Action Plans
Secure the Infrastructure
24.12.1
|Secure your cloud assets with enhanced efficiency with Prisma Cloud Action Plans. Action Plans programmatically group multiple alerts related to a single affected asset into one actionable plan. Every Action Plans include a summary as well as specific remediation steps, tailored to effectively maximize risk reduction.
Action Plans is released in a phased rollout and will be available on all Prisma Cloud stacks by January 8, 2025.
Search for Assets with Secrets
Secure the Infrastructure
24.12.1
|The Secrets attributes within the Investigate > Asset search help you prioritize and find assets with secret exposure risks. Along with Finding and Vulnerability, you can now also use Secrets as a security context to identify Attack Paths in your environment. You can create custom policies based on the specific asset query.
In order to use the Secrets attributes, make sure you have enabled Agentless Scanning during onboarding.
You can view your search results in both Table and Graph modes. In the Table mode, a new View by: Secret allows you to view all the secret detections that match the query.
In the Graph mode, each Secrets node is a representation of all the secret detections for that specific asset.
To see all matching secret detections for the given asset, click on the Secrets node and then click View Details.
AISPM Compliance with OWASP Top 10 for LLM and NIST AI 600-1
Secure the Data
24.12.1
| To empower your organization to proactively address the unique security, ethical, and regulatory challenges associated with AI deployments, Prisma Cloud AISPM now includes enhanced risk identification and compliance capabilities for AI and ML systems that aligns with two critical standards - OWASP Top 10 for Large Language Models (LLM) and NIST AI 600-1. | ## Changes in Existing Behavior | **Feature** | **Description** | | --------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | |Amazon EC2 VPC Endpoint Service Count Updates
24.12.1
|Prisma Cloud will no longer ingest EC2 VPC Endpoint Services that are visible to, but not owned by AWS accounts. Only VPC Endpoint Services directly owned by an AWS account will be ingested.
Impact— Low. Since the VPC Endpoint Services that will not be ingested are resources owned by Amazon.
| ## API Ingestions | **Service** | **API Details** | | --------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | |Amazon Cognito
24.12.1
|aws-cognito-user-pool-client
Additional permissions required:
cognito-idp:ListUserPoolscognito-idp:ListUserPoolClientscognito-idp:DescribeUserPoolClientThe Security Audit role includes the above permissions.
| |Amazon Data Lifecycle Manager
24.12.1
|aws-dlm-lifecycle-policy
Additional permissions required:
dlm:GetLifecyclePoliciesdlm:GetLifecyclePolicyThe Security Audit role does not include the above permissions. You must manually update the CFT template to enable them.
| |Amazon EC2
24.12.1
|aws-ec2-network-insights-analysis
Additional permission required:
ec2:DescribeNetworkInsightsAnalysesThe Security Audit role includes the above permission.
| |Amazon EC2
24.12.1
|aws-ec2-egress-only-internet-gateway
Additional permission required:
ec2:DescribeEgressOnlyInternetGatewaysThe Security Audit role includes the above permission.
| |Amazon EventBridge
24.12.1
|aws-events-archive
Additional permissions required:
events:ListArchivesevents:DescribeArchiveThe Security Audit role includes the above permissions.
| |Amazon EventBridge
24.12.1
|aws-events-connection
Additional permissions required:
events:ListConnectionsevents:DescribeConnectionThe Security Audit role includes the above permissions.
| |Amazon IVS
24.12.1
|aws-ivs-channel
Additional permissions required:
ivs:ListChannelsivs:GetChannelThe Security Audit role does not include the above permissions. You must manually update the CFT template to enable them.
| |Amazon Lightsail
24.12.1
|aws-lightsail-storage-bucket
Additional permission required:
lightsail:GetBucketsThe Security Audit role includes the above permission.
| |Amazon Lightsail Disk
24.12.1
|aws-lightsail-disk
Additional permission required:
lightsail:GetDisksThe Security Audit role includes the above permission.
| |Amazon MemoryDB
24.12.1
|aws-memorydb-subnet-group
Additional permissions required:
memorydb:DescribeSubnetGroupsmemorydb:ListTagsThe Security Audit role does not include the above permissions. You must manually update the CFT template to enable them.
| |Amazon MemoryDB
24.12.1
|aws-memorydb-snapshot
Additional permissions required:
memorydb:DescribeSnapshotsmemorydb:ListTagsThe Security Audit role does not include the above permissions. You must manually update the CFT template to enable them.
