> For the complete documentation index, see [llms.txt](https://docs.prismacloud.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.prismacloud.io/release-notes/prisma-cloud-release-information/classic-releases/prisma-cloud-cspm-release-information/features-introduced-in-october-2023.md).

# Features Introduced in October 2023

Learn what’s new on Prisma® Cloud in October 2023.

* [New Features Introduced in 23.10.1](#new-features-oct-1)

## New Features Introduced in 23.10.1

* [New Features](#new-features1)
* [API Ingestions](#api-ingestions1)
* [New Policies](#new-policies1)
* [Policy Updates](#policy-updates1)
* [Changes in Existing Behavior](#changes-in-existing-behavior1)
* [REST API Updates](#rest-api-updates1)
* [Deprecation Notices](#deprecation-notices)

## New Features

| FEATURE                                             | DESCRIPTION                                                                                                                                                                                                                                                                                                                                                                                                                                        |
| --------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Service Provider initiated Single Sign On (SSO)** | Prisma Cloud introduces a new Service Provider initiated SSO capability. Leveraging OpenID Connect (OIDC), this option enables Prisma Cloud System Administrators to allow users to sign in to Prisma Cloud with their Identity Provider (IdP) credentials. Learn more about setting up [SP initiated SSO](https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-admin/manage-prisma-cloud-administrators/get-started-with-oidc-sso). |

## API Ingestions

| SERVICE                        | API DETAILS                                                                                                                                                                                                                                                                                                                                                                          |
| ------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| **AWS Budgets**                | <p><strong>aws-budgets-budget</strong></p><p>Additional permission required:</p><ul><li><code>budgets:ViewBudget</code></li></ul><p>You must manually add or update the CFT template to enable the permission.</p>                                                                                                                                                                   |
| **Amazon EC2**                 | <p><strong>aws-ec2-launch-template</strong></p><p>Additional permissions required:</p><ul><li><code>ec2:DescribeLaunchTemplates</code></li><li><code>ec2:DescribeLaunchTemplateVersions</code></li></ul><p>The Security Audit role includes the permissions.</p>                                                                                                                     |
| **AWS Well-Architected Tool**  | <p><strong>aws-well-architected-tool-workload</strong></p><p>Additional permissions required:</p><ul><li><code>wellarchitected:GetWorkload</code></li><li><code>wellarchitected:ListWorkloads</code></li></ul><p>You must manually add or update the CFT template to enable the permissions.</p>                                                                                     |
| **Azure CDN**                  | <p><strong>azure-frontdoor-standardpremium-afd-endpoints</strong></p><p>Additional permissions required:</p><ul><li><code>Microsoft.Cdn/profiles/read</code></li><li><code>Microsoft.Cdn/profiles/afdendpoints/read</code></li></ul><p>The Reader role includes the permissions.</p>                                                                                                 |
| **Azure DNS**                  | <p><strong>azure-dns-privatedns-zones</strong></p><p>Additional permission required:</p><ul><li><code>Microsoft.Network/privateDnsZones/read</code></li></ul><p>The Reader role includes the permission.</p>                                                                                                                                                                         |
| **Google Certificate Manager** | <p><strong>gcloud-certificate-manager-certificate</strong></p><p>Additional permissions required:</p><ul><li><code>certificatemanager.locations.list</code></li><li><code>certificatemanager.certs.list</code></li></ul><p>The Viewer role includes the permissions.</p><p>This API will not provide the details of CLASSIC Certificates under Google Cloud Certificate Manager.</p> |
| **Google Certificate Manager** | <p><strong>gcloud-certificate-manager-dns-authorization</strong></p><p>Additional permissions required:</p><ul><li><code>certificatemanager.locations.list</code></li><li><code>certificatemanager.dnsauthorizations.list</code></li></ul><p>The Viewer role includes the permissions.</p>                                                                                           |
| **Google Certificate Manager** | <p><strong>gcloud-certificate-manager-certificate-issuance-config</strong></p><p>Additional permission required:</p><ul><li><code>certificatemanager.certissuanceconfigs.list</code></li></ul><p>The Viewer role includes the permission.</p>                                                                                                                                        |
| **Google Certificate Manager** | <p><strong>gcloud-certificate-manager-certificate-map</strong></p><p>Additional permission required:</p><ul><li><code>certificatemanager.certmaps.list</code></li></ul><p>The Viewer role includes the permission.</p>                                                                                                                                                               |
| **OCI Cloud Guard**            | <p><strong>oci-cloudguard-detector-recipe</strong></p><p>Additional permissions required:</p><ul><li><code>CG\_DETECTOR\_RECIPE\_INSPECT</code></li><li><code>CG\_DETECTOR\_RECIPE\_READ</code></li></ul><p>You must update the Terraform template to enable the permissions.</p>                                                                                                    |

