> For the complete documentation index, see [llms.txt](https://docs.prismacloud.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.prismacloud.io/release-notes/prisma-cloud-release-information/classic-releases/prisma-cloud-cspm-release-information/features-introduced-in-june-2023.md).

# Features Introduced in June 2023

Learn what’s new on Prisma® Cloud in June 2023.

* [New Features Introduced in 23.6.2](#new-features-jun-2)
* [New Features Introduced in 23.6.1](#new-features-jun-1)

## New Features Introduced in 23.6.2

* [New Features](#new-features2)
* [API Ingestions](#api-ingestions2)
* [New Policies](#new-policies2)
* [Policy Updates](#policy-updates2)
* [New Compliance Benchmarks and Updates](#new-compliance-benchmarks-and-updates2)
* [Changes in Existing Behavior](#changes-in-existing-behavior2)
* [REST API Updates](#rest-api-updates2)

## New Features

| FEATURE                                                                                                                                          | DESCRIPTION                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              |
| ------------------------------------------------------------------------------------------------------------------------------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **IAM Security metrics included in Cloud Security Report powered by Adoption Advisor** <mark style="background-color:orange;">Enhancement</mark> | <p>Implement least-privileged access by quantifying and sharing key IAM security metrics, such as unused over-privileged permissions, now available in the Prisma Cloud Cloud Security report powered by Adoption Advisor. These newly surfaced KPIs allow you to minimize the attack surface by restricting excessive permissions that may pose a significant security risk.</p><p>Navigate to <strong>Adoption Advisor > Create Report</strong> from the Prisma Cloud administrative console to explore the latest available IAM security metrics.</p> |

## API Ingestions

| SERVICE                                                                 | API DETAILS                                                                                                                                                                                                              |
| ----------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| **Amazon API Gateway**                                                  | <p><strong>aws-apigatewayv2-route</strong></p><p>Additional permission required:</p><ul><li><code>apigateway:GET</code></li></ul><p>The Security Audit role includes the permission.</p>                                 |
| **Amazon Route53** <mark style="background-color:orange;">Update</mark> | <p><strong>aws-route53-list-hosted-zones</strong></p><p>The resource JSON for this API will be updated to remove a “.”(dot) at the end from the field. <code>resourceRecordSet\[\*].name</code></p>                      |
| **AWS WAF**                                                             | <p><strong>aws-waf-v2-rule-group</strong></p><p>Additional permission required:</p><ul><li><code>wafv2:ListRuleGroups</code></li></ul><p>The Security Audit role includes the permission.</p>                            |
| **OCI Block Storage**                                                   | <p><strong>oci-block-storage-volume-group</strong></p><p>Additional permission required:</p><ul><li><code>VOLUME\_GROUP\_INSPECT</code></li></ul><p>You must update the Terraform template to enable the permission.</p> |
| **OCI Database**                                                        | <p><strong>oci-database-keystore</strong></p><p>Additional permission required:</p><ul><li><code>KEY\_STORE\_INPSECT</code></li></ul><p>You must update the Terraform template to enable the permission.</p>             |

## New Policies

<table data-header-hidden><thead><tr><th></th><th></th></tr></thead><tbody><tr><td>NEW POLICIES</td><td>DESCRIPTION</td></tr><tr><td><strong>GCP VM instance that is reachable from untrust internet source to ports with high risk</strong></td><td><p>Identifies GCP VM instances that are reachable from untrusted internet sources to ports with high risk. VM instances with unrestricted access to the internet for high risky port may enable bad actors to use brute force on a system to gain unauthorized access to the entire network. As a best practice, restrict traffic from unknown IP addresses and limit access to known hosts, services, or specific entities.</p><pre><code>config from network where source.network = UNTRUST_INTERNET and dest.resource.type = 'Instance' and dest.cloud.type = 'GCP' and dest.resource.state = 'Active' and protocol.ports in ( 'tcp/20:21', 'tcp/23', 'tcp/25', 'tcp/110', 'tcp/135', 'tcp/143', 'tcp/445', 'tcp/1433:1434', 'tcp/3000', 'tcp/3306', 'tcp/4333', 'tcp/5000', 'tcp/5432', 'tcp/5500', 'tcp/5601', 'tcp/8080', 'tcp/8088', 'tcp/8888', 'tcp/9200', 'tcp/9300' )
</code></pre><p><strong>Policy Type—</strong> Network</p><p><strong>Severity—</strong> High</p></td></tr></tbody></table>

