> For the complete documentation index, see [llms.txt](https://docs.prismacloud.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.prismacloud.io/release-notes/prisma-cloud-release-information/classic-releases/prisma-cloud-cspm-release-information/features-introduced-in-august-2023.md).

# Features Introduced in August 2023

Learn what’s new on Prisma® Cloud in August 2023.

* [New Features Introduced in 23.8.2](#new-features-aug-2)
* [New Features Introduced in 23.8.1](#new-features-aug-1)

## New Features Introduced in 23.8.2

* [New Features](#new-features2)
* [API Ingestions](#api-ingestions2)
* [New Policies](#new-policies2)
* [Policy Updates](#policy-updates2)
* [New Compliance Benchmarks and Updates](#new-compliance-benchmarks-and-updates2)
* [Changes in Existing Behavior](#changes-in-existing-behavior2)
* [REST API Updates](#rest-api-updates2)

## New Features

| FEATURE                                                     | DESCRIPTION                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |
| ----------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Updates to Workload Defense Metrics on Adoption Advisor** | <p>The Adoption Advisor dashboard and report now provide valuable insights on your workload defense coverage through both agentless scanning and Defenders. In addition to the information on how many hosts and cloud accounts are protected with Defenders, you can now review how many hosts are scanned using agentless security. This way, you’ll have a comprehensive picture of the total number of hosts that are protected and scanned using Prisma Cloud.</p><p><img src="/files/CiIjCmzATDBn48J9qIHv" alt="" data-size="original"></p> |

## API Ingestions

| SERVICE                            | API DETAILS                                                                                                                                                                                                                                                                                                                                                           |
| ---------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Amazon VPC**                     | <p><strong>aws-ec2-traffic-mirroring</strong></p><p>Additional permission required:</p><ul><li><code>ec2:DescribeTrafficMirrorSessions</code></li></ul><p>The Security Audit role includes the permission.</p>                                                                                                                                                        |
| **Amazon VPC**                     | <p><strong>aws-ec2-customer-gateway</strong></p><p>Additional permission required:</p><ul><li><code>ec2:DescribeCustomerGateways</code></li></ul><p>The Security Audit role includes the permission.</p>                                                                                                                                                              |
| **AWS Support**                    | <p><strong>aws-support-case</strong></p><p>Additional permission required:</p><ul><li><code>support:DescribeCases</code></li></ul><p>You must manually add the permission or update the CFT template to enable it.</p>                                                                                                                                                |
| **Azure Log Analytics**            | <p><strong>azure-log-analytics-linked-storage-accounts</strong></p><p>Additional permissions required:</p><ul><li><code>Microsoft.OperationalInsights/workspaces/read</code></li><li><code>Microsoft.OperationalInsights/workspaces/storageinsightconfigs/read</code></li></ul><p>The Reader role includes the permissions.</p>                                       |
| **Azure SQL Database**             | <p><strong>azure-sql-db-long-term-retention-policies</strong></p><p>Additional permissions required:</p><ul><li><code>Microsoft.Sql/servers/read</code></li><li><code>Microsoft.Sql/servers/databases/read</code></li><li><code>Microsoft.Sql/servers/databases/backupLongTermRetentionPolicies/read</code></li></ul><p>The Reader role includes the permissions.</p> |
| **Azure Synapse Analytics**        | <p><strong>azure-synapse-workspace-managed-sql-server-vulnerability-assessments</strong></p><p>Additional permissions required:</p><ul><li><code>Microsoft.Synapse/workspaces/read</code></li><li><code>Microsoft.Synapse/workspaces/sqlPools/vulnerabilityAssessments/read</code></li></ul><p>The Reader role includes the permissions.</p>                          |
| **Google Cloud Billing**           | <p><strong>gcloud-billing-project-billing-info</strong></p><p>Additional permission required:</p><ul><li><code>resourcemanager.projects.get</code></li></ul><p>The Viewer role includes the permission.</p>                                                                                                                                                           |
| **Google Cloud Identity Platform** | <p><strong>gcloud-identity-platform-tenant-idp-configuration</strong></p><p>Additional permissions required:</p><ul><li><code>firebaseauth.configs.get</code></li><li><code>identitytoolkit.tenants.list</code></li><li><code>identitytoolkit.tenants.get</code></li></ul><p>The Viewer role includes the permissions.</p>                                            |
| **Google Cloud Identity Platform** | <p><strong>gcloud-identity-platform-project-idp-configuration</strong></p><p>Additional permission required:</p><ul><li><code>firebaseauth.configs.get</code></li></ul><p>The Viewer role includes the permission.</p>                                                                                                                                                |
| **Google Stackdriver Logging**     | <p><strong>gcloud-logging-project-setting</strong></p><p>Additional permission required:</p><ul><li><code>logging.cmekSettings.get</code></li></ul><p>You must manually add the permission or update the Terraform template to enable it.</p>                                                                                                                         |

