Compute Workloads Inventory

As you onboard your Cloud accounts, Prisma Cloud Asset Inventory gives you a summarized view of Compute workloads (containers and hosts) across your entire workload for discovery, risk assessment, and securing the assets in runtime. The inventory helps you to assess and prevent breaches on Cloud workloads, say for example, you can review and protect the Kubernetes clusters in your deployment in runtime.

Prerequisites

• Onboard your Cloud account and deploy the Kubernetes clusters.
• Deploy Defenders (Orchestrator in this case) to monitor your K8s clusters and enable the admission controller.

In the Asset Inventory for Compute Workload, you can:

• Discover compute workload assets (container images and hosts) across your Cloud environment.
• Get a total count of container images and hosts across your workload.
• View a total count of vulnerable images and hosts.

  • Identify the Cloud providers of the images and filter the vulnerable images.
  • View how the container images are spread across the application lifecycle.
  • Assess the images and hosts for the most impactful vulnerabilities, based on CVEs that are critical, exploitable, or patchable.
  • Assess the vulnerable hosts for attack paths, alerts, risk factors, and vulnerabilities.

Discover Compute Workload Assets

The findings on Inventory > Compute Workloads help you to assess the impact of the vulnerable container images and hosts on your application lifecycle, identify the top impacting vulnerabilities based on critical CVEs, and identify the Cloud providers these assets belong to.

You can discover the relationships between the registry images and the deployed images and prioritize the compute workloads based on the top impactful vulnerabilities to focus on. This gives you a better understanding of your security posture and helps to identify the image and host-related security risks.

Risk Assessment for Container

In Inventory > Compute Workloads > Container Images you can assess the container images to understand the image-related risks.

Trace how the vulnerable container images are spread across your application’s Lifecycle stages. You can sort the results based on images with the most impactful vulnerabilities, running containers with these vulnerable images, and the most recent scanned vulnerable images.

Select a container image, to get more information, such as the alerts profile and the policies violated, vulnerabilities profile, risky processes, risky packages installed in the image, and labels associated with that image.

Risk Assessment for Hosts

Inventory > Compute Workloads > Hosts helps you assess the security posture for the most impactful hosts based on CVEs that are critical and high, exploitable, or patchable.

You can filter the vulnerable hosts and also sort the list based on the most impactful vulnerabilities, and the recent vulnerable hosts scanned.

Select a host to view more information such as the attack paths, audit trail, alerts profile, the policies violated, threat detection findings on the host, risk factors and impactful vulnerabilities, package information, over-permissive IAM details on the host, and the host’s relationship with other assets.

In the attack paths, you can select a CVE to fix the vulnerability in Code (Fix in Code) and submit a PR or View Details to mitigate the risk and eliminate the weak link leading to the host.

What’s Next

• Extend protection for containers running on the clusters.
• Enforce compliance checks
• Enable Runtime Audits.
• Create Create an Alert Rule for Cloud Workloads. On the alerts profile, you can see the alert policies violated by the vulnerable container images and hosts, and download the alert profile data for container images in a tabular format.
• Select an alert to further investigate Cloud workload alert policies violated under Prisma Cloud Policies.