## Policy Updates

| POLICY UPDATES                                              | DESCRIPTION                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                |
| ----------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| **Policy Updates-Metadata**                                 |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            |
| **AWS S3 bucket policy overly permissive to any principal** | <p><strong>Changes—</strong> Updating Policy Name, and Description</p><p><strong>Policy Type—</strong> Config</p><p><strong>Severity—</strong> Medium</p><p><strong>Policy Name—</strong> AWS S3 buckets are accessible to public</p><p><strong>Updated Policy Name—</strong> AWS S3 buckets are accessible to public via ACL</p><p><strong>Description-</strong> The policy name, description, and recommendation steps are updated to be specific on the criteria through which the S3 bucket is made public. Amazon S3 often stores highly sensitive enterprise data, allowing public access to S3 buckets through ACL results in sensitive data being compromised. It is highly recommended to disable ACL configuration for all S3 buckets and use resource based policies to allow access to S3 buckets.</p><p><strong>Impact—</strong> No impact, as this is a metadata change.</p> |

## New Compliance Benchmarks and Updates

No new compliance benchmarks and updates for 23.6.2.

## Changes in Existing Behavior

| FEATURE                                | DESCRIPTION                                                                                                                                                                                                                                                                                           |
| -------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Rate Limit on POST /login Endpoint** | <p>The <a href="https://pan.dev/prisma-cloud/api/cspm/app-login/">POST /login</a> endpoint will enforce rate limiting (HTTP Response Code 429).</p><p><mark style="background-color:orange;">This change was first announced in the look ahead that was published with the 23.5.1 release.</mark></p> |

## REST API Updates

No REST API updates for 23.6.2.

## New Features Introduced in 23.6.1

* [New Features](#new-features1)
* [API Ingestions](#api-ingestions1)
* [New Policies](#new-policies1)
* [Policy Updates](#policy-updates1)
* [New Compliance Benchmarks and Updates](#new-compliance-benchmarks-and-updates1)
* [Changes in Existing Behavior](#changes-in-existing-behavior1)
* [REST API Updates](#rest-api-updates1)

## New Features

| FEATURE                                                         | DESCRIPTION                                                                                                                                                                                                                                                                                                                                                                                                                                               |
| --------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Trendline for Critical Severity in Adoption Advisor Widgets** | <p>The Assets With Urgent Alerts, Incident Burndown, and Risk Burndown widgets have a trendline for critical severity alerts and assets to help you quickly review the trends for the most critical issues.</p><p>For Assets With Urgent Alerts, you can see the critical and high severity asset data points in all the 30, 60, and 90 day time series starting June 2023.</p><p><img src="/files/MI4oaU5YScjh4CekRDBN" alt="" data-size="original"></p> |