## New Policies

<table data-header-hidden><thead><tr><th></th><th></th></tr></thead><tbody><tr><td>NEW POLICIES</td><td>DESCRIPTION</td></tr><tr><td><strong>AWS Lambda function URL having overly permissive cross-origin resource sharing permissions</strong></td><td><p>Identifies AWS Lambda functions which have overly permissive cross-origin resource sharing (CORS) permissions. Overly permissive CORS settings (allowing wildcards) can potentially expose the Lambda function to unwarranted requests and cross-site scripting attacks. It is highly recommended to specify the exact domains (in 'allowOrigins') and HTTP methods (in 'allowMethods') that should be allowed to interact with your function to ensure a secure setup.</p><p><strong>Policy Severity—</strong> Medium</p><p><strong>Policy Type—</strong> Config</p><pre><code>config from cloud.resource where cloud.type = 'aws' AND api.name= 'aws-lambda-list-functions' AND json.rule = cors exists and cors.allowOrigins[*] contains "*" and cors.allowMethods[*] contains "*"
</code></pre></td></tr><tr><td><strong>AWS Auto Scaling group launch configuration has public IP address assignment enabled</strong></td><td><p>Identifies the autoscaling group launch configuration that is configured to assign a public IP address. Auto Scaling groups assign a public IP address to the group’s ec2 instances if its associated launch configuration is configured to assign a public IP address. Amazon EC2 instances should only be accessible from behind a load balancer instead of being directly exposed to the internet. It is recommended that the Amazon EC2 instances in an autoscaling group launch configuration do not have an associated public IP address except for limited edge cases.</p><p><strong>Policy Severity—</strong> Medium</p><p><strong>Policy Type—</strong> Config</p><pre><code>config from cloud.resource where api.name = 'aws-ec2-autoscaling-launch-configuration' AND json.rule = associatePublicIpAddress exists and associatePublicIpAddress is true
</code></pre></td></tr><tr><td><strong>AWS Auto Scaling group launch configuration configured with Instance Metadata Service hop count greater than 1</strong></td><td><p>Identifies the autoscaling group launch configuration where the Instance Metadata Service network hops count is set to greater than 1. A launch configuration is an instance configuration template that an Auto Scaling group uses to launch EC2 instances. With the metadata response hop limit count for the IMDS greater than 1, the PUT response that contains the secret token can travel outside the EC2 instance. Only metadata with a limited hop count for all your EC2 instances is recommended.</p><p><strong>Policy Severity—</strong> Medium</p><p><strong>Policy Type—</strong> Config</p><pre><code>config from cloud.resource where api.name = 'aws-ec2-autoscaling-launch-configuration' AND json.rule = metadataOptions.httpEndpoint exists and metadataOptions.httpEndpoint equals "enabled" and metadataOptions.httpPutResponseHopLimit greater than 1 as X; config from cloud.resource where api.name = 'aws-describe-auto-scaling-groups' as Y; filter ' $.X.launchConfigurationName equal ignore case $.Y.launchConfigurationName'; show X;
</code></pre></td></tr><tr><td><strong>AWS Auto Scaling group launch configuration not configured with Instance Metadata Service v2 (IMDSv2)</strong></td><td><p>Identifies the autoscaling group launch configuration where IMDSv2 is set to optional. A launch configuration is an instance configuration template that an Auto Scaling group uses to launch EC2 instances. With IMDSv2, every request is now protected by session authentication. Version 2 of the IMDS adds new protections that weren’t available in IMDSv1 to further safeguard your EC2 instances created by the autoscaling group. It is recommended to use only IMDSv2 for all your EC2 instances.</p><p><strong>Policy Severity—</strong> Medium</p><p><strong>Policy Type—</strong> Config</p><pre><code>config from cloud.resource where api.name = 'aws-ec2-autoscaling-launch-configuration' AND json.rule = (metadataOptions.httpEndpoint does not exist) or (metadataOptions.httpEndpoint equals "enabled" and metadataOptions.httpTokens equals "optional") as X; config from cloud.resource where api.name = 'aws-describe-auto-scaling-groups' as Y; filter ' $.X.launchConfigurationName equal ignore case $.Y.launchConfigurationName'; show X;
