prisma Cloud tile.
   1. Go to the **Tanzu Ops Manager > Installation Dashboard**.
   2. Click the **Import a Product** button.
   3. Select the downloaded tile.
   4. On the left sidebar, the Prisma Cloud for TAS appears.
   5. Click the **plus sign** beside the version number to stage the tile.
   6. Click the tile that was added.
3. Configure the Defenders.
   1. Return to the Prisma Cloud Console.
   2. Under **The name that Defender will use to connect to this Console**, select the IP address or URL that your TAS environment can reach.
   3. If you selected the **Tanzu Application Service Defender - Windows** as the **Orchestrator type**, enable or disable **Runtime protection**.
   4. Enable the **Assign globally unique names to Hosts** in the **Advanced Settings** as needed.
   5. Copy the installation scripts from the sidebar. You can deploy Prisma Cloud Defenders on Linux and Windows.
4. Configure the Prisma Cloud tile.
   1. Return to the Tanzu Ops Manager.
   2. Under **Assign AZs and Networks**, select the **TAS network** and select **Save**.
   3. Under **Prisma Cloud Component Configuration**, paste the installation scripts for the operating systems you are using.

      If you don’t provide an installation script, Tanzu doesn’t deploy Defenders for that operating system.

      Enter a **Foundation** name (optional). If you don’t enter a Foundation name, you will not be able to use **tas-foundation** label in **Manage > Collections**.

      Select **Save**.
   4. Under **Prisma Cloud Proxy configuration**, configure your Proxy as needed if you are using Linux.

      Select **Save**.

      The Defender on Windows doesn’t support a proxy.
   5. Under **Credentials**, provide your Prisma Cloud credentials for Linux and Windows. Select **Save**. You can use certificates for authentication if you only use Linux. Provide your username and password credentials instead to authenticate the Defender if you use Windows Defenders by themselves or together with Linux Defenders.
   6. Under **Resource configuration**, you can add dedicated Linux VMs to serve exclusively as Linux blobstore scanners. Select **Save**.
   7. Go back to the **Installation Dashboard**.
   8. Click Review Pending Changes.
   9. Select the following products.
      * Prisma Cloud for TAS
      * VMWare Tanzu Application Service
      * Every TAS Isolation segment in your environment.
   10. Apply the changes and wait for the tile to become active.

       It can take an hour or longer for the changes to apply and your deployment to complete.
5. Verify the deployment on Prisma Cloud under **Manage > Defenders**.

   After the deployment is complete, the deployed Defenders will appear in the table. The **Host** column shows **Agent ID** of the defended Linux Diego cells and **VM CID** of the defended Windows Diego cells.

   You can search and filter your TAS Defenders based on the hostnames.

   1. To fetch the **Agent ID** of your Diego cells:
      1. Log into a Diego cell.
      2. The `/var/vcap/instance/dns/records.json` file shows how the **Agent ID** maps to a host IP address.
   2. To fetch the **VM CID** of your Diego cells, run `bosh vms` in the **ops-manager** VM.

## Deploy Blobstore Scanners for TAS

Prisma Cloud for TAS can perform blobstore scanning on Linux VMs. Defenders deployed as dedicated blobstore scanners still scan the host where they run for vulnerabilities, compliance issues, and runtime protection. Prisma Cloud periodically discovers and scans the droplets in your blobstores for vulnerabilities using pattern matching.

1. Go to the **Tanzu Ops Manager > Installation Dashboard**.
2. Click the **Prisma Cloud for TAS** tile.
3. Under **Prisma Cloud Component Configuration**, paste the Linux installation script. If you don’t provide an installation script, Tanzu doesn’t deploy Defenders.

   If you are deploying only TAS Linux blobstore scanners you can unselect the **Install TAS Defender on all Linux Diego cells in the cluster** checkbox.

   Select **Save**.
4. Go to **Resource Configuration**.

   Specify the number of instances of blobstore scanners you want in your environment.
5. Select the **VM TYPE**.
6. Select the **PERSISTENT DISK TYPE**.
7. Provide any load balancing configuration needed.
8. Select whether an internet connection is allowed by the Blobstore scanner VM.

   Select **Save**.
9. Under **Assign AZs and Networks**, select the TAS network and specify the preferred AZs for placing the blobstore scanners.

   Select **Save**.
10. Return to the **Installation Dashboard**.
11. Click **Review Pending Changes**, and select **Prisma Cloud for TAS**.

    Apply the changes. Wait for Tanzu to finish deploying the Defenders. This process can take a long time.
12. Configure Prisma Cloud to [scan a blobstore](/admin-guide/32/vulnerability-management/vmware-tanzu-blobstore.md).


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.prismacloud.io/admin-guide/32/install/deploy-defender/orchestrator/install-tas-defender.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.