## API Ingestions

| SERVICE                | API DETAILS                                                                                                                                                                                                                                                                                                                            |
| ---------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Amazon DAX**         | <p><strong>aws-dax-parameter-group</strong></p><p>Additional permissions required:</p><ul><li><code>dax:DescribeParameterGroups</code></li><li><code>dax:DescribeParameters</code></li></ul><p>The Security Audit role includes the permissions.</p>                                                                                   |
| **AWS Shield**         | <p><strong>aws-shield-drt-access</strong></p><p>Additional permission required:</p><ul><li><code>shield:DescribeDRTAccess</code></li></ul><p>The Security Audit role includes the permission.</p>                                                                                                                                      |
| **Amazon API Gateway** | <p><strong>aws-apigatewayv2-stage</strong></p><p>Additional permission required:</p><ul><li><code>apigateway:GET</code></li></ul><p>The Security Audit role includes the permission.</p>                                                                                                                                               |
| **Google Cloud DNS**   | <p><strong>gcloud-dns-resource-record-set</strong></p><p>Additional permissions required:</p><ul><li><code>dns.managedZones.list</code></li><li><code>dns.resourceRecordSets.list</code></li></ul><p>The Viewer role includes the permissions.</p>                                                                                     |
| **Google Vertex AI**   | <p><strong>gcloud-vertex-ai-notebook-instance-schedule</strong></p><p>Additional permissions required:</p><ul><li><code>notebooks.locations.list</code></li><li><code>notebooks.schedules.list</code></li></ul><p>The Viewer role includes the permissions.</p>                                                                        |
| **Google Dataplex**    | <p><strong>gcloud-dataplex-lake-zone-action</strong></p><p>Additional permissions required:</p><ul><li><code>dataplex.locations.list</code></li><li><code>dataplex.lakes.list</code></li><li><code>dataplex.zones.list</code></li><li><code>dataplex.zoneActions.list</code></li></ul><p>The Viewer role includes the permissions.</p> |
| **Google Dataplex**    | <p><strong>gcloud-dataplex-lake-action</strong></p><p>Additional permissions required:</p><ul><li><code>dataplex.locations.list</code></li><li><code>dataplex.lakes.list</code></li><li><code>dataplex.lakeActions.list</code></li></ul><p>The Viewer role includes the permissions.</p>                                               |
| **OCI Service Mesh**   | <p><strong>oci-service-mesh-ingressgateway-routetable</strong></p><p>Additional permissions required:</p><ul><li><code>MESH\_INGRESS\_GATEWAY\_ROUTE​\_TABLE\_LIST</code></li><li><code>MESH\_INGRESS\_GATEWAY\_ROUTE​\_TABLE\_READ</code></li></ul><p>You must update the Terraform template to enable the permissions.</p>           |
| **OCI Service Mesh**   | <p><strong>oci-service-mesh-ingressgateway</strong></p><p>Additional permissions required:</p><ul><li><code>MESH\_INGRESS\_GATEWAY​\_LIST</code></li><li><code>MESH\_INGRESS\_GATEWAY​\_READ</code></li></ul><p>You must update the Terraform template to enable the permissions.</p>                                                  |
| **OCI Database**       | <p><strong>oci-database-db-node</strong></p><p>Additional permissions required:</p><ul><li><code>DB\_SYSTEM\_INSPECT</code></li><li><code>DB\_NODE\_INSPECT</code></li><li><code>DB\_NODE\_QUERY</code></li></ul><p>You must update the Terraform template to enable the permissions.</p>                                              |

## New Policies

<table data-header-hidden><thead><tr><th></th><th></th></tr></thead><tbody><tr><td>NEW POLICIES</td><td>DESCRIPTION</td></tr><tr><td><strong>AWS EC2 instance that is internet reachable with unrestricted access (0.0.0.0/0) to Admin ports</strong></td><td><p>Identifies AWS EC2 instances that are internet reachable with unrestricted access (0.0.0.0/0) to Admin ports (22 / 3389). EC2 instances with unrestricted access to the internet for admin ports may enable bad actors to use brute force on a system to gain unauthorized access to the entire network. As a best practice, restrict traffic from unknown IP addresses and limit access to known hosts, services, or specific entities.</p><pre><code>config from network where source.network = '0.0.0.0/0' and address.match.criteria = 'full_match' and dest.resource.type = 'Instance' and dest.cloud.type = 'AWS' and dest.resource.state = 'Active' and protocol.ports in ( 'tcp/22', 'tcp/3389' )
</code></pre><p><strong>Policy Type—</strong> Network</p><p><strong>Severity—</strong> High.</p></td></tr><tr><td><strong>AWS EC2 instance that is reachable from untrust internet source to ports with high risk</strong></td><td><p>Identifies AWS EC2 instances that are internet reachable with untrust internet source to ports with high risk. EC2 instances with unrestricted access to the internet for high risky port may enable bad actors to use brute force on a system to gain unauthorized access to the entire network. As a best practice, restrict traffic from unknown IP addresses and limit the access to known hosts, services, or specific entities.</p><pre><code>config from network where source.network = UNTRUST_INTERNET and dest.resource.type = 'Instance' and dest.cloud.type = 'AWS' and protocol.ports in ( 'tcp/20:21', 'tcp/23', 'tcp/25', 'tcp/110', 'tcp/135', 'tcp/143', 'tcp/445', 'tcp/1433:1434', 'tcp/3000', 'tcp/3306', 'tcp/4333', 'tcp/5000', 'tcp/5432', 'tcp/5500', 'tcp/5601', 'tcp/8080', 'tcp/8088', 'tcp/8888', 'tcp/9200', 'tcp/9300' )
</code></pre><p><strong>Policy Type—</strong> Network</p><p><strong>Severity—</strong> High.</p></td></tr><tr><td><strong>Azure Virtual Machine that is internet reachable with unrestricted access (0.0.0.0/0) to Admin ports</strong></td><td><p>Identifies Azure Virtual Machines that are internet reachable with unrestricted access (0.0.0.0/0) to admin ports. Azure VMs with unrestricted internet access to admin ports may enable bad actors to use brute force on a system to gain unauthorized access to the entire network. As a best practice, restrict traffic from unknown IP addresses and limit the access to known hosts, services, or specific entities.</p><pre><code>config from network where source.network = '0.0.0.0/0' and address.match.criteria = 'full_match' and dest.resource.type = 'Instance' and dest.cloud.type = 'Azure' and protocol.ports in ('tcp/22','tcp/3389' ) and dest.resource.state = 'Active'
</code></pre><p><strong>Policy Type—</strong> Network</p><p><strong>Severity—</strong> High.</p></td></tr><tr><td><strong>GCP VM instance that is internet reachable with unrestricted access (0.0.0.0/0) to Admin ports</strong></td><td><p>Identifies GCP VM instances that are internet reachable with unrestricted access (0.0.0.0/0) to Admin ports (22 / 3389). VM instances with unrestricted internet access to admin ports may enable bad actors to use brute force on a system to gain unauthorized access to the entire network. As a best practice, restrict traffic from unknown IP addresses and limit access to known hosts, services, or specific entities.</p><pre><code>config from network where source.network = '0.0.0.0/0' and address.match.criteria = 'full_match' and dest.resource.type = 'Instance' and dest.cloud.type = 'GCP' and dest.resource.state = 'Active' and protocol.ports in ( 'tcp/22', 'tcp/3389' )
</code></pre><p><strong>Policy Type—</strong> Network</p><p><strong>Severity—</strong> High.</p></td></tr></tbody></table>