</code></pre></td></tr><tr><td><strong>Azure Database for MySQL server not configured private endpoint</strong></td><td><p>Identifies Azure MySQL database servers that are not configured with private endpoint. Private endpoint connections enforce secure communication by enabling private connectivity to Azure Database for MySQL.</p><p><strong>Policy Severity—</strong> Medium</p><p><strong>Policy Type—</strong> Config</p><pre><code>config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-mysql-server' AND json.rule = properties.userVisibleState equal ignore case Ready and properties.privateEndpointConnections[*] is empty
</code></pre></td></tr><tr><td><strong>Azure Cache for Redis not configured with data in-transit encryption</strong></td><td><p>Identifies Azure Cache for Redis which are not configured with data encryption in transit. Enforcing an SSL connection helps prevent unauthorized users from reading sensitive data that is intercepted as it travels through the network, between clients/applications and cache servers, known as data in transit.</p><p><strong>Policy Severity—</strong> Medium</p><p><strong>Policy Type—</strong> Config</p><pre><code>config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-cache-redis' AND json.rule = properties provisioningState equal ignore case Succeeded and properties.enableNonSslPort is true
</code></pre></td></tr><tr><td><strong>Azure PostgreSQL servers not configured private endpoint</strong></td><td><p>Identifies Azure PostgreSQL database servers that are not configured with private endpoint. Private endpoint connections enforce secure communication by enabling private connectivity to Azure Database for PostgreSQL. Configuring a private endpoint enables access to traffic coming from only known networks and prevents access from malicious or unknown IP addresses which includes IP addresses within Azure. It is recommended to create private endpoint for secure communication for your Azure PostgreSQL database.</p><p><strong>Policy Severity—</strong> Medium</p><p><strong>Policy Type—</strong> Config</p><pre><code>config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-postgresql-server' AND json.rule = properties.userVisibleState equal ignore case Ready and properties.privateEndpointConnections[*] is empty
</code></pre></td></tr><tr><td><strong>Azure SQL Database server not configured private endpoint</strong></td><td><p>Identifies Azure SQL database servers that are not configured with private endpoint. Private endpoint connections enforce secure communication by enabling private connectivity to Azure Database for SQL. Configuring a private endpoint enables access to traffic coming from only known networks and prevents access from malicious or unknown IP addresses which includes IP addresses within Azure. It is recommended to create private endpoint for secure communication for your Azure SQL database.</p><p><strong>Policy Severity—</strong> Medium</p><p><strong>Policy Type—</strong> Config</p><pre><code>config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-sql-server-list' AND json.rule = properties.userVisibleState equal ignore case Ready and properties.privateEndpointConnections[*] is empty
</code></pre></td></tr><tr><td><strong>Azure Database for MariaDB not configured private endpoint</strong></td><td><p>Identifies Azure MariaDB database servers that are not configured with private endpoint. Private endpoint connections enforce secure communication by enabling private connectivity to Azure Database for MariaDB. Configuring a private endpoint enables access to traffic coming from only known networks and prevents access from malicious or unknown IP addresses which includes IP addresses within Azure. It is recommended to create private endpoint for secure communication for your Azure MariaDB database.</p><p><strong>Policy Severity—</strong> Medium</p><p><strong>Policy Type—</strong> Config</p><pre><code>config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-database-maria-db-server' AND json.rule = properties.userVisibleState equal ignore case Ready and properties.privateEndpointConnections[*] is empty
</code></pre></td></tr></tbody></table>

