Investigate Container Network Exposure on Prisma Cloud

Use the config from network where queries, to investigate the true Network Exposure of your cloud assets.

You can also search for Kubernetes-related objects on Investigate. They are designed to be flexible in order to support a majority of use cases. The Network Path Analysis shows the path that network traffic would take if traffic were to be initiated from Source A to Destination B. Every hop in the path is a decision point in the traffic forwarding path in the cloud.

Container Exposure Graph

After the Investigate search displays the query results, click the i icon (Network Path) under Actions to view the detailed Network Path Analysis, which shows the path that the network traffic would take if traffic were to be initiated from the Source (Internet) to Destination (Kubernetes service and the endpoints). Every hop with a green bubble indicates the traffic can move forward (Allow traffic) from one point to the next. A hop with a red bubble indicates the traffic cannot move forward (Deny traffic).

• Path: Different paths the destination are exposed to the internet.
• Source: Source of the exposure (untrusted internet or a specific IP).
• CSP Overlay: Cloud Service Provider assets in the network path.
• Kubernetes Underlay:

  • K8s Nodes: Nodes that belongs to the K8s cluster.
  • K8s Service: K8s Services exposing the container.
  • K8s Deployment: Deployment associated with the endpoint/service.
  • K8s Endpoints: Endpoint associated with the running pods.

See Network Configuration Query Examples and Network Configuration Query Attributes for more details.