Ctrlk
BlogSupport
For the complete documentation index, see llms.txt. This page is also available as Markdown.

34.00 (Build 34.00.141)

The following table outlines the release particulars:

Build

34.00.141

Code name

Quinn

Release date

March 30, 2025

Type

Major release

SHA-256

93f2fb04aa192a5218ae2fb9391c123b34456b0928aed7baec0c8b404ea67149

Review the system requirements to learn about the supported operating systems, hypervisors, runtimes, tools, and orchestrators.

Upgrade from Previous Releases

Upgrade Defenders

With the v34.00 release, the supported Defender releases (n, n-1, and n-2) are v34, v33, and v32 respectively. In addition, Prisma Cloud will not restrict the usage of Defender versions or REST API calls from the n-3 releases. So the current release will allow Defenders and REST API calls from release v31 also. Failure to upgrade Defenders below release v31, such as v30.03, will result in disconnection of the Defenders from the Console.

However, to maintain full support, you must upgrade your Defenders to a v32.00 or a higher release.

To summarize, the level of support for the different versions of Defenders is as follows:

  • Defender versions 34.xx, 33.xx, and 32.xx have full support

  • Defender versions 31.xx are functional (will be able to connect to version 34.00 Console) but support is not available for such Defenders

  • Defender versions previous to 31.00, such as 30.03, are neither supported nor functional (cannot connect to version 34.xx Console)

Upgrade the Prisma Cloud Console

With the v34.00 release, the supported Console releases (n, n-1, and n-2) are v34, v33, and v32 respectively.

Defenders from the n-3 release will remain functional as described above.

You can upgrade the Prisma Cloud console directly from any n-1 or n-2 version to n. For example, with v34 as n and v33 as n-1, you can upgrade directly from 33.01.137 to 34.00.141. You can also upgrade directly from an n-2 version (32.00.161, 32.01.128, 32.02.127, 32.03.123, 32.04.113, 32.05.124, 32.06.113, 32.07.123) to 34.00.141.

Enhancements

Feature

Description

Cloud Discovery Enhancements

  1. Azure Container Instances (ACI): Cloud Discovery now includes data for all containers in container groups. Previously, data for only the first container was included.

  2. Identify Account ID attribution for app-embedded defenders used for defending CaaS assets: The Account ID was previously available for ECS Fargate and Google Cloud Run. This release adds the support for displaying the Account ID for ACI as well. With this release:

    1. ECS Fargate and GCP Cloud Run: the Account ID was already shown for: i) Fargate defenders; and ii) App-embedded defenders installed on GCP Cloud Run.

    2. Azure Container Instances (ACI): In this release, Account ID is shown for app-embedded defenders installed on ACI containers after you perform the following steps for each container:

      1. Upgrade the defender to the 34.00 (Quinn) release.

      2. Create a managed identity.

      3. Assign the Reader role to the newly created managed identity.

      4. Assign the newly created managed identity to the container group.

Jira Authentication Update for Prisma Cloud Runtime Alerts

Jira Cloud has deprecated Basic Authentication with passwords and now requires API tokens for authentication. When integrating Prisma Cloud Runtime with Jira as an alert provider, you must use an API token instead of a username-password combination.

Required Actions

To set up a new alert profile for Jira Cloud users, do the following:

  1. Generate an API token from your Jira Cloud account.

    For more information, see Manage API tokens for your Atlassian account topic in Jira Documentation site.

  2. Save the token in Prisma Cloud’s Credentials Store and use this new credential when adding a new Jira Alert profile.

    For more information, see Adding Jira Cloud Credentials topic in the Prisma Cloud Admin Guide.

To update an existing alert profile for Jira Cloud users, do the following:

  1. Generate an API token from your Jira Cloud account.

    For more information, see Manage API tokens for your Atlassian account topic in the Jira Documentation site.

  2. Update the credentials by replacing the password with the API token.

    For more information, see Updating Jira Cloud Credentials topic in the Prisma Cloud Admin Guide.

To set Up a new alert profile for Jira Data Center (DC) users, do the following:

  1. Generate a personal access token from your Jira DC account.

    For more information, see Using Personal Access Tokens topic in the Jira Documentation site.

  2. Configure the credentials using Basic Authentication with your username and the personal access token as the password when adding a new Jira Alert profile. For more information, see Adding Jira DC Credentials topic in the Prisma Cloud Admin Guide.

Customization for Scanning Amazon Machine Images (AMIs)

Prisma Cloud now offers on-prem users greater flexibility in selecting AMIs.

For on-prem users, the following environment variables enable customization:

  • AGENTLESS_USE_CUSTOM_AMI – Enables or disables the use of custom AMIs.