## Policy Updates

<table data-header-hidden><thead><tr><th></th><th></th></tr></thead><tbody><tr><td>POLICY UPDATES</td><td>DESCRIPTION</td></tr><tr><td><strong>Updates to Attack Path Policy Names</strong></td><td><p>All <a href="https://docs.paloaltonetworks.com/content/dam/techdocs/en_US/pdf/prisma/prisma-cloud/prerelease/attack-path-policy-name-changes.pdf">Attack Path policy names</a> are being revised to use a new format to help you identify the risks and impact better.</p><p><strong>Impact—</strong> No impact since only the policy names are updated.</p></td></tr><tr><td><strong>Policy Updates—RQL</strong></td><td></td></tr><tr><td><strong>AWS CloudTrail is not enabled with multi trail and not capturing all management events</strong></td><td><p><strong>Changes—</strong> The policy RQL is updated to check if logging all management events has been enabled via basic or advanced event selectors.</p><p><strong>Severity—</strong> Informational</p><p><strong>Policy Type—</strong> Config</p><p><strong>Current RQL—</strong></p><pre><code>config from cloud.resource where api.name= 'aws-cloudtrail-describe-trails' AND json.rule = 'isMultiRegionTrail is true and includeGlobalServiceEvents is true' as X; config from cloud.resource where api.name= 'aws-cloudtrail-get-trail-status' AND json.rule = 'status.isLogging equals true' as Y; config from cloud.resource where api.name= 'aws-cloudtrail-get-event-selectors' AND json.rule = 'eventSelectors[*].readWriteType contains All' as Z; filter '($.X.trailARN equals $.Z.trailARN) and ($.X.name equals $.Y.trail)'; show X; count(X) less than 1
</code></pre><p><strong>Updated RQL—</strong></p><pre><code>config from cloud.resource where api.name= 'aws-cloudtrail-describe-trails' AND json.rule = 'isMultiRegionTrail is true and includeGlobalServiceEvents is true' as X; config from cloud.resource where api.name= 'aws-cloudtrail-get-trail-status' AND json.rule = 'status.isLogging equals true' as Y; config from cloud.resource where api.name= 'aws-cloudtrail-get-event-selectors' AND json.rule = '(eventSelectors[].readWriteType contains All and eventSelectors[].includeManagementEvents equal ignore case true) or (advancedEventSelectors[].fieldSelectors[].equals contains "Management" and advancedEventSelectors[].fieldSelectors[].field does not contain "readOnly" and advancedEventSelectors[].fieldSelectors[].field does not contain "eventSource")' as Z; filter '($.X.trailARN equals $.Z.trailARN) and ($.X.name equals $.Y.trail)'; show X; count(X) less than 1
</code></pre><p><strong>Impact—</strong> Medium. Alerts will be generated when the logging of all management events are not enabled by default through advanced selectors. Existing alerts where the logging of all management events was enabled via advanced selectors will be resolved.</p></td></tr><tr><td><strong>GCP VM instances have block project-wide SSH keys feature disabled</strong></td><td><p><strong>Changes—</strong> The policy RQL is updated to check for enabling OS login for the GCP VM instances.</p><p><strong>Severity—</strong> Low</p><p><strong>Policy Type—</strong> Config</p><p><strong>Current RQL—</strong></p><pre><code>config from cloud.resource where api.name = 'gcloud-compute-project-info' AND json.rule = commonInstanceMetadata.kind equals "compute#metadata" and commonInstanceMetadata.items[?any(key contains "block-project-ssh-keys" and (value contains "Yes" or value contains "Y" or value contains "True" or value contains "true" or value contains "TRUE" or value contains "1"))] does not exist as X; config from cloud.resource where api.name = 'gcloud-compute-instances-list' AND json.rule = status equals RUNNING and (metadata.items[?any(key exists and key contains "block-project-ssh-keys" and (value contains "Yes" or value contains "Y" or value contains "True" or value contains "true" or value contains "TRUE" or value contains "1"))] does not exist and name does not start with "gke-") as Y; filter '$.Y.zone contains $.X.name'; show Y;
</code></pre><p><strong>Updated RQL—</strong></p><pre><code>config from cloud.resource where api.name = 'gcloud-compute-project-info' AND json.rule = commonInstanceMetadata.kind equals "compute#metadata" and commonInstanceMetadata.items[?any(key contains "enable-oslogin" and (value contains "Yes" or value contains "Y" or value contains "True" or value contains "true" or value contains "TRUE" or value contains "1"))] does not exist and commonInstanceMetadata.items[?any(key contains "ssh-keys")] exists as X; config from cloud.resource where api.name = 'gcloud-compute-instances-list' AND json.rule = status equals RUNNING and ( metadata.items[?any(key exists and key contains "block-project-ssh-keys" and (value contains "Yes" or value contains "Y" or value contains "True" or value contains "true" or value contains "TRUE" or value contains "1"))] does not exist and metadata.items[?any(key exists and key contains "enable-oslogin" and (value contains "Yes" or value contains "Y" or value contains "True" or value contains "true" or value contains "TRUE" or value contains "1"))] does not exist and name does not start with "gke-") as Y; filter '$.Y.zone contains $.X.name'; show Y;
</code></pre><p><strong>Impact—</strong> Low. Alerts will be generated where the enable OS-login is not enabled for the GCP VM instances. Existing alerts where the block-project-ssh-keys are disabled at the project level are resolved as <strong>Policy_Updated</strong>.</p></td></tr><tr><td><strong>Policy Updates—Metadata</strong></td><td></td></tr><tr><td><strong>Updates to Azure Policy Names</strong></td><td><p><strong>Changes—</strong> The policy names are revised as follows:</p><p><strong>Current Policy Name—</strong> Azure storage account logging for tables is disabled</p><p><strong>Updated Policy Name—</strong> Azure storage account logging (Classic Diagnostic Setting) for tables is disabled</p><p><strong>Current Policy Name—</strong> Azure storage account logging for blobs is disabled</p><p><strong>Updated Policy Name—</strong> Azure storage account logging (Classic Diagnostic Setting) for blobs is disabled</p><p><strong>Current Policy Name—</strong> Azure storage account logging for queues is disabled</p><p><strong>Updated Policy Name—</strong> Azure storage account logging (Classic Diagnostic Setting) for queues is disabled</p><p><strong>Severity—</strong> Informational</p><p><strong>Policy Type—</strong> Config</p><p><strong>Impact—</strong> No impact since only the policy names are updated.</p></td></tr></tbody></table>

## New Compliance Benchmarks and Updates

| COMPLIANCE BENCHMARK                                 | DESCRIPTION                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  |
| ---------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Support for CIS AWS Foundations Benchmark v2.0.0** | <p>Prisma Cloud now supports the CIS AWS Foundations Benchmark v2.0.0 compliance standard. This benchmark specifies best practices for configuring AWS services in accordance with industry best practices.</p><p>You can now view this built-in standard and the associated policies on the "Compliance > Standard" page with this support. You can also generate reports for immediate viewing or download, or schedule recurring reports to track this compliance standard over time.</p> |

