Network Queries

Use network queries to find real-time network security risks on your assets deployed in public cloud environments.

Prisma Cloud identifies anomalies in ingested network traffic data using Machine Learning to help you conduct network investigation and analysis. With Prisma Cloud you can query network traffic from VPC flow logs in extensive detail using pre-defined or custom queries. Set up queries for conditions you want to be alerted on, such as services that are exposed to the internet, communicating with suspicious IPs or communicating outside of approved guardrails.

Network queries are based on varying RQL and data sources and can be of two types:

• Network Flow - Query for incidents and threats that are based on flow logs.
• Network Configuration - Query for true exposures that are based on configuration.

These queries help you monitor network traffic and explore the inter-connectivity of your cloud resources by account and region using data points such as, packets, bytes, source or destination resource, source or destination IP address, and source or destination port information.

The intelligent Investigate Graph brings traffic into context by automatically grouping assets into their parent relationships. For every IP address associated with a Prisma Cloud monitored asset, the graph automatically builds a top down hierarchy. This provides a visual representation of where an asset is deployed, how critical that environment is, and if flows represent a risk or anomaly requiring further investigation.

Flows are further separated into two different swimlanes:

• External → Flows coming from/going to unmanaged IPs
• Your Environment → Flows coming from/going to assets known to Prisma Cloud

External IPs are grouped by a parent related to the specific IP CIDR block or Threat Feed. The supported groups are:

• AWS → Public IPs associated to an AWS Service
• AZURE → Public IPs associated to an Azure Service
• GCP → Public IPs associate to a GCP Service
• Suspicious IPS → Public IPs associate with a Threat List
• Internet → All other public IPs

Analyzing Network Flows

To analyze a specific network traffic of interest, expand the graph to the asset level. Select a connecting line between the External IP and the asset of interest. Select View Details, on Connection Details to display an aggregated visualization of all flows between the selected asset and its related source(s) or destination(s). If the traffic is from a suspicious IP address as characterized by a threat feed, additional details for the threat feed source, such as when it was classified and reason for classification is also provided.

If the side panel is empty, you may have to click on a parent group instead of an individual asset.