  • AGENTLESS_CUSTOM_AMI_PER_REGION – Specifies custom AMIs per AWS region

Example Configuration:

AGENTLESS_USE_CUSTOM_AMI=true AGENTLESS_CUSTOM_AMI_PER_REGION='{"us-east-1":"ami-005fc0f236362e99f"}'

In this example, the custom AMI (ami-005fc0f236362e99f) is used in the 'us-east-1' region.

Behavior Based on Configuration:

  • If AGENTLESS_USE_CUSTOM_AMI is false, Prisma Cloud falls back to the previous scanner image, which is Ubuntu 20.04.

  • If AGENTLESS_USE_CUSTOM_AMI is set to true but AGENTLESS_CUSTOM_AMI_PER_REGION is not set, Prisma Cloud uses the LaunchDarkly (LD) custom AMI list.

  • If AGENTLESS_USE_CUSTOM_AMI is not set, Prisma Cloud defaults to the LD custom AMI list.

  • For Cloud (SaaS) users, no action is required—Prisma Cloud automatically selects the latest optimized AMI.

Better utilization of vendor-specific feeds

The National Vulnerability Database (NVD) provides a valuable baseline CVSS score for vulnerabilities. However, vendors often have a more granular understanding of how a specific vulnerability impacts their implementation of a component. This allows them to provide a more accurate CVSS score, especially when considering environmental factors and the specific ways their product utilizes the vulnerable component. In some cases, vendor-specific vulnerability feeds may have the latest CVSS scores before they are reflected in NVD.

This release leverages additional data from vendor-specific vulnerability feeds, such as those from RedHat, Photon OS, and Ruby Gems, and implements several improvements in the extraction and reporting of CVSS scores. These changes provide more accurate and timely CVSS scores, reflecting the latest vendor-specific mitigations, configurations, and environmental impacts.

RedHat Security Feed:

  • Previously, if a CVE had a CVSS score of 0 in the RedHat security feed, we used the CVSS score provided by NVD for that CVE.

  • Now, we use the CVE data and the CVSS score provided by the RedHat feed even if the CVSS score is 0 in the RedHat feed. This ensures that we consider RedHat’s specific assessment, which might indicate a mitigated or non-impactful vulnerability in their context.

Photon OS Security Feed:

  • Previously, we extracted CVSS scores for CVEs from the NVD for Photon OS vulnerabilities.

  • Now, we use the CVSS scores provided in the Photon OS security feed. This allows us to reflect Photon OS-specific mitigations and impacts more accurately.

Ruby Gems Security Feed:

Amazon Linux Security Feed:

  • Previously, we extracted CVSS scores for Amazon Linux vulnerabilities/CVEs from the NVD.

  • Now, we use the CVSS scores provided in the Amazon Linux security feed. This allows us to reflect Amazon Linux-specific mitigations and impacts more accurately.

Fallback to NVD CVSS Scores

If the vendor feed does not provide a CVSS value for any CVE, then the CVSS value from the NVD will be used. This ensures that we always have a CVSS score to guide our risk assessment and mitigation efforts.

A new Description field in the Create New User screen

A Description field is added to the Create New User screen (Manage > Authentication > Users), allowing additional details to be included for each user.

This field will also be visible in the Users table, which will enable you to refine searches based on the description.

Feature

Description

Removal of Stale Hosts and Images

We’re implementing a fix that will remove outdated assets that are no longer protected by a Defender. These assets should have been automatically deleted previously, but were not. With this update, you might notice that certain stale assets are no longer present in your inventory. As a result, you might also see a reduction in vulnerabilities and compliance findings due to their removal.

System Requirements: Changes to supported systems and platforms

The following changes have been made to the system requirements:

Support added for WAAS

  1. WAAS with Defender (AWS): Node.js 22

  2. WAAS with Defender (AWS): Python 3.13

Support removed for WAAS

  1. WAAS with Defender (AWS): Node.js 16

  2. WAAS with Defender (AWS): Python 3.8

Support removed for Auto Defend

  1. Auto-Defend (AWS): Node.js 16

  2. Auto-Defend (AWS): Python 3.8

Support added for Runtime Protection

  1. Runtime protection with Defender (AWS): Node.js 22

  2. Runtime protection with Defender (AWS): Python 3.13

Support removed for Runtime Protection

  1. Runtime protection with Defender (AWS): Node.js 16

  2. Runtime protection with Defender (AWS): Python 3.8

Support added for x86 Operating Systems

  1. Alma Linux 8

  2. Alma Linux 9

  3. Bottlerocket OS 1.20.5

  4. Talos OS 1.9.4

Support removed for x86 Operating Systems

  1. Talos OS 1.3.0

  2. Talos OS 1.3.3

  3. Talos OS 1.5.1

  4. Talos OS 1.5.3

  5. Talos OS 1.5.5

  6. Talos OS 1.6.0

  7. Talos OS 1.6.1

  8. Talos OS 1.6.4

  9. Talos OS 1.6.6

  10. Talos OS 1.6.6

  11. Talos OS 1.7.2

  12. Talos OS 1.7.5

  13. Talos OS 1.7.6

  14. Talos OS 1.8.0

  15. Talos OS 1.8.2

Support added for x86 Orchestrators

  1. Azure Kubernetes Service (AKS) v1.29.13 Linux (Mariner)

  2. Elastic Container Service (ECS) 1.87.1 Linux

  3. Elastic Kubernetes Service (EKS) v1.32.1-eks-5d632ec Linux

  4. Elastic Kubernetes Service (EKS) Bottlerocket v1.32.0-eks-2e66e76 Linux

  5. Google Kubernetes Engine (GKE) v1.32.1-gke.1489001 Linux

  6. Google Kubernetes Engine (GKE) autopilot v1.31.6-gke.1020000 Linux

  7. Lightweight Kubernetes (k3s) v1.31.5+k3s1 Linux

  8. OpenShift 4.17

  9. RKE v1.31.5 Linux

  10. RKE2 v1.32.1+rke2r1 Linux

  11. VMware Tanzu Kubernetes Grid Integrated Edition (TKGI) v1.30.7+vmware.1 Ubuntu 22.04.1 LTS

Support removed for x86 Orchestrators

  1. Azure Kubernetes Service (AKS) v1.27.9 Linux

  2. Azure Kubernetes Service (AKS) v1.28.9 Linux

  3. Azure Kubernetes Service (AKS) v1.29.2 Linux

  4. Azure Kubernetes Service (AKS) v1.30.3 Linux

  5. Azure Kubernetes Service (AKS) v1.28.5 Linux

  6. Azure Kubernetes Service (AKS) v1.29.2 Linux

  7. Azure Kubernetes Service (AKS) v1.29.7 Linux (Mariner)

  8. Azure Kubernetes Service (AKS) v1.31.1 Windows

  9. Azure Kubernetes Service (AKS) v1.30.4 Windows

  10. Azure Kubernetes Service (AKS) v1.30.3 Windows

  11. Azure Kubernetes Service (AKS) v1.29.0 Windows

  12. Azure Kubernetes Service (AKS) v1.28.15 Linux

  13. Azure Kubernetes Service (AKS) v1.29.7 Linux (Mariner)

  14. Azure Kubernetes Service (AKS) v1.28.15 Linux

  15. Azure Kubernetes Service (AKS) v1.29.7 Linux (Mariner)

  16. Elastic Container Service (ECS) 1.86.2 Linux

  17. Elastic Container Service (ECS) 1.86.3 Linux

  18. Elastic Kubernetes Service (EKS) v1.28.1-eks-43840fb

  19. Elastic Kubernetes Service (EKS) v1.28.1-eks-43840fb Linux

  20. Elastic Kubernetes Service (EKS) v1.29.0-eks-5e0fdde Linux

  21. Elastic Kubernetes Service (EKS) v1.30.0-eks-036c24b Linux

  22. Elastic Kubernetes Service (EKS) v1.28.1-eks-43840fb Linux

  23. Elastic Kubernetes Service (EKS) v1.29.0-eks-5e0fdde Linux

  24. Elastic Kubernetes Service (EKS) v1.30.0-eks-036c24b Linux

  25. Elastic Kubernetes Service (EKS) Bottlerocket v1.29.1-eks-61c0bbb Linux

  26. Elastic Kubernetes Service (EKS) Bottlerocket v1.30.0-eks-fff26e3 Linux

  27. Google Kubernetes Engine (GKE) v1.27.12-gke.1115000 Linux

  28. Google Kubernetes Engine (GKE) v1.28.8-gke.1095000 Linux

  29. Google Kubernetes Engine (GKE) v1.29.7-gke.1104000 Linux

  30. Google Kubernetes Engine (GKE) autopilot v1.29.7-gke.1104000 Linux

  31. Google Kubernetes Engine (GKE) 1.27.12-gke.1115000 Linux

  32. Google Kubernetes Engine (GKE) 1.28.8-gke.1095000 Linux

  33. Google Kubernetes Engine (GKE) v1.29.7-gke.1104000 Linux

  34. Google Kubernetes Engine (GKE) v1.30.3-gke.1225000 Linux

  35. Google Kubernetes Engine (GKE) autopilot v1.30.3-gke.1639000 Linux

  36. Google Kubernetes Engine (GKE) 1.27.12-gke.1115000 Linux

  37. Google Kubernetes Engine (GKE) 1.28.8-gke.1095000 Linux