## Changes in Existing Behavior

| FEATURE                                                                       | DESCRIPTION                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               |
| ----------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Code Security has a New Name**                                              | [Cloud Application Security](/release-notes/prisma-cloud-release-information/classic-releases/prisma-cloud-code-security-release-information/features-introduced-in-code-security-august-2023.md) is the new name for the combination of the Cloud Code Security capabilities and the newly introduced CI/CD Security module. CI/CD Security is available as a standard a-la-carte option or as an add-on with the Prisma Cloud Runtime Security Foundations or Advanced bundles.                         |
| <mark style="background-color:orange;">Update</mark> **Amazon Inspector API** | <p>Prisma Cloud will no longer ingest metadata for <code>aws-inspector-v2-finding</code> API. Due to this change, you will no longer be able to view the list the assets on the <strong>Investigate page</strong> and perform an RQL search query for this API.</p><p>Impact—All the resources that were ingested as a part of the <code>aws-inspector-v2-finding</code> API will be removed, and all existing alerts associated with the API will be resolved as <strong>Resource\_Deleted</strong>.</p> |

## REST API Updates

No REST API updates for 23.8.2.

## New Features Introduced in 23.8.1

* [New Features](#new-features1)
* [API Ingestions](#api-ingestions1)
* [New Policies](#new-policies1)
* [Policy Updates](#policy-updates1)
* [IAM Policy Updates](#iam-policy-update)
* [Changes in Existing Behavior](#changes-in-existing-behavior1)
* [REST API Updates](#rest-api-updates1)

## New Features

| FEATURE                                                                                                        | DESCRIPTION                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               |
| -------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Attack Path Analysis and Visualization**                                                                     | <p>Prisma Cloud now includes attack path analysis and visualization that identifies attack paths and presents them in a graph view, offering valuable security context to protect against high-risk threats. It is an automated process that identifies the exposed vulnerable assets and indicates the likelihood of a breach which often requires immediate action. Whenever there is a policy violation, the <a href="https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-admin/prisma-cloud-policies/attack-path-policies">attack path policy</a> generates an alert as long as there is a matching alert rule. You can see additional information in the graph view by clicking on the node. Additionally, the asset detail view displays the finding types and vulnerabilities. To review these policies, select <strong>Policies</strong> and filter by Policy Type <strong>Attack Path</strong>. Attack Path policies are not available in China and Government regions.</p><p><img src="/files/e2TfXHJM7rhaxWgXWDyS" alt="" data-size="original"></p>                                                                                                                                                                             |
| **Credit Requirements Updates**                                                                                | <p>Starting August 1 2023, Prisma Cloud Enterprise Edition will reduce the number of credits required.</p><p>Visibility, Compliance, and Governance (for CSPM use cases) will only require 1 credit per virtual machine (AWS EC2s, Azure Virtual Machines and Virtual Machine Scale Sets, Google Cloud Google Compute Engine (GCE), Oracle Cloud (OCI) Compute, Alibaba Cloud ECS). Load Balancers, NAT gateways, Databases and Data Warehouse cloud resources will no longer require credits.</p><p>IAM Security (for CIEM use cases) will only require 0.25 credit per virtual machine. Load Balancers, NAT gateways, Databases and Data Warehouse cloud resources will no longer require credits.</p><p>Host Security credit requirements reduce from 1 to 0.5 credit per Host Defender.</p><p>Container Security credit requirements reduce from 7 to 5 credits per Container Defender.</p><p>Web Application and API Security credit requirements reduce from 30 to 2 credits per Defender performing inline protection.</p><p>The <a href="https://www.paloaltonetworks.com/resources/guides/prisma-cloud-enterprise-edition-licensing-guide">Prisma Cloud Enterprise Edition Licensing Guide</a> will reflect these changes on August 1, 2023.</p> |
| **Support for New Region on AWS**                                                                              | <p>Prisma Cloud now ingests data for resources deployed in the Spain region on AWS.</p><p>To review a list of supported regions, select "Inventory > Assets", and choose <a href="https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-admin/connect-your-cloud-platform-to-prisma-cloud/cloud-service-provider-regions-on-prisma-cloud#id091e5e1f-e6d4-42a8-b2ff-85840eb23396_id9c4f8473-140d-4e4a-94a1-523e00ebfbe4">Cloud Region</a> from the filter drop-down.</p><p><img src="/files/sfLPw8wVai8yrakRwbAc" alt="" data-size="original"></p>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            |
| <mark style="background-color:orange;">Enhancement</mark> **Tenant-Level Opt-Out for Prisma Cloud Chronicles** | <p>For greater control and flexibility for system administrators within your organization, you can now opt-out all your administrators from receiving the Prisma Cloud Chronicles at the tenant level "Settings > Enterprise Settings > Unsubscribe from Prisma Cloud Chronicles".</p><p>An email is sent to all administrators notifying them that a System Administrator has opted them out. Each administrator who wants to receive the latest weekly updates can edit their preference on their Prisma Cloud user profile to opt-in to receive the newsletter.</p><p><img src="/files/XY895tn4rsNtZCcOrBKy" alt="" data-size="original"></p>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          |