| |AWS Application Migration Service
24.12.1
|aws-mgn-source-server
Additional permission required:
mgn:DescribeSourceServersThe Security Audit role does not include the above permission. You must manually update the CFT template to enable it.
| |AWS Fault Injection Service
24.12.1
|aws-fis-experiment-template
Additional permissions required:
fis:ListExperimentTemplatesfis:GetExperimentTemplateThe Security Audit role does not include the above permissions. You must manually update the CFT template to enable them.
| |AWS Network Manager
24.12.1
|aws-network-manager-global-network-site
Additional permissions required:
networkmanager:DescribeGlobalNetworksnetworkmanager:GetSitesThe Security Audit role only includes networkmanager:DescribeGlobalNetworks permission.
You must manually include networkmanager:GetSites permission in the CFT template to enable it.
Amazon Recycle Bin
24.12.1
|aws-recycle-bin-ebs-snapshot-rule
Additional permissions required:
rbin:ListRulesrbin:GetRulerbin:ListTagsForResourceThe Security Audit role does not include the above permissions. You must manually update the CFT template to enable them.
| |Amazon SageMaker
24.12.1
|aws-sagemaker-notebook-instance-lifecycle-config
Additional permissions required:
sagemaker:ListNotebookInstanceLifecycleConfigssagemaker:DescribeNotebookInstanceLifecycleConfigThe Security Audit role includes the above permissions.
| |Amazon S3
24.12.1
|aws-s3-multi-region-access-point
Additional permission required:
s3:ListMultiRegionAccessPointsThe Security Audit role includes the above permission.
| |Amazon Transcribe
24.12.1
|aws-transcribe-transcription-job
Additional permissions required:
transcribe:ListTranscriptionJobstranscribe:GetTranscriptionJobThe Security Audit role only includes transcribe:ListTranscriptionJobs permission.
You must manually include transcribe:GetTranscriptionJob permission in the CFT template to enable it.
Azure Active Directory
24.12.1
|azure-active-directory-role-assignment-schedules
Additional permission required:
RoleAssignmentSchedule.Read.DirectoryThe Reader role includes the above permission.
| |Azure Application Insights
24.12.1
|azure-application-insights-workbooks
Additional permission required:
Microsoft.Insights/Workbooks/ReadThe Reader role includes the above permission.
| |Azure API Management
24.12.1
|azure-api-management-service-subscriptions
Additional permissions required:
Microsoft.ApiManagement/service/readMicrosoft.ApiManagement/service/subscriptions/readThe Reader role includes the above permissions.
| |Azure App Service
24.12.1
|azure-app-service-connections
Additional permissions required:
Microsoft.Web/connections/ReadMicrosoft.Resources/subscriptions/resourceGroups/readThe Reader role includes the above permissions.
| |Azure Automation Accounts
24.12.1
|azure-automation-account-hybrid-runbook-workers
Additional permissions required:
Microsoft.Automation/automationAccounts/readMicrosoft.Automation/automationAccounts/hybridRunbookWorkerGroups/hybridRunbookWorkers/readThe Reader role includes the above permissions.
| |Azure Compute
24.12.1
|azure-compute-restore-point-collections
Additional permission required:
Microsoft.Compute/restorePointCollections/readThe Reader role includes the above permission.
| |Azure Compute
24.12.1
|azure-compute-proximity-placement-groups
Additional permission required:
Microsoft.Compute/proximityPlacementGroups/readThe Reader role includes the above permission.
| |Azure Machine Learning
24.12.1
|azure-machine-learning-workspace-diagnostic-settings
Additional permissions required:
Microsoft.MachineLearningServices/workspaces/readMicrosoft.Insights/DiagnosticSettings/ReadThe Reader role includes the above permissions.
| |Azure Virtual WAN
24.12.1
|azure-virtual-wan-virtual-hubs
Additional permission required:
Microsoft.Network/virtualHubs/readThe Reader role includes the above permission.
| |Google App Engine
24.12.1
|gcloud-app-engine-service-version
Additional permissions required:
appengine.services.listappengine.versions.listThe Viewer role includes the above permissions.
| |Google App Engine
24.12.1
|gcloud-app-engine-service
Additional permission required:
appengine.services.listThe Viewer role includes the above permission.
| |Google App Engine
24.12.1
|gcloud-app-engine-domain-mapping
Additional permission required:
appengine.applications.getThe Viewer role includes the above permission.