## Policy Updates

<table data-header-hidden><thead><tr><th></th><th></th></tr></thead><tbody><tr><td>POLICY UPDATES</td><td>DESCRIPTION</td></tr><tr><td><strong>Policy Updates—RQL</strong></td><td></td></tr><tr><td><strong>AWS S3 bucket policy overly permissive to any principal</strong></td><td><p><strong>Changes—</strong> The policy description and RQL are updated. The RQL now considers <strong>Block public access</strong> settings configuration at account and bucket Level.</p><p><strong>Updated Description—</strong> Identifies the S3 buckets that have a bucket policy overly permissive to any principal and don’t have Block public and cross-account access to buckets and objects through any public bucket or access point policies enabled. It is recommended to follow the principle of least privileges ensuring that the only restricted entities have permission on S3 operations instead of any anonymous.</p><p><strong>Policy Type—</strong> Config</p><p><strong>Severity—</strong> Medium.</p><p><strong>Current RQL—</strong></p><pre><code>config from cloud.resource where cloud.type = 'aws' AND api.name='aws-s3api-get-bucket-acl' AND json.rule = policy.Statement[?any(Effect equals Allow and Action anyStartWith s3: and (Principal.AWS contains * or Principal equals *) and Condition does not exist)] exists
</code></pre><p><strong>Updated RQL—</strong></p><pre><code>config from cloud.resource where cloud.type = 'aws' AND api.name='aws-s3api-get-bucket-acl' AND json.rule = ( ( publicAccessBlockConfiguration.restrictPublicBuckets is false and accountLevelPublicAccessBlockConfiguration does not exist ) or ( publicAccessBlockConfiguration does not exist and accountLevelPublicAccessBlockConfiguration.restrictPublicBuckets is false ) or ( publicAccessBlockConfiguration.restrictPublicBuckets is false and accountLevelPublicAccessBlockConfiguration.restrictPublicBuckets is false ) or ( publicAccessBlockConfiguration does not exist and accountLevelPublicAccessBlockConfiguration does not exist ) )AND policy.Statement[?any(Effect equals Allow and Action anyStartWith s3: and (Principal.AWS contains * or Principal equals *) and (Condition does not exist or Condition[*] is empty) )] exists
</code></pre><p><strong>Impact—</strong> Medium. Based on the Block Public Access settings at account and bucket Level, some alerts might get resolved.</p></td></tr><tr><td><strong>AWS S3 bucket publicly writable</strong></td><td><p><strong>Changes—</strong> The policy remediation steps and RQL are updated. The policy RQL now checks for <strong>Authenticated Users</strong> access.</p><p><strong>Policy Type—</strong> Config</p><p><strong>Severity—</strong> High.</p><p><strong>Current RQL—</strong></p><pre><code>config from cloud.resource where cloud.type = 'aws' AND api.name = 'aws-s3api-get-bucket-acl' AND json.rule = ((((publicAccessBlockConfiguration.ignorePublicAcls is false and accountLevelPublicAccessBlockConfiguration does not exist) or (publicAccessBlockConfiguration does not exist and accountLevelPublicAccessBlockConfiguration.ignorePublicAcls is false) or (publicAccessBlockConfiguration.ignorePublicAcls is false and accountLevelPublicAccessBlockConfiguration.ignorePublicAcls is false)) and acl.grantsAsList[?any(grantee equals AllUsers and permission is member of (WriteAcp,Write,FullControl))] exists) or ((policyStatus.isPublic is true and ((publicAccessBlockConfiguration.restrictPublicBuckets is false and accountLevelPublicAccessBlockConfiguration does not exist) or (publicAccessBlockConfiguration does not exist and accountLevelPublicAccessBlockConfiguration.restrictPublicBuckets is false) or (publicAccessBlockConfiguration.restrictPublicBuckets is false and accountLevelPublicAccessBlockConfiguration.restrictPublicBuckets is false))) and (policy.Statement[?any(Effect equals Allow and (Principal equals * or Principal.AWS equals *) and (Action contains s3:* or Action contains s3:Put or Action contains s3:Create or Action contains s3:Replicate or Action contains s3:Update or Action contains s3:Delete) and (Condition does not exist))] exists))) and websiteConfiguration does not exist