## API Ingestions

| SERVICE                                                                              | API DETAILS                                                                                                                                                                                                                                                                                                                                                      |
| ------------------------------------------------------------------------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **AWS Cost Explorer**                                                                | <p><strong>aws-costexplorer-cost-and-usage</strong></p><p>Additional permission required:</p><ul><li><code>ce:GetCostAndUsage</code></li></ul><p>You must manually add the permission or update the CFT template to enable the permission.</p>                                                                                                                   |
| **Amazon ElastiCache**                                                               | <p><strong>aws-elasticache-user</strong></p><p>Additional permission required:</p><ul><li><code>elasticache:DescribeUsers</code></li></ul><p>The Security Audit role includes the permission.</p>                                                                                                                                                                |
| **Amazon Macie**                                                                     | <p><strong>aws-macie2-administrator-account</strong></p><p>Additional permission required:</p><ul><li><code>macie2:ListOrganizationAdminAccounts</code></li></ul><p>You must manually add the permission or update the CFT template to enable the permission.</p>                                                                                                |
| <mark style="background-color:orange;">Update</mark> **Amazon Simple Email Service** | <p><strong>aws-ses-identities</strong></p><p>Additional permission required:</p><ul><li><code>ses:GetIdentityVerificationAttributes</code></li></ul>                                                                                                                                                                                                             |
| <mark style="background-color:orange;">Update</mark> **Amazon VPC**                  | <p><strong>aws-ec2-describe-flow-logs</strong></p><p>The resource JSON for this API will be updated to include the <code>DeliverLogStatus</code> field.</p>                                                                                                                                                                                                      |
| **Azure Data Lake Store Gen1**                                                       | <p><strong>azure-data-lake-store-gen1-diagnostic-settings</strong></p><p>Additional permissions required:</p><ul><li><code>Microsoft.DataLakeStore/accounts/read</code></li><li><code>Microsoft.Insights/DiagnosticSettings/Read</code></li></ul><p>The Reader role includes the permissions.</p>                                                                |
| **Azure IoT Hub**                                                                    | <p><strong>azure-devices-iot-hub-resource-diagnostic-settings</strong></p><p>Additional permissions required:</p><ul><li><code>Microsoft.Devices/iotHubs/Read</code></li><li><code>Microsoft.Insights/DiagnosticSettings/Read</code></li></ul><p>The Reader role includes the permissions.</p>                                                                   |
| **Azure Key Vault**                                                                  | <p><strong>azure-key-vault-managed-hsms-diagnostic-settings</strong></p><p>Additional permissions required:</p><ul><li><code>Microsoft.KeyVault/managedHSMs/read</code></li><li><code>Microsoft.Insights/DiagnosticSettings/Read</code></li></ul><p>The Reader role includes the permissions.</p>                                                                |
| **Azure Key Vault**                                                                  | <p><strong>azure-key-vault-managed-hsms</strong></p><p>Additional permission required:</p><ul><li><code>Microsoft.KeyVault/managedHSMs/read</code></li></ul><p>The Reader role includes the permissions.</p>                                                                                                                                                     |
| **Google Firebase App Distribution**                                                 | <p><strong>gcloud-firebase-app-distribution-tester</strong></p><p>Additional permissions required:</p><ul><li><code>resourcemanager.projects.get</code></li><li><code>firebaseappdistro.testers.list</code></li></ul><p>The Viewer role includes the permissions.</p>                                                                                            |
| **Google Cloud Identity Platform**                                                   | <p><strong>gcloud-identity-platform-tenant-configuration</strong></p><p>Additional permissions required:</p><ul><li><code>identitytoolkit.tenants.list</code></li><li><code>identitytoolkit.tenants.getIamPolicy</code></li></ul><p>The Viewer role includes the permissions.</p>                                                                                |
| **Google Cloud Identity Platform**                                                   | <p><strong>gcloud-identity-platform-project-user-account</strong></p><p>Additional permission required:</p><ul><li><code>firebaseauth.users.get</code></li></ul><p>The Viewer role includes the permission.</p>                                                                                                                                                  |
| **Google Cloud Identity Platform**                                                   | <p><strong>gcloud-identity-platform-tenant-user-account</strong></p><p>Additional permissions required:</p><ul><li><code>identitytoolkit.tenants.list</code></li><li><code>firebaseauth.users.get</code></li></ul><p>The Viewer role includes the permissions.</p>                                                                                               |
| **Google Cloud Identity Platform**                                                   | <p><strong>gcloud-identity-platform-project-configuration</strong></p><p>Additional permission required:</p><ul><li><code>firebaseauth.configs.get</code></li></ul><p>The Viewer role includes the permission.</p>                                                                                                                                               |
| **OCI Block Storage**                                                                | <p><strong>oci-block-storage-boot-volume</strong></p><p>Additional permissions required:</p><ul><li><code>COMPARTMENT\_INSPECT</code></li><li><code>VOLUME\_INSPECT</code></li></ul><p>You must download and execute the Terraform template from the console to enable the permissions.</p>                                                                      |
| **OCI Block Storage**                                                                | <p><strong>oci-block-storage-boot-volume-attachment</strong></p><p>Additional permissions required:</p><ul><li><code>COMPARTMENT\_INSPECT</code></li><li><code>VOLUME\_ATTACHMENT\_INSPECT</code></li><li><code>VOLUME\_ATTACHMENT\_READ</code></li></ul><p>You must download and execute the Terraform template from the console to enable the permissions.</p> |
| **OCI Networking**                                                                   | <p><strong>oci-networking-private-ip</strong></p><p>Additional permissions required:</p><ul><li><code>SUBNET\_READ</code></li><li><code>PRIVATE\_IP\_READ</code></li></ul><p>You must download and execute the Terraform template from the console to enable the permissions.</p>                                                                                |
| **OCI Networking**                                                                   | <p><strong>oci-networking-public-ip</strong></p><p>Additional permission required:</p><ul><li><code>PUBLIC\_IP\_READ</code></li></ul><p>You must download and execute the Terraform template from the console to enable the permission.</p>                                                                                                                      |
| <mark style="background-color:orange;">Update</mark> **OCI Database**                | <p><strong>oci-oracledatabase-databases</strong></p><p>The resource JSON for this API has been updated to include new fields:</p><ul><li><code>nsgIds</code></li><li><code>psubnetId</code></li><li><code>backupNetworkNsgIds</code></li><li><code>backupSubnetId</code></li></ul>                                                                               |