| |Google Bigquery Data Policy
24.12.1
|gcloud-bigquery-data-policy
Additional permissions required:
bigquery.dataPolicies.listbigquery.dataPolicies.getIamPolicyThe Viewer role includes the above permissions.
| |Google Integration Connectors
24.12.1
|gcloud-integration-connectors-endpoint-attachment
Additional permission required:
connectors.endpointAttachments.listThe Viewer role includes the above permission.
| |Google Integration Connectors
24.12.1
|gcloud-integration-connectors-custom-connector-version
Additional permissions required:
connectors.customConnectors.listconnectors.customConnectorVersions.listThe Viewer role includes the above permissions.
| |Google Integration Connectors
24.12.1
|gcloud-integration-connectors-custom-connector
Additional permission required:
connectors.customConnectors.listThe Viewer role includes the above permission.
| |OCI Vaults
24.12.1
|oci-vault-secret-versions
Additional permissions required:
SECRET\_INSPECTSECRET\_VERSION\_INSPECTThe Reader role includes the above permissions.
| ## New Policies| Policies | Description |
Alibaba Cloud VPC flow log not enabled 24.12.1 | This policy identifies Virtual Private Clouds (VPCs) where flow logs are not enabled. VPC flow logs capture information about the traffic entering and exiting network interfaces in the VPC. Without VPC flow logs, there is limited visibility into network traffic, making it challenging to detect and investigate suspicious activities, potential data breaches, or security policy violations. Enabling VPC flow logs enhances network monitoring, improves threat detection, and supports compliance requirements. As a security best practice, it is recommended to enable VPC flow logs. Policy Severity— Informational Policy Type— Config RQL— |
Alibaba Cloud OSS bucket logging not enabled 24.12.1 | This policy identifies Alibaba Cloud Object Storage Service (OSS) buckets that do not have logging enabled. Enabling logging for OSS buckets helps capture access and operation events, which are critical for security monitoring, troubleshooting, and auditing. Without logging, you lack visibility into who accesses and interacts with your bucket, potentially missing unauthorized access or suspicious behaviour. As a security best practice, it is recommended to enable logging for OSS buckets. Policy Severity— Informational Policy Type— Config RQL— |
AWS ECR private repository with cross-account access 24.12.1 | This policy identifies AWS ECR private repository that are configured with cross-account access. An ECR repository is a storage location within Amazon Elastic Container Registry (ECR) where Docker container images are stored and managed. Granting cross-account access to an ECR repository risks unauthorized access and data exposure, requiring strict policy controls and monitoring. It is recommended to implement strict access controls and allow only trusted entities to access to an ECR repository to mitigate security risks. Policy Severity— Low Policy Type— Config RQL— |
AWS CloudWatch Log groups not encrypted by Customer Managed Key (CMK) 24.12.1 | This policy identifies AWS CloudWatch Log groups that are encrypted using the default KMS key instead of CMK (Customer Managed Key) or using a CMK that is disabled. A CloudWatch Log Group is a collection of log streams that share the same retention, monitoring, and access control settings. Encrypting with a Customer Managed Key (CMK) provides additional control over key rotation, management, and access policies compared to the default encryption. As a security best practice, using CMK to encrypt your CloudWatch Log Groups is advisable as it gives you full control over the encrypted data. Policy Severity— Low Policy Type— Config RQL— |
AWS MSK cluster public access is enabled 24.12.1 | This policy identifies the Amazon Managed Streaming for Apache Kafka (Amazon MSK) Cluster is configured with public access enabled. Amazon MSK gives you the option to turn on public access to the brokers of MSK clusters. When the AWS MSK Cluster is public there could be posibility that the data can be exposed publicly. It is recommended to disable the public access on the AWS MSK cluster to prevent unathourized access and complaince requirements. Policy Severity— Low Policy Type— Config RQL— |
AWS FSX Windows filesystem is not configured with file access auditing 24.12.1 | This policy identifies the AWS FSX Windows filesystem not configured FileAccessAuditLogLevel and FileShareAccessAuditLogLevel. Amazon FSx for Windows File Server supports auditing of end-user access to files, folders, and file shares. FileAccessAuditLogLevel and FileShareAccessAuditLogLevel Both settings can be configured to log successful events, failed events, both, or neither, depending on your auditing requirements. Not configuring these audit logs can lead to undetected unauthorized access and non-compliance with security regulations. It is recommended to configure both log access to files and folders and access to file shares according to your business requirements to ensure comprehensive logging, providing visibility, accountability, and compliance, and enabling effective monitoring and incident response capabilities. Policy Severity— Informational Policy Type— Config RQL— |
