> For the complete documentation index, see [llms.txt](https://docs.prismacloud.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.prismacloud.io/content-collections/runtime-security/install/deploy-defender/app-embedded/deploy-app-embedded-defender-aci.md). # (Dockerfile method) Deploy App-Embedded Defender in ACI Deploy an App-Embedded Defender in ACI to provide runtime protection to App-Embedded applications installed in ACI. The App-Embedded Defender enforces runtime policy on the application entrypoint and any child processes created by this entrypoint. To learn when to use App-Embedded Defenders, see [Defender types](/content-collections/runtime-security/install/deploy-defender/defender-types.md). To learn more about App-Embedded Defender’s capabilities, see: * [Vulnerability scanning for App-Embedded](/content-collections/runtime-security/vulnerability-management/scan-app-embedded.md) * [Compliance scanning for App-Embedded](/content-collections/runtime-security/compliance/operations/app-embedded-scanning.md) * [Runtime defense for App-Embedded](/content-collections/runtime-security/runtime-defense/runtime-defense-app-embedded.md) * Protecting front-end containers at runtime with [WAAS](https://github.com/PaloAltoNetworks/pc-docs-md/tree/main/enterprise-edition/content-collections/runtime-security/waas/waas.md) ## System Requirements * ACI supports Linux containers * App-Embedded Defender image is supported on Linux (x86) architecture * Any Docker image with Prisma Cloud App-Embedded Defender binary. * Azure Container Registry (ACR) (recommended) ## Configure App-Embedded Defender in Prisma Console UI Prisma Console provides you with an App-Embedded Defender bundle that contains the Dockerfile with App-Embedded configurations and the Defender installation binary file. You can select one of the **Deployment types**: Dockerfile or Manual. * **Dockerfile**: Creates a new Dockerfile based on your Dockerfile and embeds the App-Embedded parameters. * **Manual**: Select the manual method to customize the required Dockerfile parameters in the Console UI and directly download the App-Embedded Defender binary file. **Prerequisites** * You can connect to Azure Container Registry(ACR) or any other registry used to pull your images. * The container where you are embedding App-Embedded Defender can reach Console’s port 8084 over the network. * You have the Dockerfile for your image if you choose the **Deployment type** as Dockerfile. ### Embed App-Embedded Defender with Dockerfile Upload your Dockerfile and Prisma Cloud creates a new Dockerfile with App-Embedded Defender parameters and the Defender binary file. 1. Log in to Prisma Cloud Console. 2. Go to **Manage > Defenders > Deployed Defenders > Manual deploy**.
deploy app embedded defender aci
3. In Deployment method, select **Single Defender**. 4. Select the Defender type as **Container Defender - App-Embedded**. 5. Select the DNS name configured in **Manage > Defenders > Names (SAN)** or public IP address that Defender will use to connect to Prisma Console. 6. **Enable file system runtime protection** to allow the sensors to monitor file system events regardless of how your runtime policy is configured, and could impact the underlying workload’s performance. 7. Select Deployment type as **Dockerfile**. 1. In **App ID**, enter a unique identifier for the App-Embedded Defender. All vulnerability, compliance, and runtime findings for the container will be aggregated under this App ID. In Console, the App ID is presented as the image name. Be sure to specify an App ID that lets you easily trace findings back to the image. 2. In **Data folder**, enter the path that the Defender will use to write files and store information. 3. **Dockerfile**: Upload the Dockerfile for your container image. Set up the task’s entrypoint in the Dockerfile. The embed process modifies the container’s entrypoint to run the App-Embedded Defender first, which in turn starts the original entrypoint process. The Defender starts defending the app from the entrypoint and the thread/child process created by this entrypoint. 