Aggregation of Events by Defender

This table categorizes various events, their corresponding APIs, and how Defender aggregates the events within Prisma Cloud.

Module	API	Defender Aggregation by
container-events	audits/runtime/container	None
security-events	cloud-security-agent/alerts/container	None
CNNS for containers	audits/firewall/network/container	NetworkFirewallAttackType
WAAS for containers	audits/firewall/app/container	None
Trust audits	audits/trust	Image repo tag
Kubernetes audits	audits/kubernetes	None
Admission audits	audits/admission	None
Docker audits	audits/access	None
App-Embedded audits	audits/runtime/app-embedded	RuntimeAttackType
WAAS audits for App-Embedded	audits/firewall/app/app-embedded	Different mechanism
Host audits	audits/runtime/host	RuntimeAttackType
Security events	cloud-security-agent/alerts/host	None
CNNS for hosts	audits/firewall/network/host	NetworkFirewallAttackType
WAAS for hosts	audits/firewall/app/host	None
Host log inspection audits	audits/runtime/log-inspection	None
Host file integrity	audits/runtime/file-integrity	FileIntegrityEventType
Host activities	forensic/activities	ActivityType
Serverless audits	audits/runtime/serverless	C code
WAAS audits for serverless	audits/firewall/app/serverless	C code
WAAS audits for agentless	audits/firewall/app/agentless	None