## New Policies

<table data-header-hidden><thead><tr><th></th><th></th></tr></thead><tbody><tr><td>POLICY UPDATES</td><td>DESCRIPTION</td></tr><tr><td><strong>Azure Storage account not configured with SAS expiration policy</strong></td><td><p>Identifies Azure Storage accounts not configured with SAS expiration policy.</p><p>A Shared Access Signature (SAS) expiration policy specifies a recommended interval over which the SAS is valid. SAS expiration policies apply to a service SAS or an account SAS. When a user generates service SAS or an account SAS with a validity interval that is larger than the recommended interval, they’ll see a warning. If Azure Storage logging with Azure Monitor is enabled, then an entry is written to the Azure Storage logs. It is recommended that you limit the interval for a SAS in case it is compromised.</p><pre><code>config from cloud.resource where cloud.type = 'azure' and api.name= 'azure-storage-account-list' AND json.rule = properties.provisioningState equal ignore case Succeeded and properties.allowSharedKeyAccess is true and properties.sasPolicy does not exist
</code></pre><p><strong>Severity—</strong> Low</p><p><strong>Policy Type—</strong> Config</p></td></tr><tr><td><strong>Azure Storage account configured with Shared Key authorization</strong></td><td><p>Identifies Azure Storage accounts configured with Shared Key authorization.</p><p>Azure Storage accounts authorized with Shared Key authorization via Shared Access Signature (SAS) tokens pose a security risk, as they allow sharing information with external unidentified identities. It is highly recommended to disable Shared Key authorization and Use Azure AD authorization as it provides superior security and ease of use over Shared Key.</p><pre><code>config from cloud.resource where cloud.type = 'azure' and api.name= 'azure-storage-account-list' AND json.rule = properties.provisioningState equal ignore case Succeeded and properties.allowSharedKeyAccess is true
</code></pre><p><strong>Severity—</strong> Medium</p><p><strong>Policy Type—</strong> Config</p></td></tr><tr><td><strong>Azure Virtual machine configured with public IP and serial console access</strong></td><td><p>Identifies Azure Virtual machines with public IP configured with serial console access (via Boot diagnostic setting).</p><p>The Microsoft Azure serial console feature provides access to a text-based console for virtual machines (VMs) running either Linux or Windows. Serial Console connects to the ttyS0 or COM1 serial port of the VM instance, providing access independent of the network or operating system state. Attacker can leverage public IP assigned Serial console enabled virtual machine for remote code execution and privilege escalation. It is recommended to restrict public access to the reported virtual machine and disable/restrict serial console feature.</p><pre><code>config from cloud.resource where cloud.type = 'azure' and api.name= 'azure-vm-list' AND json.rule = powerState contains "PowerState/running" and ['properties.networkProfile'].['networkInterfaces'][*].['publicIpAddressId'] exists and ['properties.diagnosticsProfile'].['bootDiagnostics'].['enabled'] is true
</code></pre><p><strong>Severity—</strong> Low</p><p><strong>Policy Type—</strong> Config</p></td></tr></tbody></table>