## New Policies

<table data-header-hidden><thead><tr><th></th><th></th></tr></thead><tbody><tr><td>NEW POLICIES</td><td>DESCRIPTION</td></tr><tr><td><strong>Unusual Usage of Workload Credentials Anomaly Policies</strong></td><td><p>Two new anomaly policies are now available in Prisma Cloud.</p><ul><li>Unusual usage of Workload Credentials from outside the Cloud</li><li>Unusual usage of Workload Credentials from inside the Cloud</li></ul><p>The policies detect the use of a credential assigned to a compute resource from a different resource, which could be outside or inside the cloud service provider. This is typically a sign of an attack or a very unusual use of resource credentials. The policies will be triggered based on whether the anomalous IP address is outside or inside the cloud provider’s IP address range.</p><p>You can configure the <strong>Unusual usage of Workload Credentials from inside the Cloud</strong> policy from the new <strong>Identity</strong> section that is available in the <a href="https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-admin/manage-prisma-cloud-administrators/define-prisma-cloud-enterprise-settings">anomaly settings</a>.</p><p>Severity—Medium.</p><p>These two policies require the IAM security (CIEM) module to be enabled.</p></td></tr><tr><td><strong>AWS Route53 Hosted Zone having dangling DNS record with subdomain takeover risk associated with AWS Elastic Beanstalk Instance</strong></td><td><p>Identifies AWS Route53 Hosted Zones which have dangling DNS records with subdomain takeover risk. A Route53 Hosted Zone having a CNAME entry pointing to a non-existing Elastic Beanstalk (EBS) will have a risk of these dangling domain entries being taken over by an attacker by creating a similar Elastic beanstalk (EBS) in any AWS account which the attacker owns / controls. Attackers can use this domain to do phishing attacks, spread malware and other illegal activities. As a best practice, it is recommended to delete dangling DNS records entry from your AWS Route 53 hosted zones.</p><pre><code>config from cloud.resource where api.name = 'aws-route53-list-hosted-zones' AND json.rule = hostedZone.config.privateZone is false and resourceRecordSet[?any( type equals CNAME and resourceRecords[*].value contains elasticbeanstalk.com)] exists as X; config from cloud.resource where api.name = 'aws-elasticbeanstalk-environment' as Y; filter 'not (X.resourceRecordSet[*].resourceRecords[*].value intersects $.Y.cname)'; show X;
</code></pre><p><strong>Policy Type—</strong> Config</p><p><strong>Severity—</strong> High</p></td></tr><tr><td><strong>Azure App Service web apps with public network access</strong></td><td><p>Identifies Azure App Service web apps that are publicly accessible. Publicly accessible web apps could allow malicious actors to remotely exploit if any vulnerabilities and could. It is recommended to configure the App Service web apps with private endpoints so that the web apps hosted are accessible only to restricted entities.</p><pre><code>config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-app-service' AND json.rule = 'kind starts with app and properties.state equal ignore case running and properties.publicNetworkAccess exists and properties.publicNetworkAccess equal ignore case Enabled and config.ipSecurityRestrictions[?any(action equals Allow and ipAddress equals Any)] exists'
</code></pre><p><strong>Policy Type—</strong> Config</p><p><strong>Severity—</strong> Medium</p></td></tr><tr><td><strong>Azure Function app configured with public network access</strong></td><td><p>Identifies Azure Function apps that are configured with public network access. Publicly accessible web apps could allow malicious actors to remotely exploit any vulnerabilities and could. It is recommended to configure the App Service web apps with private endpoints so that the functions hosted are accessible only to restricted entities.</p><pre><code>config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-app-service' AND json.rule = kind starts with functionapp and properties.state equal ignore case running and properties.publicNetworkAccess exists and properties.publicNetworkAccess equal ignore case ENABLED
</code></pre><p><strong>Policy Type—</strong> Config</p><p><strong>Severity—</strong> Medium</p></td></tr><tr><td><strong>Azure Data Explorer cluster double encryption is disabled</strong></td><td><p>Identifies Azure Data Explorer clusters in which double encryption is disabled. Double encryption adds a second layer of encryption using service-managed keys. It is recommended to enable infrastructure double encryption on Data Explorer clusters so that encryption can be implemented at the layer closest to the storage device or network wires.</p><pre><code>config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-kusto-clusters' AND json.rule = properties.state equal ignore case Running and properties.enableDoubleEncryption is false
</code></pre><p><strong>Policy Type—</strong> Config</p><p><strong>Severity—</strong> Informational</p></td></tr><tr><td><strong>Azure Data Explorer cluster disk encryption is disabled</strong></td><td><p>Identifies Azure Data Explorer clusters in which disk encryption is disabled. Enabling encryption at rest on your cluster provides data protection for stored data. It is recommended to enable disk encryption on Data Explorer clusters.</p><pre><code>config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-kusto-clusters' AND json.rule = properties.state equal ignore case Running and properties.enableDiskEncryption is false
</code></pre><p><strong>Policy Type—</strong> Config</p><p><strong>Severity—</strong> Medium</p></td></tr></tbody></table>