AWS EMR cluster is not enabled with termination protection 24.12.1 | This policy identifies the AWS EMR Cluster that is not enabled with termination protection. Termination protection protects your clusters from accidental termination, When termination protection is enabled, any attempt to terminate the cluster through the AWS Management Console, CLI, or API will be blocked unless the protection is explicitly disabled first. Termination protection useful for long-running or critical clusters where accidental termination could result in data loss or significant downtime. It recommended to enable Termination protection on AWS EMR clusters from accidental termination. Policy Severity— Informational Policy Type— Config RQL— |
AWS Lightsail Instance does not restrict traffic on admin ports 24.12.1 | This policy identifies the AWS Lightsail instance having network rule with unrestricted access ("0.0.0.0/0" or "::/0") on port 22 or 3389. The firewall in Amazon Lightsail manages inbound traffic permitted to connect to your instance via its public IP address, controlling access to specific IPs and ports. Leaving administrative ports open to unrestricted access increases the risk of unauthorized access, such as brute-force attacks, which can compromise the instance and expose sensitive data. It is recommended to limit access to specific IP addresses in the firewall rules to reduce unauthorized access attempts. Policy Severity— Low Policy Type— Config RQL— |
AWS Security Group allows all ingress traffic on CIFS port (445) 24.12.1 | This policy identifies Security groups that allow all traffic on port 445 used by Common Internet File System (CIFS). Common Internet File System (CIFS) is a network file-sharing protocol that allows systems to share files over a network. unrestricted CIFS access can expose your data to unauthorized users, leading to potential security risks. It is recommended to restrict CIFS port 445 access to only trusted networks to prevent unauthorized access and data breaches. Policy Severity— Informational Policy Type— Config RQL— |
AWS Route53 Domain transfer lock is not enabled 24.12.1 | This policy identifies the AWS Route53 domain which is not enabled with transfer lock. Route 53 Domain Transfer Lock is a security feature that prevents unauthorised domain transfers by locking the domain at the registrar level. The feature sets the "clientTransferProhibited" flag, which is a registry setting enabled by the registrar to force all transfer requests to be rejected automatically. If Route 53 Domain Transfer Lock is disabled, your domain is vulnerable to unauthorized transfers, which can lead to service disruptions, data breaches, reputational damage, and financial loss. It is recommended to enable Route 53 Domain Transfer Lock to prevent unauthorized domain transfers and protect your domain from potential security threats and disruptions. Policy Severity— Low Policy Type— Config RQL— |
Azure Microsoft Entra ID account lockout threshold greater than 10 24.12.1 | This policy identifies if the account lockout threshold for Microsoft Entra ID (formerly Azure AD) accounts is configured to allow more than 10 failed login attempts before the account is locked out. A high lockout threshold (greater than 10) increases the risk of brute-force or password spray attacks, where attackers can attempt multiple passwords over time without triggering account lockouts, leaving accounts vulnerable to unauthorized access. Setting the lockout threshold to a reasonable value (e.g., less than or equal to 10) balances usability and security by limiting the number of login attempts before an account is locked, reducing exposure to attacks while preventing frequent unnecessary lockouts for legitimate users. As a security best practice, it is recommended to configure the account lockout threshold to less than or equal to 10. Policy Severity— High Policy Type— Config RQL— |
Azure Microsoft Entra ID account lockout duration less than 60 seconds 24.12.1 | This policy identifies if the account lockout duration for Microsoft Entra ID (formerly Azure AD) accounts is configured to be less than 60 seconds. The lockout duration determines how long the account remains locked after exceeding the lockout threshold. A lockout duration of less than 60 seconds increases the risk of brute-force or password spray attacks. Malicious actors can exploit a short lockout period to attempt multiple logins more frequently, increasing the likelihood of gaining unauthorized access. Configuring the lockout duration to be at least 60 seconds helps reduce the frequency of repeated login attempts during a brute-force attack, improving protection against such attacks while ensuring a reasonable delay for legitimate users after exceeding the threshold. As a security best practice, it is recommended to configure the account lockout duration to greater than or equal to 60 seconds. Policy Severity— High Policy Type— Config RQL— |
