> For the complete documentation index, see [llms.txt](https://docs.prismacloud.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.prismacloud.io/content-collections/administration/network-security/cloud-network-analyzer.md).
# Cloud Network Analyzer
Cloud Network Analyzer (CNA) by Prisma Cloud takes a multi-dimensional approach in identifying overly-exposed assets by providing end-to-end network path visibility from any source, such as an AWS EC2 virtual machine, DB instance, or Lambda application to any destination, such as the internet, another VPC, or on-premises networks. CNA helps you determine the network exposure of your cloud assets and secure them from network threats by providing an end-to-end path analysis. It also helps you in identifying Kubernetes services that are internet exposed.
For example, a compute instance is directly exposed to the internet only when it has an Elastic Network Interface (ENI) with EIP attached to a public subnet and has overly permissive security-group in a VPC that is attached to an gateway with internet connectivity.
CNA also provides visibility into the associations between security groups and compute instances, such as EC2, RDS, or Redshift to identify network security risks before they become incidents. For example, you can address the risk when a compute instance has direct internet access because it has an ENI attached to a public subnet, overly permissive security-group, and is in a VPC that is attached to an internet gateway with route to internet.
Prisma Cloud does not send actual traffic or read network logs for performing network path analysis. The CNA engine correlates multiple data points, including routing paths and security policy configurations using graph-based modeling and then runs a complex calculation to evaluate the net effective action (**Allow** or **Deny**).
Some of the important use cases that you can address using CNA are:
* Internet exposed AWS EC2 instances, Azure VMs, interfaces, PaaS, or workloads
* AWS applications or workloads that have unrestricted access to the internet (Egress)
* Overly permissive security groups attached to sensitive workloads
* AWS RDS or sensitive DB workloads exposed to the internet
* Production applications connected to QA or staging environments between cloud accounts or VPCs
* Object storage buckets with sensitive data exposed through network connectivity to external cloud accounts or networks
* Kubernetes services internet exposed and the underlying endpoints and associated deployments.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://docs.prismacloud.io/content-collections/administration/network-security/cloud-network-analyzer.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.