## Policy Updates

<table data-header-hidden><thead><tr><th></th><th></th></tr></thead><tbody><tr><td>POLICY UPDATES</td><td>DESCRIPTION</td></tr><tr><td><strong>Policy Updates—RQL</strong></td><td></td></tr><tr><td><strong>GCP VPC Flow logs for the subnet is set to Off</strong></td><td><p><strong>Changes—</strong> The policy RQL has been updated to exclude checking for proxy-only subnets in the policy as VPC flow logs are not supported for proxy-only subnets.</p><p><strong>Severity—</strong> Informational</p><p><strong>Policy Type—</strong> Config</p><p><strong>Current RQL—</strong></p><pre><code>config from cloud.resource where cloud.type = 'gcp' AND api.name = 'gcloud-compute-networks-subnets-list' AND json.rule = purpose does not contain INTERNAL_HTTPS_LOAD_BALANCER and (enableFlowLogs is false or enableFlowLogs does not exist)
</code></pre><p><strong>Updated RQL—</strong></p><pre><code>config from cloud.resource where cloud.type = 'gcp' AND api.name = 'gcloud-compute-networks-subnets-list' AND json.rule = purpose does not contain INTERNAL_HTTPS_LOAD_BALANCER and purpose does not contain "REGIONAL_MANAGED_PROXY" and (enableFlowLogs is false or enableFlowLogs does not exist)
</code></pre><p><strong>Impact—</strong> Low. Alerts generated for proxy-only subnets will be resolved as <strong>Policy_updated</strong>.</p></td></tr></tbody></table>

## IAM Policy Updates

Prisma Cloud has updated the IAM policy as follows:

<table data-header-hidden><thead><tr><th></th><th></th><th></th><th></th></tr></thead><tbody><tr><td>CURRENT POLICY NAME</td><td>UPDATED POLICY NAME</td><td>CURRENT RQL</td><td>UPDATED RQL</td></tr><tr><td><strong>EC2 with IAM role attached has s3:GetObject permission</strong></td><td><strong>EC2 with IAM role attached has s3:GetObject and s3:ListBucket permissions</strong></td><td><pre><code>config from iam where dest.cloud.type = 'AWS' AND action.name IN ('s3:ListBucket') AND source.cloud.service.name = 'ec2' AND source.cloud.resource.type = 'instance'
</code></pre></td><td><pre><code>config from iam where dest.cloud.type = 'AWS' AND action.name CONTAINS ALL ('s3:ListBucket', 's3:GetObject') AND source.cloud.service.name = 'ec2' AND source.cloud.resource.type = 'instance'
</code></pre></td></tr></tbody></table>

## Changes in Existing Behavior

| FEATURE                   | DESCRIPTION                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     |
| ------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Microsegmentation EoS** | With the 23.8.1 release, the credit usage for Microsegmentation is no longer displayed on "Settings > Licensing". This change follows the announcement of the Microsegmentation capabilities as [End-of-Sale](https://www.paloaltonetworks.com/services/support/end-of-life-announcements/end-of-sale) effective August 31, 2022. To retrieve your credit consumption for Microsegmentation, you can use the [POST /license/api/v1/usage](https://pan.dev/prisma-cloud/api/cspm/license-usage-count-by-cloud-paginated-1/) API. |

## REST API Updates

No REST API updates for 23.8.1.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.prismacloud.io/release-notes/prisma-cloud-release-information/classic-releases/prisma-cloud-cspm-release-information/features-introduced-in-august-2023.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.