## Policy Updates

<table data-header-hidden><thead><tr><th></th><th></th></tr></thead><tbody><tr><td>POLICY UPDATES</td><td>DESCRIPTION</td></tr><tr><td><strong>Policy Updates—RQL</strong></td><td></td></tr><tr><td><strong>Azure Activity Log Policies</strong></td><td><p><strong>Changes—</strong> The RQL has been updated to ignore the case for the location parameter <strong>Global</strong> for the following policies:</p><ul><li><strong>Policy Name—</strong> Azure Activity log alert for Delete security solution does not exist</li></ul><p><strong>Current RQL—</strong></p><pre><code>config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-activity-log-alerts' AND json.rule = "location equals Global and properties.enabled equals true and properties.scopes[*] does not contain resourceGroups and properties.condition.allOf[?(@.field=='operationName')].equals equals Microsoft.Security/securitySolutions/delete" as X; count(X) less than 1
</code></pre><p><strong>Updated RQL—</strong></p><pre><code>config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-activity-log-alerts' AND json.rule = "location equal ignore case Global and properties.enabled equals true and properties.scopes[*] does not contain resourceGroups and properties.condition.allOf[?(@.field=='operationName')].equals equals Microsoft.Security/securitySolutions/delete" as X; count(X) less than 1
</code></pre><ul><li><strong>Policy Name—</strong> Azure Activity log alert for delete policy assignment does not exist</li></ul><p><strong>Current RQL—</strong></p><pre><code>config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-activity-log-alerts' AND json.rule = "location equals Global and properties.scopes[*] does not contain resourceGroups and properties.enabled equals true and properties.condition.allOf[?(@.field=='operationName')].equals equals Microsoft.Authorization/policyAssignments/delete" as X; count(X) less than 1
</code></pre><p><strong>Updated RQL—</strong></p><pre><code>config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-activity-log-alerts' AND json.rule = "location equal ignore case Global and properties.scopes[*] does not contain resourceGroups and properties.enabled equals true and properties.condition.allOf[?(@.field=='operationName')].equals equals Microsoft.Authorization/policyAssignments/delete" as X; count(X) less than 1
</code></pre><ul><li><strong>Policy Name—</strong> Azure Activity log alert for Create or update SQL server firewall rule does not exist</li></ul><p><strong>Current RQL—</strong></p><pre><code>config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-activity-log-alerts' AND json.rule = "location equals Global and properties.enabled equals true and properties.scopes[*] does not contain resourceGroups and properties.condition.allOf[?(@.field=='operationName')].equals equals Microsoft.Sql/servers/firewallRules/write" as X; count(X) less than 1
</code></pre><p><strong>Updated RQL—</strong></p><pre><code>config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-activity-log-alerts' AND json.rule = "location equal ignore case Global and properties.enabled equals true and properties.scopes[*] does not contain resourceGroups and properties.condition.allOf[?(@.field=='operationName')].equals equals Microsoft.Sql/servers/firewallRules/write" as X; count(X) less than 1
</code></pre><ul><li><strong>Policy Name—</strong> Azure Activity log alert for Create or update security solution does not exist</li></ul><p><strong>Current RQL—</strong></p><pre><code>config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-activity-log-alerts' AND json.rule = "location equals Global and properties.enabled equals true and properties.scopes[*] does not contain resourceGroups and properties.condition.allOf[?(@.field=='operationName')].equals equals Microsoft.Security/securitySolutions/write" as X; count(X) less than 1
</code></pre><p><strong>Updated RQL—</strong></p><pre><code>config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-activity-log-alerts' AND json.rule = "location equal ignore case Global and properties.enabled equals true and properties.scopes[*] does not contain resourceGroups and properties.condition.allOf[?(@.field=='operationName')].equals equals Microsoft.Security/securitySolutions/write" as X; count(X) less than 1
</code></pre><ul><li><strong>Policy Name—</strong> Azure Activity log alert for Create policy assignment does not exist</li></ul><p><strong>Current RQL—</strong></p><pre><code>config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-activity-log-alerts' AND json.rule = "location equals Global and properties.enabled equals true and properties.scopes[*] does not contain resourceGroups and properties.condition.allOf[?(@.field=='operationName')].equals equals Microsoft.Authorization/policyAssignments/write" as X; count(X) less than 1
</code></pre><p><strong>Updated RQL—</strong></p><pre><code>config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-activity-log-alerts' AND json.rule = "location equal ignore case Global and properties.enabled equals true and properties.scopes[*] does not contain resourceGroups and properties.condition.allOf[?(@.field=='operationName')].equals equals Microsoft.Authorization/policyAssignments/write" as X; count(X) less than 1
</code></pre><ul><li><strong>Policy Name—</strong> Azure Activity log alert for Create or update network security group rule does not exist</li></ul><p><strong>Current RQL—</strong></p><pre><code>config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-activity-log-alerts' AND json.rule = "location equals Global and properties.enabled equals true and properties.scopes[*] does not contain resourceGroups and properties.condition.allOf[?(@.field=='operationName')].equals equals Microsoft.Network/networkSecurityGroups/securityRules/write" as X; count(X) less than 1
