> For the complete documentation index, see [llms.txt](https://docs.prismacloud.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.prismacloud.io/admin-guide/33/install/deploy-defender.md).

# Deploy the Prisma Cloud Defender

To take advantage of the agent-based security features of Prisma Cloud, you must deploy the Defender agent.

You can deploy single Defenders for containers, hosts, and serverless functions or deploy Defenders on entire clusters using an orchestrator. There are several [Defender types](/admin-guide/33/install/deploy-defender/defender-types.md) based on the assets they protect and how you wish to deploy them.

## Defender capabilities

The following table summarizes the key functional differences between Defender types.

| Capabilities                 | Defender type           |               |            |               |               |
| ---------------------------- | ----------------------- | ------------- | ---------- | ------------- | ------------- |
|                              | Container<sup>1</sup>   | Host          | Serverless | App-Embedded  |               |
| **Deployment methods**       | **Console UI**          | Y             | Y          | Y             | Y             |
| **API**                      | Y                       | Y             | Y          | Y             |               |
| **twistcli**                 | Y                       |               |            | Y             |               |
| **Vulnerability management** |                         | Y             | Y          | Y<sup>2</sup> | Y<sup>3</sup> |
| **Compliance**               |                         | Y             | Y          | Y<sup>2</sup> | Y<sup>4</sup> |
| **Runtime defense**          | **Behavioral modeling** | Y             |            |               |               |
| **Process**                  | Y                       | Y             | Y          | Y             |               |
| **Networking**               | Y                       | Y             | Y          | Y             |               |
| **File system**              | Y                       | Y             | Y          | Y             |               |
| **Forensics**                | Y                       | Y             |            | Y             |               |
| **Access control**           | **Kubernetes auditing** | Y<sup>5</sup> |            |               | Y<sup>5</sup> |
| **Admission control**        | Y                       |               |            |               |               |
| **Firewalls**                | **WAAS**                | Y             | Y          | Y             | Y             |
| **Radar (visualization)**    | **Radar**               | Y             | Y          | Y             |               |

<sup>1</sup> Container Defender supports all Host Defender capabilities. You can deploy single container and host Defenders or deploy container and host Defenders using an [orchestrator](https://github.com/PaloAltoNetworks/pc-docs-md/tree/main/compute-edition/33/admin-guide/install/deploy-defender/orchestrator/orchestrator.md).

<sup>2</sup> Normally Defender scans workloads for vulnerabilities and compliance issues. For serverless functions, Console does the scanning. In the Console, create a configuration that points to your repository of functions in your cloud provider.

<sup>3</sup> Vulnerability management for deployed images only. Registry scanning by app-embedded Defenders is not supported.

<sup>4</sup> Image compliance and custom compliance checks only. The trusted images feature isn’t supported.

<sup>5</sup> Kubernetes auditing is done by the Console, and not by the Defenders. In the Console, enable Kubernetes auditing and create a configuration that points to your cluster.

## Connectivity Requirements

Defender must be able to communicate with Prisma Cloud over the network because it pulls policies down and sends data (alerts, events, etc) back to the Prisma Cloud console.

If you are using a certificate authority through a proxy, add the `--proxy-cacert` flag to the curl command [as described in the curl documentation](https://curl.se/docs/manpage.html#--proxy-cacert).

### URL Whitelisting

When Defenders are behind a proxy or firewall, ensure the following URLs are whitelisted to allow proper communication:

* **Console URL**: Ensure Defenders can access the Prisma Cloud Console URL.
* **API Endpoint**: For SaaS consoles (not applicable to self-hosted versions), allow Defenders to connect to the API endpoint URL.

  API endpoint URL format: `api.<region>.prismacloud.io`. Replace `<region>` with the Prisma Cloud instance location. For example, `sg` for Singapore or `us` for the United States.
* **WildFire Service**: If the WildFire service is enabled, allow Defenders to connect to \*.wildfire.paloaltonetworks.com or the relevant [regional WildFire URLs](/admin-guide/33/configure/wildfire.md).


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.prismacloud.io/admin-guide/33/install/deploy-defender.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.