34.01 (Build 34.01.126)
The following table outlines the release particulars:
Build
34.01.126
Code name
Quinn Update 1
Release date
May 18, 2025
Type
Minor release
SHA-256
d6e3cdf62f33363d03eeb5f9dcdb315a3b13f245fad40810ac8e454c8281b485
Review the system requirements to learn about the supported operating systems, hypervisors, runtimes, tools, and orchestrators.
Upgrade from Previous Releases
Upgrade Defenders
With the v34.00 release, the supported Defender releases (n, n-1, and n-2) are v34, v33, and v32 respectively. In addition, Prisma Cloud will not restrict the usage of Defender versions or REST API calls from the n-3 releases. So the current release will allow Defenders and REST API calls from release v31 also. Failure to upgrade Defenders below release v31, such as v30.03, will result in disconnection of the Defenders from the Console.
However, to maintain full support, you must upgrade your Defenders to a v32.00 or a higher release.
To summarize, the level of support for the different versions of Defenders is as follows:
Defender versions 34.xx, 33.xx, and 32.xx have full support
Defender versions 31.xx are functional (will be able to connect to version 34.00 Console) but support is not available for such Defenders
Defender versions previous to 31.00, such as 30.03, are neither supported nor functional (cannot connect to version 34.xx Console)
Upgrade the Prisma Cloud Console
With the v34.00 release, the supported Console releases (n, n-1, and n-2) are v34, v33, and v32 respectively.
Defenders from the n-3 release will remain functional as described above.
You can upgrade the Prisma Cloud console directly from any n-1 or n-2 version to n. For example, with v34 as n and v33 as n-1, you can upgrade directly from 33.01.137 to 34.00.141. You can also upgrade directly from an n-2 version (32.00.161, 32.01.128, 32.02.127, 32.03.123, 32.04.113, 32.05.124, 32.06.113, 32.07.123) to 34.00.141.
Announcement
Feature
Description
RedHat Enterprise Linux 10 incompatibility with WAAS Defender Agent
RedHat deprecated iptables in RHEL 9 and the upcoming RHEL 10 will not support iptables.
The WAAS defender agent deployed directly on RHEL10 (as Host Defender), which relies on iptables, is incompatible with RHEL 10 due to this change.
Containerized varieties of the WAAS Defender will continue to work.
Enhancements
Feature
Description
Enhanced fsmon monitoring process
To enhance the handling of file system events in the runtime, a new version, fsmon_v2, has been developed. This version improves stability by managing timeouts more promptly and robustly, which reduces bottlenecks and enhances overall stability.
Starting from this release (version 34.01), fsmon_v2 is the default file system monitoring process and runs by default when the defender launches.
Support for Oracle Linux as Base Image
Prisma Cloud now provides runtime protection for containers that use Oracle Linux as the base layer.
Support for mounted paths
A new environment variable (HOST_FIM_MOUNTS) enables you to specify additional host mounted paths for runtime monitoring. By incorporating these specified paths into all applicable policies, this feature provides enhanced flexibility in monitoring critical mounted paths within your environment.
The value of this new variable is a colon separated list of the additional mountpoints to track, for example: /mnt/mountpoint1:/mnt/mountpoint2.
To update the environment variable:
Add or modify the new environment variable in the deployment file to include the desired mounted paths for monitoring.
Deploy the Defender with the new environment variables to activate monitoring of the new paths.
New environment variable for configuring the number of image external labels
A new environment variable — IMAGE_EXTERNAL_LABELS_CAP, enables configuration of the maximum number of external labels (indirect labels collected by Prisma Cloud) that are allowed for an image. The default value is 100, and the maximum configurable value is 1024. This variable is applicable to both Console and Defenders.
Important Considerations:
External labels, such as Kubernetes Namespace and Deployment labels, as well as cloud tags, are collected and stored per container.
This limit is specific to external labels collect per image and doesn’t impact existing container limitations.
External labels are not inherent image properties and are not be displayed if a container is not scanned (for example, short-lived containers).
Vulnerabilities and Compliance data available as PDF files
You can now download the data shown on the following pages as PDF files:
Monitor > Vulnerabilities > Images & Hosts
Monitor > Compliance > Containers, Images & Hosts
Runtime protection for SUSE Linux Enterprise Server 15 SP6
Prisma Cloud now supports runtime protection of SUSE Linux Enterprise Server 15 SP6 images.
Feature
Description
System Requirements: Changes to supported systems and platforms
The following changes have been made to the system requirements:
Support added for the following x86 Operating Systems
SLES 15 SP6
Talos OS 1.10.1
Talos OS 1.9.5
Support removed for the following x86 Operating Systems
CentOS 7
RedHat Enterprise Linux 7
VMWare Photon OS 3.0
Support added for the following ARM-based Orchestrators
Google Kubernetes Engine (GKE) autopilot on ARM v1.31.6-gke.1064001
Oracle Kubernetes Engine (OKE) V.1.32.1
Support removed for the following ARM-based Orchestrators
Elastic Container Service (ECS) 1.86.2
Elastic Container Service (ECS) 1.86.3
Support added for the following Auto-Defend platforms
AWS Node.js 22
AWS Python 3.13
API Changes and New APIs
Feature
Description
Download Image Scan Results API
A new column, Cloud Security Agent Hosts, is added in the Download Image Scan Results API CSV file response. This new field lists the number of integrated XDR Agents in the Prisma Cloud and Cortex XDR integration.
Support for new agentless APIs
The following new API endpoints enable you to set the maximum number of scanners for an agentless account and get the agentless scan statistics.
Support for a new enum value
A new Enum value gcp-cloud-run-service has been added to the shared.ScanResultType schema.
Deprecation Notices
Feature
Description
Deprecation of the CNNS feature
The Cloud Native Network Segmentation (CNNS) feature is deprecated for the enforcement of protection against network threats for both containers and hosts. However, in scenarios where alternative network monitoring modes are unavailable, it can be used only for monitoring, such as radar visibility. The current recommendation is to disable all CNNS-based network monitoring as well.
Last updated
Was this helpful?