8. **Download** the App-embedded bundle that contains the Dockerfile with Defender deployment configurations appended to your Dockerfile and the App-Embedded Defender binary file. 9. Rebuild the image and embed the Defender in ACI. ### Embed App-Embedded Defender Manually Embed App-Embedded Defender into a container image manually. Modify your Dockerfile with the given configurations, download the App-Embedded Defender binaries into the image’s build context, then rebuild the image. **Prerequisites** * At runtime, the container where you’re embedding App-Embedded Defender can reach Console over the network. For Enterprise Edition, Defender talks to Console on port 443. For Compute Edition, Defender talks to Console on port 8084. * The host where you are rebuilding your container image with App-Embedded Defender can reach Console over the network on port 8083. * You have the Dockerfile for your image. 1. Log in to Prisma Cloud Console. 2. Go to **Manage > Defenders > Deployed Defenders > Manual deploy**. 3. In Deployment method, select **Single Defender**. 4. Select the Defender type as **Container Defender - App-Embedded**. 5. Select the DNS name (configured in **Manage > Defenders > Names (SAN)** or public IP address that Defender will use to connect to Prisma Console. 6. **Enable file system runtime protection** to allow the sensors to monitor file system events regardless of how your runtime policy is configured, and could impact the underlying workload’s performance. 7. Select **Deployment type** as **Manual** Follow the instructions for embedding App-Embedded Defender into your image. 1. Download the App-Embedded bundle using the command or download the file directly. 2. Configure your Dockerfile and set the following environment variables: ``` DEFENDER_TYPE="appEmbedded" ENV DEFENDER_APP_ID="Unique identifier for the App-Embedded Defender in Prisma Cloud Console" FILESYSTEM_MONITORING="true/false" WS_ADDRESS="Websocket address the Defender is communicating to" DATA_FOLDER="The path that Defender uses to store its metadata" INSTALL_BUNDLE="The access key for the Prisma Console, copy this from the Console" FIPS_ENABLED="true/false" ENTRYPOINT="Modify the entrypoint for the app to start the app under the control of App-Embedded Defender" ``` 3. Add the App-Embedded Defender to Dockerfile. ``` ADD twistlock_defender_app_embedded.tar.gz ``` 4. Modify the entrypoint so that your app starts under the control of App-Embedded Defender. 5. Rebuild your image and embed the Defender in Cloud instance. ## Embed App-Embedded Defender in Azure ACI Prisma Cloud uses the updated Dockerfile to deploy the Defender in your containers running in ACI. Use the updated Dockerfile to build the image for App-Embedded Defender, push it to Azure Container Registry, and then run the container instance. **Prerequisite**: * Log in to Azure * Create an Azure resource group * Create an Azure ACI context * You have an image of the Defender binary from the download App-Embedded zipped bundle from Prisma Cloud Console. * You have the modified Dockerfile with App-Embedded Defender deployment configurations. 1. Log in to your Azure instances ``` az login ``` 2. Copy the App-Embedded zipped bundle and unzip it to get the Dockerfile and App-Embedded Defender binary. 3. Build the Dockerfile: ``` docker build -t : ``` If your Dockerfile is in the current directory, use **.** for \ 4. Start an Azure container instance from this image: 1. Go to **Azure Portal > Azure Container Registry > Repositories**. Right-click on the App-Embedded image and select **Run Instance**. 2. Create a container instance and edit the following: 1. Enter the **Container name** to be the same as the container image name in Azure. 2. Select the **OS type** as Linux (as Prisma Cloud only supports Linux x86 App-Embedded Defenders). 3. Select **Public IP address** if you need routable IPs to establish communication between Prisma Console and Defender installed in Azure. 4. Enter the **Port** defined for the APP in Dockerfile. 3. Select **Create**. 5. In Azure Container instances, verify that your application shows a **running** status. This App-Embedded Defender running in ACI is now recognized in Prisma Console under **Manage > Defenders > Deployed Defenders**. ## Embed App-Embedded Defender with twistcli Use the `twistcli` command line tool to embed an App-Embedded Defender in your Cloud Container Registries. **Prerequisites**: * Running tasks can connect to Prisma Cloud Console over the network. * Prisma Cloud Defender connects to Console to retrieve runtime policies and send audits. * Defender uses port 443 to connect to the Prisma Cloud Console. * The container where you’re embedding App-Embedded Defender can reach Console’s port 8084 over the network. * You have Dockerfile for you image. * Cloud CLI, such as Azure CLI, or Google Cloud CLI. 1. Log in to Prisma Cloud Console. 