Identity Dashboard

Prisma Cloud’s Identity dashboard provides a comprehensive view of security risk across the entire identity landscape including, users, permissions, access levels, and more. The dashboard provides critical insights into user activity, permissions, and potential risks, to help you proactively detect and mitigate identity-based threats like unauthorized access, misconfigurations, and privilege escalations.

Use the Identity dashboard as a risk oversight tool across all supported cloud platforms and quickly evaluate your identity posture using real-time data. Use the provided Filters to hone in on the cloud account, or account group you would like to focus on.

Asset totals reported on the Identity Dashboard and Asset Inventory are the sum of all assets with violations and not the total number of alerts generated by that asset. The Assets page therefore may have a different total than the tally found on the Identity dashboard and should not be compared.

The Identity Dashboard includes visualizations for the following widgets:

Identity Asset Inventory

Provides visualizations depicting the security risks associated with each of the following identity types:

• Users
• Machine Identities (such as EC2 instance, Lambda, Azure and GCP Functions, VMs)
• Cloud Service Accounts (such as AWS Roles, Azure Service Principals and Managed Identities, and GCP Service Accounts)
• IAM Policies (such as AWS IAM Policy, Azure, and GCP Roles)
• IAM Groups

Click on any Risk on any identity type to see a list of prioritized Alerts.

Misconfigurations

Provides a pie chart visualization of identities with common misconfigurations that bad actors can potentially access for easy access to your cloud resources. Displays misconfigured identities with over-privileged or inactive credentials over a 30 day period.

Select any section to view the alerts and violating assets. Enable all suggested policies to get the most accurate view of identity misconfiguration risks.

Over privileged

Provides a visualization of identities with overly permissive access, such as:

• Inactive users - Lists users that were inactive for 30 days or more per cloud provider.
• Identities with Excessive Policies Displays identities (users/machines/groups/cloud service accounts) with excessive policies attached. The IAM policy (AWS policy or Azure/GCP role) is considered excessive under the following conditions:

  • AWS: When the action and/or scope of a policy includes “*”
  • Azure: Action includes “*” and the level of role assignment is Subscription or higher
  • GCP: Basic and Service Agent roles are granted at Folder or higher level

The permissions above are extremely dangerous and difficult to monitor.

• Identities with Unused Permissions - Displays identities (users/machines/groups/cloud service accounts) with unused permissions for more than 90 days.

Click on any bar chart to see a breakdown of identities triggering alerts.

Admin Summary and Risks

Displays admin users, who are privileged identities and require close monitoring. The widget provides information about cloud resources with Admin Identities that meet the following criteria:

• Includes built-in Admin policies
• Includes custom policies with administrative permissions

The level at which access is granted for the identity is also taken into consideration.