  38. Google Kubernetes Engine (GKE) v1.29.7-gke.1104000 Linux

  39. Google Kubernetes Engine (GKE) v1.30.5-gke.1443001 Linux

  40. Google Kubernetes Engine (GKE) autopilot v1.31.1-gke.1678000 Linux

  41. Google Kubernetes Engine (GKE) 1.28.15-gke.1159000 Linux

  42. Google Kubernetes Engine (GKE) autopilot v1.31.3-gke.1006000 Linux

  43. Kubernetes (k8s) v1.28.10 Linux

  44. Lightweight Kubernetes (k3s) v1.30.0+k3s1 Linux

  45. Lightweight Kubernetes (k3s) v1.31.0+k3s1 Linux

  46. OpenShift 4.14

  47. RKE v1.30.3 Linux

  48. RKE v1.30.4 Linux

  49. RKE v1.30.4 Linux

  50. RKE v1.31.2 Linux

  51. RKE2 v1.29.3+rke2r1 Linux

  52. RKE2 v1.29.3+rke2r1 Linux

  53. RKE2 v1.31.2+rke2r1 Linux

  54. RKE2 v1.31.2+rke2r1 Linux

  55. TalOS 1.7.6 Talos

  56. VMware Tanzu Kubernetes Grid Integrated Edition (TKGI) v1.26.5+vmware.1 Ubuntu 22.04.1 LTS

  57. VMware Tanzu Kubernetes Grid Integrated Edition (TKGI) v1.28.7+vmware.1 Ubuntu 22.04.1 LTS

Support added for ARM orchestrators

  1. Elastic Kubernetes Service (EKS) v1.32.1-eks-5d632ec.arm

  2. Google Kubernetes Engine (GKE) 1.32.1-gke.1489001.arm

  3. Google Kubernetes Engine (GKE) autopilot on ARM v1.30.9-gke.1046000

Support removed for ARM orchestrators

  1. Elastic Container Service (ECS) 1.86.2

  2. Elastic Container Service (ECS) 1.86.3

  3. Elastic Kubernetes Service (EKS) v1.29.0-eks-5e0fdde.arm

  4. Elastic Kubernetes Service (EKS) v1.30.0-eks-036c24b.arm

  5. Google Kubernetes Engine (GKE) v1.29.7-gke.1104000.arm

  6. Google Kubernetes Engine (GKE) autopilot on ARM v1.29.7-gke.1104000.arm

  7. Google Kubernetes Engine (GKE) v1.30.5-gke.1443001

  8. Google Kubernetes Engine (GKE) autopilot on ARM v1.30.5-gke.1014001

  9. Google Kubernetes Engine (GKE) 1.31.1-gke.2105000

  10. Google Kubernetes Engine (GKE) autopilot on ARM v1.30.6-gke.1125000

  11. Elastic Kubernetes Service (EKS) v1.29.0-eks-5e0fdde

  12. Elastic Kubernetes Service (EKS) v1.30.0-eks-036c24b

API Changes and New APIs

Feature

Description

Support Description Field

A new Description parameter has been introduced to the Get Users API response. This will help to get more information on the users based on the description field.

Support CaaS Specification References Field

A new hasCAASSpecReferences query parameter has been introduced to Get Registry Scan Results, Download Registry Scan Results and Get Registry Image Names APIs to enable registry image filtering deployed as part of CaaS specifications (AWS Fargate, GCP Cloud Run, ACI). This parameter only applies to Prisma onboarded accounts.

Support Images Field

A new images query parameter has been added to the Get Discovered Cloud Entities API to filter cloud-discovered entities by the container image names defined in a CaaS specification (AWS Fargate Task Definition, GCP Cloud Run, ACI). This parameter only applies to Prisma onboarded accounts.

Support Service Field

A new service parameter has been introduced to the Get Discovered Cloud Entities API response to specify the discovered GCP Cloud Run service name. This parameter only applies to Prisma onboarded accounts.

Support CaaS Specification References Total Field

A new caasSpecReferencesTotal parameter has been introduced to Get Host Scan Results, Get Image Scan Results, Get Impacted Container Compliance Policy, Get Impacted VMs Compliance Policy, Host App Firewall Policy Impacted, Get Impacted Host Vulnerability Policy, Get Impacted Image Vulnerability Policy, Get Registry Scan Results and Get VM Image Scan Results APIs to specify the referenced number of CaaS specifications (AWS Fargate Task Definition, GCP Cloud Run, ACI). This parameter only applies to Prisma onboarded accounts.

Support for a Amazon Fargate Task Definition

A new Enum value aws-fargate-task-definition has been added to shared.ScanResultType schema to specify a new scan result type of Amazon Fargate Task Definition. This parameter only applies to Prisma onboarded accounts.

Previous34.01 (Build 34.01.126)NextFixed and Known Issues in 34.xx

Last updated

Was this helpful?