</code></pre><p><strong>Updated RQL—</strong></p><pre><code>config from cloud.resource where cloud.type = 'aws' AND api.name = 'aws-s3api-get-bucket-acl' AND json.rule = ((((publicAccessBlockConfiguration.ignorePublicAcls is false and accountLevelPublicAccessBlockConfiguration does not exist) or (publicAccessBlockConfiguration does not exist and accountLevelPublicAccessBlockConfiguration.ignorePublicAcls is false) or (publicAccessBlockConfiguration.ignorePublicAcls is false and accountLevelPublicAccessBlockConfiguration.ignorePublicAcls is false)) and (acl.grantsAsList[?any(grantee equals AllUsers and permission is member of (WriteAcp,Write,FullControl))] exists or acl.grantsAsList[?any(grantee equals AuthenticatedUsers and permission is member of (WriteAcp,Write,FullControl))] exists)) or ((policyStatus.isPublic is true and ((publicAccessBlockConfiguration.restrictPublicBuckets is false and accountLevelPublicAccessBlockConfiguration does not exist) or (publicAccessBlockConfiguration does not exist and accountLevelPublicAccessBlockConfiguration.restrictPublicBuckets is false) or (publicAccessBlockConfiguration.restrictPublicBuckets is false and accountLevelPublicAccessBlockConfiguration.restrictPublicBuckets is false))) and (policy.Statement[?any(Effect equals Allow and (Principal equals * or Principal.AWS equals *) and (Action contains s3:* or Action contains s3:Put or Action contains s3:Create or Action contains s3:Replicate or Action contains s3:Update or Action contains s3:Delete) and (Condition does not exist))] exists))) and websiteConfiguration does not exist
</code></pre><p><strong>Impact—</strong> Low. New alerts may be generated if Authenticated Users have <em>Write</em> permissions.</p></td></tr><tr><td><strong>GCP Log metric filter and alert does not exist for VPC network route delete and insert</strong></td><td><p><strong>Changes—</strong> The Policy RQL is updated to verify if <em>resource type</em> is present in the Log metric filter.</p><p><strong>Policy Type—</strong> Config</p><p><strong>Severity—</strong> Informational.</p><p><strong>Current RQL—</strong></p><pre><code>config from cloud.resource where api.name = 'gcloud-logging-metric' as X; config from cloud.resource where api.name = 'gcloud-monitoring-policies-list' as Y; filter '$.Y.conditions[*].metricThresholdFilter contains $.X.name and ( $.X.filter does not contain "resource.type =" or $.X.filter does not contain "resource.type=" ) and ( $.X.filter does not contain "resource.type !=" and $.X.filter does not contain "resource.type!=" ) and $.X.filter contains "gce_route" and ( $.X.filter contains "protoPayload.methodName:" or $.X.filter contains "protoPayload.methodName :" ) and ( $.X.filter does not contain "protoPayload.methodName!:" and $.X.filter does not contain "protoPayload.methodName !:" ) and $.X.filter contains "compute.routes.delete" and $.X.filter contains "compute.routes.insert"'; show X; count(X) less than 1
</code></pre><p><strong>Updated RQL—</strong></p><pre><code>config from cloud.resource where api.name = 'gcloud-logging-metric' as X; config from cloud.resource where api.name = 'gcloud-monitoring-policies-list' as Y; filter '$.Y.conditions[*].metricThresholdFilter contains $.X.name and ( $.X.filter contains "resource.type =" or $.X.filter contains "resource.type=" ) and ( $.X.filter does not contain "resource.type !=" and $.X.filter does not contain "resource.type!=" ) and $.X.filter contains "gce_route" and ( $.X.filter contains "protoPayload.methodName:" or $.X.filter contains "protoPayload.methodName :" ) and ( $.X.filter does not contain "protoPayload.methodName!:" and $.X.filter does not contain "protoPayload.methodName !:" ) and $.X.filter contains "compute.routes.delete" and $.X.filter contains "compute.routes.insert"'; show X; count(X) less than 1