</code></pre><p><strong>Updated RQL—</strong></p><pre><code>config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-activity-log-alerts' AND json.rule = "location equal ignore case Global and properties.enabled equals true and properties.scopes[*] does not contain resourceGroups and properties.condition.allOf[?(@.field=='operationName')].equals equals Microsoft.Network/networkSecurityGroups/securityRules/write" as X; count(X) less than 1
</code></pre><ul><li><strong>Policy Name—</strong> Azure Activity log alert for Delete SQL server firewall rule does not exist</li></ul><p><strong>Current RQL—</strong></p><pre><code>config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-activity-log-alerts' AND json.rule = "location equals Global and properties.enabled equals true and properties.scopes[*] does not contain resourceGroups and properties.condition.allOf[?(@.field=='operationName')].equals equals Microsoft.Sql/servers/firewallRules/delete" as X; count(X) less than 1
</code></pre><p><strong>Updated RQL—</strong></p><pre><code>config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-activity-log-alerts' AND json.rule = "location equal ignore case Global and properties.enabled equals true and properties.scopes[*] does not contain resourceGroups and properties.condition.allOf[?(@.field=='operationName')].equals equals Microsoft.Sql/servers/firewallRules/delete" as X; count(X) less than 1
</code></pre><ul><li><strong>Policy Name—</strong> Azure Activity log alert for Create or update network security group does not exist</li></ul><p><strong>Current RQL—</strong></p><pre><code>config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-activity-log-alerts' AND json.rule = "location equals Global and properties.enabled equals true and properties.scopes[*] does not contain resourceGroups and properties.condition.allOf[?(@.field=='operationName')].equals equals Microsoft.Network/networkSecurityGroups/write" as X; count(X) less than 1
</code></pre><p><strong>Updated RQL—</strong></p><pre><code>config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-activity-log-alerts' AND json.rule = "location equal ignore case Global and properties.enabled equals true and properties.scopes[*] does not contain resourceGroups and properties.condition.allOf[?(@.field=='operationName')].equals equals Microsoft.Network/networkSecurityGroups/write" as X; count(X) less than 1
</code></pre><ul><li><strong>Policy Name—</strong> Azure Activity log alert for Delete network security group does not exist</li></ul><p><strong>Current RQL—</strong></p><pre><code>config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-activity-log-alerts' AND json.rule = "location equals Global and properties.enabled equals true and properties.scopes[*] does not contain resourceGroups and properties.condition.allOf[?(@.field=='operationName')].equals equals Microsoft.Network/networkSecurityGroups/delete" as X; count(X) less than 1
</code></pre><p><strong>Updated RQL—</strong></p><pre><code>config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-activity-log-alerts' AND json.rule = "location equal ignore case Global and properties.enabled equals true and properties.scopes[*] does not contain resourceGroups and properties.condition.allOf[?(@.field=='operationName')].equals equals Microsoft.Network/networkSecurityGroups/delete" as X; count(X) less than 1
</code></pre><ul><li><strong>Policy Name—</strong> Azure Activity log alert for Update security policy does not exist</li></ul><p><strong>Current RQL—</strong></p><pre><code>config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-activity-log-alerts' AND json.rule = "location equals Global and properties.enabled equals true and properties.scopes[*] does not contain resourceGroups and properties.condition.allOf[?(@.field=='operationName')].equals equals Microsoft.Security/policies/write" as X; count(X) less than 1
</code></pre><p><strong>Updated RQL—</strong></p><pre><code>config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-activity-log-alerts' AND json.rule = "location equal ignore case Global and properties.enabled equals true and properties.scopes[*] does not contain resourceGroups and properties.condition.allOf[?(@.field=='operationName')].equals equals Microsoft.Security/policies/write" as X; count(X) less than 1
</code></pre><ul><li><strong>Policy Name—</strong> Azure Activity log alert for Delete network security group rule does not exist</li></ul><p><strong>Current RQL—</strong></p><pre><code>config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-activity-log-alerts' AND json.rule = "location equals Global and properties.enabled equals true and properties.scopes[*] does not contain resourceGroups and properties.condition.allOf[?(@.field=='operationName')].equals equals Microsoft.Network/networkSecurityGroups/securityRules/delete" as X; count(X) less than 1
</code></pre><p><strong>Updated RQL—</strong></p><pre><code>config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-activity-log-alerts' AND json.rule = "location equal ignore case Global and properties.enabled equals true and properties.scopes[*] does not contain resourceGroups and properties.condition.allOf[?(@.field=='operationName')].equals equals Microsoft.Network/networkSecurityGroups/securityRules/delete" as X; count(X) less than 1
</code></pre><p><strong>Severity—</strong> Informational</p><p><strong>Policy Type—</strong> Config</p><p><strong>Impact—</strong> Medium. Existing alerts are resolved as <strong>Policy_Updated</strong> and new alerts will be generated.</p></td></tr><tr><td><strong>Policy Deletions</strong></td><td></td></tr><tr><td><strong>AWS EC2 instance publicly exposed with critical/high exploitable vulnerabilities and port scan activity</strong></td><td><p>This policy has been deleted from Prisma Cloud.</p><p><strong>Severity—</strong> Critical</p><p><strong>Policy Type—</strong> Attack Path</p><p><strong>Impact—</strong> High. Previously generated alerts will be resolved as <strong>Policy_Deleted</strong>.</p></td></tr></tbody></table>