Azure disk data access authentication mode not enabled 24.12.1 | This policy identifies if the Data Access Authentication Mode for Azure disks is disabled. This mode is crucial for controlling how users upload or export Virtual Machine Disks by requiring an Azure Entra ID role to authorize such operations. Without enabling this mode, users can create SAS tokens to export disks without stringent identity-based restrictions. This increases the risk of unauthorized disk access or data exposure, especially in environments handling sensitive data. Enabling the Data Access Authentication Mode ensures that only users with the appropriate Data Operator for Managed Disk role in Azure Entra ID can export or manage disks. This enhances data security by preventing unauthorized disk exports and restricting access to secure download URLs. As a security best practice, it is recommended to enable data access authentication mode for Azure disks. Policy Severity— Medium Policy Type— Config RQL— |
Azure App Service basic authentication enabled 24.12.1 | This policy identifies Azure App Services which have basic authentication enabled. Basic Authentication allows local identity management for App Services without using a centralized identity provider like Azure Entra ID, posing a security risk by creating isolated identity systems that lack centralized control and are vulnerable to credential compromise and unauthorized access. Disabling Basic Authentication and integrating with a centralized solution like Azure Entra ID enhances security with stronger authentication, improved access management, and reduced attack risks. As a security best practice, it is recommended to disable basic authentication for Azure App Services. Policy Severity— Medium Policy Type— Config RQL— |
GCP Cloud Run function is using default service account with editor role 24.12.1 | This policy identifies GCP Cloud Run functions that are using the default service account with the editor role. GCP Compute Engine Default service account is automatically created upon enabling the Compute Engine API. This service account is granted the IAM basic Editor role by default, unless explicitly disabled. Assigning default service account with the editor role to cloud run functions could lead to privilege escalation. Granting minimal access rights helps in promoting a better security posture. Policy Severity— Medium Policy Type— Config RQL— |
GCP Spanner Databases not encrypted with CMEK 24.12.1 | This policy identifies GCP Spanner databases that are not encrypted with a Customer-Managed Encryption Key (CMEK). Google Cloud Spanner is a scalable, globally distributed, and strongly consistent database service. By using CMEK with Spanner, you retain complete control over the encryption keys protecting your sensitive data, ensuring that only authorized users with access to these keys can decrypt and access the information. Without CMEK, data is encrypted with Google-managed keys, which may not provide the level of control required for handling sensitive data in certain industries. It is recommended to encrypt Spanner database data using a Customer-Managed Encryption Key (CMEK). Policy Severity— Low Policy Type— Config RQL— |
GCP Spanner Database drop protection disabled 24.12.1 | This policy identifies GCP Spanner Databases with drop protection disabled. Google Cloud Spanner is a scalable, globally distributed, and strongly consistent database service. The Spanner database drop protection feature prevents accidental deletion of databases and configurations. Without drop protection enabled, a user error or malicious action could lead to irreversible data loss and service disruption for all applications relying on that Spanner instance. It is recommended to enable drop protection on spanner database to prevent from accidental deletion. Policy Severity— Informational Policy Type— Config RQL— |
GCP SQL Instance not encrypted with CMEK 24.12.1 | This policy identifies GCP SQL Instances that are not encrypted with Customer Managed Encryption Keys (CMEK). Using CMEK for SQL Instances provides greater control over data at rest encryption by allowing key rotation and revocation, which enhances security and helps meet compliance requirements. Encrypting SQL Instances with CMEK ensures better data privacy management. It is recommended to use CMEK for SQL Instance encryption. Policy Severity— Low Policy Type— Config RQL— |
GCP Vertex AI Workbench Instance has Secure Boot disabled 24.12.1 | This policy identifies GCP Vertex AI Workbench instances with Secure Boot disabled. Secure Boot is a security feature that ensures only trusted, digitally signed software runs during the boot process, protecting against advanced threats such as rootkits and bootkits. By verifying the integrity of the bootloader and operating system, Secure Boot prevents unauthorized software from compromising the system at startup. Without Secure Boot, instances are vulnerable to persistent malware and unauthorized code that could compromise the system deeply. It is recommended to enable Secure Boot for Vertex AI Workbench instances. Policy Severity— Low Policy Type— Config RQL— |