</code></pre><p><strong>Impact—</strong> Low. New alerts will be generated against the policy violations.</p></td></tr><tr><td><strong>GCP Log metric filter and alert does not exist for VPC network route changes</strong></td><td><p><strong>Changes—</strong> The Policy RQL is updated to verify if <em>resource type</em> is present in the Log metric filter.</p><p><strong>Policy Type—</strong> Config</p><p><strong>Severity—</strong> Informational.</p><p><strong>Current RQL—</strong></p><pre><code>config from cloud.resource where api.name = 'gcloud-logging-metric' as X; config from cloud.resource where api.name = 'gcloud-monitoring-policies-list' as Y; filter '$.Y.conditions[*].metricThresholdFilter contains $.X.name and ($.X.filter does not contain "resource.type =" or $.X.filter does not contain "resource.type=") and ($.X.filter does not contain "resource.type !=" and $.X.filter does not contain "resource.type!=") and $.X.filter contains "gce_route" and ($.X.filter contains "jsonPayload.event_subtype=" or $.X.filter contains "jsonPayload.event_subtype =") and ($.X.filter does not contain "jsonPayload.event_subtype!=" and $.X.filter does not contain "jsonPayload.event_subtype !=") and $.X.filter contains "compute.routes.delete" and $.X.filter contains "compute.routes.insert"'; show X; count(X) less than 1
</code></pre><p><strong>Updated RQL—</strong></p><pre><code>config from cloud.resource where api.name = 'gcloud-logging-metric' as X; config from cloud.resource where api.name = 'gcloud-monitoring-policies-list' as Y; filter '$.Y.conditions[*].metricThresholdFilter contains $.X.name and ($.X.filter contains "resource.type =" or $.X.filter contains "resource.type=") and ($.X.filter does not contain "resource.type !=" and $.X.filter does not contain "resource.type!=") and $.X.filter contains "gce_route" and ($.X.filter contains "jsonPayload.event_subtype=" or $.X.filter contains "jsonPayload.event_subtype =") and ($.X.filter does not contain "jsonPayload.event_subtype!=" and $.X.filter does not contain "jsonPayload.event_subtype !=") and $.X.filter contains "compute.routes.delete" and $.X.filter contains "compute.routes.insert"'; show X; count(X) less than 1
</code></pre><p><strong>Impact—</strong> Low. New alerts will be generated against the policy violations.</p></td></tr><tr><td><strong>GCP Log metric filter and alert does not exist for VPC network route patch and insert</strong></td><td><p><strong>Changes—</strong> The Policy RQL is updated to verify if <em>resource type</em> is present in the Log metric filter.</p><p><strong>Policy Type—</strong> Config</p><p><strong>Severity—</strong> Informational.</p><p><strong>Current RQL—</strong></p><pre><code>config from cloud.resource where api.name = 'gcloud-logging-metric' as X; config from cloud.resource where api.name = 'gcloud-monitoring-policies-list' as Y; filter '$.Y.conditions[*].metricThresholdFilter contains $.X.name and ( $.X.filter does not contain "resource.type =" or $.X.filter does not contain "resource.type=" ) and ( $.X.filter does not contain "resource.type !=" and $.X.filter does not contain "resource.type!=" ) and $.X.filter contains "gce_route" and ( $.X.filter contains "protoPayload.methodName=" or $.X.filter contains "protoPayload.methodName =" ) and ( $.X.filter does not contain "protoPayload.methodName!=" and $.X.filter does not contain "protoPayload.methodName !=" ) and $.X.filter contains "beta.compute.routes.patch" and $.X.filter contains "beta.compute.routes.insert"'; show X; count(X) less than 1
</code></pre><p><strong>Updated RQL—</strong></p><pre><code>config from cloud.resource where api.name = 'gcloud-logging-metric' as X; config from cloud.resource where api.name = 'gcloud-monitoring-policies-list' as Y; filter '$.Y.conditions[*].metricThresholdFilter contains $.X.name and ( $.X.filter contains "resource.type =" or $.X.filter contains "resource.type=" ) and ( $.X.filter does not contain "resource.type !=" and $.X.filter does not contain "resource.type!=" ) and $.X.filter contains "gce_route" and ( $.X.filter contains "protoPayload.methodName=" or $.X.filter contains "protoPayload.methodName =" ) and ( $.X.filter does not contain "protoPayload.methodName!=" and $.X.filter does not contain "protoPayload.methodName !=" ) and $.X.filter contains "beta.compute.routes.patch" and $.X.filter contains "beta.compute.routes.insert"'; show X; count(X) less than 1
