Prisma Cloud Findings

All Prisma Cloud findings are driven by policies. While you can take action on Prisma Cloud generated alerts, findings are purely informational and provide security context. Findings inherit the attributes of the policy, such as name, severity, and description. The Finding Type is a set of findings with a specific security focus.

Each OOTB policy (except for Attack Path policies) is classified with a finding type. The finding type is displayed as <unclassified> for custom policies and also for policies cloned from OOTB policies. The View Finding Details button is not visible if the finding details are not applicable for the finding type.

Finding Type	Description
Bot Activity	A WAAS detection of web activity performed by an automated tool known as a bot.
Config Tampering	Findings that identify alternation on critical configurations that may pose an escalated security risk.
Cross Account Trust	A scenario where a cloud account provides access to some of its resources or services to a different cloud account.
Defense Evasion	A scenario where an attacker performs actions to evade detection of their actions by security controls.
High Privileged Role	An IAM role that has (risky) excessive access permissions to a cloud resource or service.
Internet Exposure	A cloud asset, usually a compute resource such as a VM or a Container that is accessible from the public Internet.
Keys And Secrets	Insecure findings related to keys and secrets.
Malware	The detection of software intentionally designed to cause damage, steal data, or gain unauthorized access to computer systems or networks.
Misconfiguration	A misconfiguration of a cloud asset, service or account, which may introduce a security weakness and allow malicious users to abuse it.
MFA	Multi-factor authentication is not enabled for some user actions.
Overly Permissive Resource	Cloud resources can be accessed by any user due to the overly permissive IAM policy configuration. It differs from the INTERNET_EXPOSURE finding type, mainly identifying the resources with unrestricted inbound network firewall rules.
Privilege Escalation	A scenario where a malicious user can potentially elevate their privileges to an asset or a service.
Reconnaissance	Potentially malicious reconnaissance activity performed.
Resource Hijacking	Potentially unauthorized utilization of cloud computing resources by an attacker.
Sensitive Data	The detection of sensitive data such as credit card information, PII, usernames, and so on.
SSH Brute Force	Findings that identify the use of trial and error to guess information like passwords and encryption keys, attempting to gain unauthorized access to a system.
Suspicious IAM Activity	Findings that identify the IAM actions or activities that are unusual or may pose an elevated risk.
Unencrypted Data	Data that is stored, transmitted, or processed in plain text or a format that is easily readable without the use of encryption, posing a significant security risk.
Unused Privileges	IAM access permissions that have not been used for a certain period. These permissions are potentially unnecessary for the user/entity’s normal operation.
User Anomaly	Suspicious cloud account user activity that could potentially point to malicious user behavior.
Weak Password	The authentication mechanism in use is flawed, less secure, or susceptible to attacks like brute force.
Web Attack	A WAAS detection of an active web attack performed by a potentially malicious user.