32.00 (Build 32.00.159)

The following table outlines the release particulars:

Build	32.00.159
Code name	O’Neal
Release date	December 3, 2023
Type	Major release
SHA-256	39d1f808550f7491dcc63e392b5eb55e8f9068494b4f49c07c71da17433f7396

Review the system requirements to learn about the supported operating systems, hypervisors, runtimes, tools, and orchestrators.

Upgrade from Previous Releases

Upgrade Defender Versions 22.12 and Earlier

With the v32.00 release, Defender versions supported (n, n-1, and n-2) are v32.00, v31.00, and v30.00.

To prepare for this update, you must upgrade your Defenders from version v22.12 (Lagrange) or earlier to a later version. Failure to upgrade Defenders will result in disconnection of any Defender version below v30.00 such as v22.12.

Upgrade the Prisma Cloud Console

With the v32.00 release, the supported Console versions (n, n-1, and n-2) are v32.00, v31.00, and v30.00.

You can upgrade the Prisma Cloud console directly from any version for n-1 to n. With v30.00 as n-1 and v31.00 as n, you can for example go directly from v30.01.153 to v31.00.129.

You have to upgrade any version of v22.00 to v30.00 before upgrading to v31.00. For example, you can upgrade from v22.12.693 to v30.02.123 and then upgrade to v32.00.159.

Enhancements

Added the Agentless Scanning Report

The agentless scanning report is now available under Runtime Security > Cloud Accounts. This report provides you with complete visibility of all hosts in your cloud account at the account and regional level. It includes clear reporting of each host, the corresponding scan status, and further details.

Added the Ability to Scan all Supported Binaries

Agentless malware scanning detects all supported binaries and shared libraries on both Linux and Windows operating systems. For example, malicious ELF files on Windows machines are now detected.

API Changes and New APIs

Addressed Issues

• Fixed an issue with agentless scanning that in some conditions failed scanning encrypted volumes when using hub mode in AWS.
• In v31.02.133, the new 81 out-of-box admission control rules in Rego were not available by default. This is now fixed. With the v32.00 Console, you now get all the 81 OOB admission control rules.
• Fixed an issue where "sourceType" field was missing for Splunk alert messages. Users can now add "sourceType" field to the custom alert JSON of Splunk and prisma cloud will define the external field based on the custom one.
• Fixed an issue where the progress bar while scanning deployed images was not reported correctly.
• Fixed an issue where Nuget vulnerabilities of same the package with different path appear with the same path.
• Custom rule names are now populated for runtime custom rule incidents. Also, labels are reported for when the incident occurred in a Kubernetes cluster.

End of Support Notifications

Ended Support for Cloud Native Network Segmentation (CNNS)

The ability to create CNNS policies that Defenders use to limit traffic from containers and hosts is being removed. The configuration settings on the console (Runtime Security > Defend > CNNS) and the corresponding APIs for CNNS are removed in v32.00.159. Radar has a container and a host view, where you can view the network topology for your containerized apps and hosts respectively, and this continues to be available.

Deprecation Notices

Deprecated the aggregated and rest fields

The aggregated and rest macros from the webhook custom JSON alerts are being deprecated and replaced by AggregatedAlerts and Dropped macros respectively.

Deprecated AccountID macro from the Alerts payload

The AccountID macro in the Alerts payload is deprecated and replaced by the AccountIDs macro.