</code></pre><p><strong>Impact—</strong> Low. New alerts will be generated against the policy violations.</p></td></tr><tr><td><strong>GCP Log metric filter and alert does not exist for VPC network changes</strong></td><td><p><strong>Changes—</strong> The Policy RQL is updated to verify if <em>resource type</em> is present in the Log metric filter.</p><p><strong>Policy Type—</strong> Config</p><p><strong>Severity—</strong> Informational.</p><p><strong>Current RQL—</strong></p><pre><code>config from cloud.resource where api.name = 'gcloud-logging-metric' as X; config from cloud.resource where api.name = 'gcloud-monitoring-policies-list' as Y; filter '$.Y.conditions[*].metricThresholdFilter contains $.X.name and ($.X.filter does not contain "resource.type =" or $.X.filter does not contain "resource.type=") and ($.X.filter does not contain "resource.type !=" and $.X.filter does not contain "resource.type!=") and $.X.filter contains "gce_network" and ($.X.filter contains "jsonPayload.event_subtype=" or $.X.filter contains "jsonPayload.event_subtype =") and ($.X.filter does not contain "jsonPayload.event_subtype!=" and $.X.filter does not contain "jsonPayload.event_subtype !=") and $.X.filter contains "compute.networks.insert" and $.X.filter contains "compute.networks.patch" and $.X.filter contains "compute.networks.delete" and $.X.filter contains "compute.networks.removePeering" and $.X.filter contains "compute.networks.addPeering"'; show X; count(X) less than 1
</code></pre><p><strong>Updated RQL—</strong></p><pre><code>config from cloud.resource where api.name = 'gcloud-logging-metric' as X; config from cloud.resource where api.name = 'gcloud-monitoring-policies-list' as Y; filter '$.Y.conditions[*].metricThresholdFilter contains $.X.name and ($.X.filter contains "resource.type =" or $.X.filter contains "resource.type=") and ($.X.filter does not contain "resource.type !=" and $.X.filter does not contain "resource.type!=") and $.X.filter contains "gce_network" and ($.X.filter contains "jsonPayload.event_subtype=" or $.X.filter contains "jsonPayload.event_subtype =") and ($.X.filter does not contain "jsonPayload.event_subtype!=" and $.X.filter does not contain "jsonPayload.event_subtype !=") and $.X.filter contains "compute.networks.insert" and $.X.filter contains "compute.networks.patch" and $.X.filter contains "compute.networks.delete" and $.X.filter contains "compute.networks.removePeering" and $.X.filter contains "compute.networks.addPeering"'; show X; count(X) less than 1
</code></pre><p><strong>Impact—</strong> Low. New alerts will be generated against the policy violations.</p></td></tr><tr><td><strong>GCP Log metric filter and alert does not exist for Cloud Storage IAM permission changes</strong></td><td><p><strong>Changes—</strong> The Policy RQL is updated to verify if <em>resource type</em> is present in the Log metric filter.</p><p><strong>Policy Type—</strong> Config</p><p><strong>Severity—</strong> Informational.</p><p><strong>Current RQL—</strong></p><pre><code>config from cloud.resource where api.name = 'gcloud-logging-metric' as X; config from cloud.resource where api.name = 'gcloud-monitoring-policies-list' as Y; filter '$.Y.conditions[*].metricThresholdFilter contains $.X.name and ($.X.filter does not contain "resource.type =" or $.X.filter does not contain "resource.type=") and ($.X.filter does not contain "resource.type !=" and $.X.filter does not contain "resource.type!=") and $.X.filter contains "gcs_bucket" and ($.X.filter contains "protoPayload.methodName=" or $.X.filter contains "protoPayload.methodName =") and ($.X.filter does not contain "protoPayload.methodName!=" and $.X.filter does not contain "protoPayload.methodName !=") and $.X.filter contains "storage.setIamPermissions"'; show X; count(X) less than 1
</code></pre><p><strong>Updated RQL—</strong></p><pre><code>config from cloud.resource where api.name = 'gcloud-logging-metric' as X; config from cloud.resource where api.name = 'gcloud-monitoring-policies-list' as Y; filter '$.Y.conditions[*].metricThresholdFilter contains $.X.name and ($.X.filter contains "resource.type =" or $.X.filter contains "resource.type=") and ($.X.filter does not contain "resource.type !=" and $.X.filter does not contain "resource.type!=") and $.X.filter contains "gcs_bucket" and ($.X.filter contains "protoPayload.methodName=" or $.X.filter contains "protoPayload.methodName =") and ($.X.filter does not contain "protoPayload.methodName!=" and $.X.filter does not contain "protoPayload.methodName !=") and $.X.filter contains "storage.setIamPermissions"'; show X; count(X) less than 1
</code></pre><p><strong>Impact—</strong> Low. New alerts will be generated against the policy violations.</p></td></tr></tbody></table>