## Changes in Existing Behavior

No changes in existing behavior for 23.10.1.

## REST API Updates

| CHANGE                                                    | DESCRIPTION                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           |
| --------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **New APIs to Configure SSO using OpenID Connect (OIDC)** | <p>The following new endpoints are introduced to configure tenant SSO authentication using OpenID Connect (OIDC):</p><ul><li>Get OIDC Configuration - <a href="https://pan.dev/prisma-cloud/api/cspm/get-oauth-2-config/">GET authn/api/v1/oauth2/config</a></li><li>Update OIDC Configuration - <a href="https://pan.dev/prisma-cloud/api/cspm/update-oauth-2-config/">PUT authn/api/v1/oauth2/config</a></li><li>Create an OIDC Configuration - <a href="https://pan.dev/prisma-cloud/api/cspm/create-oauth-2-config/">POST authn/api/v1/oauth2/config</a></li><li>Update OIDC Configuration Partially - <a href="https://pan.dev/prisma-cloud/api/cspm/patch-oauth-2-config/">PATCH authn/api/v1/oauth2/config</a></li><li>Get OIDC Login URL - <a href="https://pan.dev/prisma-cloud/api/cspm/get-oauth-2-login-url/">GET authn/api/v1/oauth2/login</a></li></ul> |

## Deprecation Notices

| CHANGE                                                                                                                                                                                                                         | DESCRIPTION                                                                                                                                                            |
| ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| <p><strong>Removal of Deprecated Get Resource Snapshot API</strong></p><p><mark style="background-color:orange;">This deprecation was first announced in the Look Ahead that was published with the 23.9.1 release.</mark></p> | The deprecated **GET /das/api/v1/resource** API has been removed. Instead, you can use [POST /uai/v1/asset](https://pan.dev/prisma-cloud/api/cspm/asset-2/#get-asset). |


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.prismacloud.io/release-notes/prisma-cloud-release-information/classic-releases/prisma-cloud-cspm-release-information/features-introduced-in-october-2023.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.