Onboard OCI Accounts

1. Create an OCI compartment to run the needed instances in OCI that perform the agentless scanning.
2. Create a new OCI user for Prisma Cloud to access OCI.
3. Create an API key in OCI for the new user.
4. Configure the Prisma Cloud console to access the OCI resources.
5. Apply the needed permissions in OCI.
6. Start an agentless scan.

Create an OCI Compartment

1. Go to the Oracle Cloud console.

   
2. In the menu, go to Identity & Security > Compartments.

   
3. Click Create Compartment.

   
4. Enter a name and a description for the compartment.

   
5. Click Create Compartment.

   To scan all resources across all regions, you must create the resources for the different regions in the compartment. Make sure to create all needed resources with the same name in all regions.

Create a New OCI User

1. In the menu, go to Identity & Security > Users.

   
2. Click Create User.

   
3. Select IAM User.
4. Enter a Name and a Description for the user.

   
5. Click Create.

   

Create an API Access Key

1. On the user page, go to Resources > API Key.

   
2. Select Generate API Key Pair.

   
3. Click Download Private Key.

   
4. Click Add.

   
5. The Configuration File Preview opens.

   

   1. Copy the key-value pair for user into a text file.
   2. Copy the key-value pair for fingerprint into a text file.
   3. Copy the key-value pair for tenancy into a text file.

      
   4. Save the text file.
6. Click Close.

   

Configure Agentless Scanning

Apply the Permissions in OCI

1. Go to the Oracle Cloud console.

   
2. Click on the terminal icon on the right hand corner and select Cloud Shell.

   
3. Click the gear icon on the shell, and select Upload File.

   
4. Select the pcc-apply-permissions.sh permission template you downloaded from the Prisma Cloud Console.
5. Make the file executable with the following command.
6. Apply the permissions with the following command. Replace <OCI-Compartment> with the name of the created compartment.
7. Verify that the changed statements for the policy are correct and enter y to continue.
8. Enter y to dismiss the warning about tags.
9. Once the permissions are applied, you have an OCI user with the needed permissions.

Agentless Scanning for Cloud Accounts

• During Onboarding: When cloud accounts are onboarded to Prisma Cloud with the "Agentless Scanning" option enabled, scanning starts immediately. This provides instant visibility into the vulnerabilities and configurations risks for the account. If this option is disabled before onboarding, Prisma Cloud does not scan the workloads in the account. The account remains unscanned until agentless scanning is enabled.

  To modify the scan settings, see Edit Agentless Scan Settings.
• For existing accounts: Enabling agentless scanning for existing accounts in Prisma Cloud does not initiate an immediate scan. Instead, these accounts are added to the next scheduled scan cycle, which occurs every 24 hours by default. This ensures that scans are conducted systematically according to the scan cycle, rather than starting immediately upon enabling.

  To modify the scan cycle, see Modify the Agentless Scan Interval.

Account Origin Filter

• Local accounts – Accounts created in Runtime Security only (not present in the Prisma Cloud console).
• Manually imported accounts – Accounts manually imported from the Prisma Cloud console to Runtime Security before the Lagrange release (end of 2022).
• Auto-imported accounts – Accounts that originated in the Prisma Cloud console and were automatically imported into Runtime Security.

Edit Agentless Scan Settings

1. Go to Runtime Security > Manage > Cloud accounts.
2. Select Edit Account icon from the Actions column for the account.
3. In Account and Agentless setup, go to Agentless scanning section.
4. Modify the agentless configuration options in this section.
5. Select Save.

Modify the Agentless Scan Interval

1. Go to Runtime Security > Manage > System.
2. Select the Scan tab.
3. In the Scheduling section, in Agentless box, type the new duration for the scan cycle.
4. Select Save

   

Manually Start Agentless Scanning

1. Go to Runtime Security > Manage > Cloud accounts.
2. In the Scan in your environment section, select Start Agentless scan.

   

   Note: Scanning starts for all the accounts that have the agentless scanning option enabled.
3. Select the Scan icon in the top-right corner of the console to view the scan status.
4. To view the results, complete the following steps.

   1. Go to Runtime Security > Monitor > Vulnerabilities > Hosts or Runtime Security > Monitor > Vulnerabilities > Images.
   2. Select Filter hosts.

      
   3. Select the Scanned by filter.

      
   4. Select the Agentless filter.