## New Compliance Benchmarks and Updates

| COMPLIANCE BENCHMARK                                                  | DESCRIPTION                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 |
| --------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **CIS Google Kubernetes Engine (GKE) v1.4.0 - (Level 1 and Level 2)** | <p>The Center for Internet Security (CIS) releases benchmarks for best practice security recommendations. CIS Google Kubernetes Engine (GKE) v1.4.0 - (Level 1 and Level 2) is a set of recommendations for configuring Kubernetes to support a strong security posture. Benchmarks are tied to specific Kubernetes releases. The CIS Kubernetes Benchmark is written for open-source Kubernetes distribution and is intended to be universally applicable. Based on the existing CIS Benchmark, this standard adds additional Google Cloud-specific controls.</p><p>You can review this compliance standard and its associated policies on Prisma Cloud’s <strong>Compliance > Standard</strong> page.</p> |

## Changes in Existing Behavior

| FEATURE                                                                                                                                                                                                      | DESCRIPTION                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    |
| ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| <p><strong>S3 Flow Logs with Hourly Partition</strong></p><p><mark style="background-color:orange;">This change was first announced in the look ahead that was published with the 23.1.1 release.</mark></p> | <p>If you currently ingest AWS flow logs using S3 with the 24-hour partition, you need to change it to the hourly partition.</p><p>To make this change, <a href="https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-admin/connect-your-cloud-platform-to-prisma-cloud/onboard-aws/configure-flow-logs">Configure Flow Logs</a> to use the hourly partition and enable the required additional fields.</p><p><strong>Impact</strong>— VPC Flow logs with partitions set to <strong>Every 24 hours (default)</strong> will be disabled. As a result, you will no longer be able to monitor or receive alerts for these logs.</p> |

## REST API Updates

No REST API updates for 23.6.1.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.prismacloud.io/release-notes/prisma-cloud-release-information/classic-releases/prisma-cloud-cspm-release-information/features-introduced-in-june-2023.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.