Features Introduced in August 2023

Learn about the new Code Security capabilities on Prisma® Cloud Enterprise Edition (SaaS) in August 2023.

The following new REST API endpoints are available for Prisma Cloud Code Security.

• New Features
• Changes in Existing Behavior
• Policy Updates
• REST API Updates

New Features

FEATURE	DESCRIPTION
Added support for setting up Transporter network tunnels using Helm Charts	You can now set up Transporter with Kubernetes Helm Charts. This enhancement provides increased flexibility in customizing your Transporter deployment to meet your specific requirements.
Added support for multiple integrations across both GitLab and GitLab Self-Managed version control systems	Added support for multiple integrations across both GitLab and GitLab Self-Managed version control systems. After the initial integration with Prisma Cloud, you can continue to add additional organizations and workspaces using a different or the same user or team token. Multiple integrations from a single Prisma Cloud account enables you to: View a list of integrations on a single console. Add additional integrations. Manage integrations.
Added support for multiple integrations across Jenkins Plugin and CircleCI CI/CD systems	Added support for multiple integrations across Jenkins Plugin and CircleCI CI/CD systems. Multiple integrations from a single Prisma Cloud account enables you to: View a list of integrations on a single console. Add additional integrations. Manage integrations.

Changes in Existing Behavior

FEATURE	DESCRIPTION
Code Security has a New Name	Starting with 23.8.3, Cloud Application Security is the new name for the combination of the Cloud Code Security capabilities and the newly introduced CI/CD Security module. CI/CD Security is available as a standard a-la-carte option or as an add-on with the Prisma Cloud Runtime Security Foundations or Advanced bundles. Owing to the name change, the path to Projects, Development Pipelines and Supply Chain will now be Application Security instead of Code Security on the Prisma Cloud administrative console. The change does impact any existing workflows for scanning and fixing issues.
New Policies for Cloud Application Security (previously Cloud Code Security)	Starting with the 23.8.3 release, 125 new Config policies of subtype Build that enable the detection of CI/CD security risks will be enabled by default and available on the Policies page. With the release, the Code Security capabilities are being renamed as Application Security, and also will introduce CI/CD Security. These new policies will not generate any alerts until you enable the new CI/CD Security capability on "Settings > Application Security Configuration". When you subscribe the CI/CD Security capability, when it becomes available, the alerts will display on "Application Security > CI/CD Risks".

Policy Updates

POLICY UPDATES	DESCRIPTION
Migration of Build Integrity Policies to Configuration Build Policies	Changes - The Build Integrity policies for GitHub and GitLab Terraform Providers will be migrated to IaC Misconfiguration Build policies in the next release. Here is the list of policies to be migrated: Ensure GitHub repository is Private Ensure GitHub repository has vulnerability alerts enabled Ensure GitHub Actions secrets are encrypted Ensure GitHub branch protection rules requires signed commits Ensure Gitlab project merge requests has at least 2 approvals Ensure Gitlab branch protection rules do not allow force pushes Ensure Gitlab project prevents secrets Impact- You will view policy violations for these policies on Projects and Supply Chain in IaC Misconfigurations code category. Enforcement levels for IaC Misconfigurations will now be applied to pipelines with these findings.
Build Integrity Policies -Deleted	Changes - The following Build Integrity policies are no longer supported. Gitlab branch protection rules allows force pushes Gitlab organization has groups with no two factor authentication configured GitHub Actions ACTIONS_ALLOW_UNSECURE_COMMANDS environment variable is set to true GitHub Actions Run commands are vulnerable to shell injection GitHub Actions curl is being with secrets GitHub Actions Netcat is being used with IP address GitHub Actions artifact build do not have cosign - sign execution in pipeline GitHub Actions artifact build do not have SBOM attestation in pipeline GitHub Actions contain workflow_dispatch inputs parameters Rules used could create a double pipeline Suspicious use of curl in a GitLab CI environment GitHub organization security settings do not include 2FA capability GitHub organization security settings do not include SSO GitHub Repository doesn’t have vulnerability alerts enabled GitHub Actions Environment Secrets are not encrypted GitHub merge requests should require at least 2 approvals GitHub organization webhooks do not use HTTPs GitHub repository webhooks do not use HTTPs GitHub branch protection rules do not require linear history GitHub repository has less than 2 admins GitHub branch protection rules are not enforced on administrators GitHub branch protection does not dismiss stale reviews GitHub branch protection does not restrict who can dismiss a PR GitHub branch protection does not require code owner reviews GitHub branch protection does not require status checks GitHub branch protection does not require push restrictions GitHub branch protection rules allow branch deletions Ensure container job uses a non latest version tag Ensure container job uses a version digest Ensure set variable is not marked as a secret BitBucket pull requests require less than approvals Impact- You will not view any policy violations on Projects and Supply Chain.

REST API Updates

FEATURE	DESCRIPTION
Code Security Dashboard APIs	Prisma Cloud Code Security (CCS) now includes the following new Dashboard endpoints that enable you to get details and metrics for Code Security related issues: Common Errors By Policy Code Issues by Severity IaC Errors by Category Top Non-compliant Package Licenses Pull Requests over Time Top CVSS Score Vulnerabilities Top Repositories by Critical Error Count Code issues over time