2. Download `twistcli` 1. Go to **Runtime Security > Manage > System > Utilities**, and download `twistcli` for your platform. 3. Run `twistcli` to embed Defender in your Cloud Registry (such as Azure, or Google Run). A file named *app\_embedded\_embed*\.zip\_ is created, that has the Dockerfile for App-Embedded Defender and App-Embedded Defender binary file. Get the API **Token details** from **Manage > System > Utilities > API token, Token details**. ``` $ ./twistcli app-embedded embed \ --user \ --password \ --token=$token \ --address "" \ --app-id \ --data-folder /tmp \ ``` * \ — Name of a Prisma Cloud user with a minimum [role](/content-collections/runtime-security/authentication/user-roles.md) of Defender Manager. * \ — For Prisma Cloud Enterprise Edition, you can also specify the secret key that you configured under **Prisma > Settings > Access Control > Access Keys**. * \ — API Token for authenticating with Prisma Cloud Console. (For Enterprise Edition only) * \ — DNS name or IP address for Console. * \ — Unique identifier. When setting ``, specify a value that lets you easily trace findings back to the image. All vulnerability, compliance, and runtime findings for the container will be aggregated under this App ID. In Console, the App ID is presented as the image name. * \ — Readable and writable directory in the container’s filesystem. * To enable file system protection, add the `--filesystem-monitoring` flag to the `twistcli` command. 4. Unpack *app\_embedded\_embed\_help.zip*. 5. Create and push the docker image to ACR ``` $ az login $ docker login -u -p $ docker build -t /REPO:TAG $ docker images $ docker push /REPO:TAG ``` 1. Check the image exists in Azure repo ``` $ az acr repository show-tags \ --name \ --repository \ --top 10 \ --orderby time_desc \ --detail ``` 2. Create a container instance (ACI) ``` $ az container create -g \ --name \ --image \ --registry-username \ --registry-password \ --location \ --ip-address Public \ --os-type Linux \ --ports 8080 \ --cpu 1 \ --memory 1.5 ``` ### Delete a Container Instance ``` $ az container delete -g --name -y ``` ## View Deployed Defenders You can review the list of all Defenders connected to Console under **Runtime Security > Manage > Defenders > Deployed Defenders**. To narrow the list to just App-Embedded Defenders, filter the table by type `Type: Container Defender - App-Embedded`.
connected app embedded defenders
By default, Prisma Cloud removes disconnected App-Embedded Defenders from the list after an hour. As part of the cleanup process, data collected by the disconnected Defender is also removed from **Monitor > Runtime > App-Embedded observations**. There is an advanced settings dialog under **Runtime Security > Manage > Defenders > Deployed Defenders**, which lets you configure how long Prisma Cloud should wait before cleaning up disconnected Defenders. This setting doesn’t apply to App-Embedded Defenders. Disconnected App-Embedded Defenders are always removed after one hour. ## Trigger Events for App-Embedded Refer to [Runtime defense for App-Embedded](/content-collections/runtime-security/runtime-defense/runtime-defense-app-embedded.md). ## Monitor App-Embedded Events You can view the [App-Embedded runtime events](/content-collections/runtime-security/runtime-defense/runtime-defense-app-embedded.md) by app ID under **Monitor > Events > App-Embedded audits**, and view the [App-Embedded incidents](/content-collections/runtime-security/runtime-defense/incident-explorer.md) under **Monitor > Runtime > Incident Explorer**. You can also [deploy WAAS for Containers Protected By App-Embedded Defender](/content-collections/runtime-security/waas/deploy-waas/app-embedded.md), create a WAAS rule policy, add an app, enable protections, run WAAS sanity tests, and monitor the events under **Monitor > Events > WAAS for App-Embedded**. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.prismacloud.io/content-collections/runtime-security/install/deploy-defender/app-embedded/deploy-app-embedded-defender-aci.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.