GCP Vertex AI Workbench Instance JupyterLab interface access mode set to single user 24.12.1 | This policy identifies GCP Vertex AI Workbench Instances with JupyterLab interface access mode set to single user. Vertex AI Workbench Instance can be accessed using the web-based JupyterLab interface. Access mode controls the control access to this interface. Allowing access to only a single user could limit collaboration, increase chances of credential sharing, and hinder security audits and reviews of the resource. It is recommended to avoid single user access and make use of the service account access mode for workbench instances. Policy Severity— Informational Policy Type— Config RQL— |
GCP Vertex AI Workbench Instance auto-upgrade is disabled 24.12.1 | This policy identifies GCP Vertex AI Workbench Instances that have auto-upgrade disabled. Auto-upgrading Google Cloud Vertex environments ensures timely security updates, bug fixes, and compatibility with APIs and libraries. It reduces security risks associated with outdated software, enhances stability, and enables access to new features and optimizations. It is recommended to enable auto-upgrade to minimize maintenance overhead and mitigate security risks. Policy Severity— Low Policy Type— Config RQL— |
GCP SQL database instance deletion protection is disabled 24.12.1 | This policy identifies GCP SQL database instances that have deletion protection disabled. Enabling instance deletion protection on GCP SQL databases is crucial for preventing accidental data loss, especially in production environments where an unintended deletion could disrupt services and impact business continuity. Deletion protection adds an extra safeguard, requiring intentional action to disable the setting before deletion, helping teams avoid costly downtime and ensuring the availability of essential data. It is recommended to enable deletion protection on GCP SQL database instances to prevent accidental deletion. Policy Severity— Informational Policy Type— Config RQL— |
GCP Secrets Manager secret not encrypted with CMEK 24.12.1 | This policy identifies GCP Secrets Manager secrets that are not encrypted with a Customer-Managed Encryption Key (CMEK). GCP Secret Manager securely stores and controls access to API keys, passwords, certificates, and other sensitive data. By using CMEK with secrets, you retain complete control over the encryption keys protecting your sensitive data, ensuring that only authorized users with access to these keys can decrypt and access the information. Without CMEK, data is encrypted with Google-managed keys, which may not provide the level of control required for handling sensitive data in certain industries. It is recommended to encrypt Secrets Manager secrets using a Customer-Managed Encryption Key (CMEK). Policy Severity— Low Policy Type— Config RQL— |
GCP Secrets Manager secret not encrypted with CMEK 24.12.1 | This policy identifies GCP Secrets Manager secrets that are not encrypted with a Customer-Managed Encryption Key (CMEK). GCP Secret Manager securely stores and controls access to API keys, passwords, certificates, and other sensitive data. By using CMEK with secrets, you retain complete control over the encryption keys protecting your sensitive data, ensuring that only authorized users with access to these keys can decrypt and access the information. Without CMEK, data is encrypted with Google-managed keys, which may not provide the level of control required for handling sensitive data in certain industries. It is recommended to encrypt Secrets Manager secrets using a Customer-Managed Encryption Key (CMEK). Policy Severity— Low Policy Type— Config RQL— |
| Policy Updates | Description |
| Policy Updates—RQL | |
AWS EMR cluster is not enabled with local disk encryption 24.12.1 | The policy is updated to exclude different Current RQL– Updated RQL– Policy Type– Config Policy Severity– Low Impact– Low. Existing alerts where the state of the EMR cluster is |
AWS EMR cluster is not enabled with local disk encryption using Custom key provider 24.12.1 | The policy RQL is updated to exclude different Current RQL– Updated RQL– Policy Type– Config Policy Severity– Low Impact– Low. Existing alerts where the state of the EMR cluster is |
GCP PostgreSQL instance database flag log_hostname is not set to off 24.12.1 | The policy RQL is updated to not generate false positive alerts in case the Current RQL– Updated RQL– Policy Type– Config Policy Severity– Informational Impact– Low. Existing alerts where the |
GCP GKE unsupported node version 24.12.1 | The policy RQL is updated to provide accurate results. Current RQL– Updated RQL– Policy Type– Config Policy Severity– Medium Impact– Medium. New alerts may be triggered when the GKE version is not supported since the policy RQL is updated to check for the complete version. |
GCP GKE unsupported Master node version 24.12.1 | The policy RQL is updated to provide accurate results. Current RQL– Updated RQL– Policy Type– Config Policy Severity– Medium Impact– Medium. New alerts may be generated when the GKE version is not supported since the policy RQL is updated to check for the complete version. |
GCP VM instance with the external IP address 24.12.1 | The policy description and recommendation steps are updated to provide better context. The policy RQL is updated to consider public IPv6 addresses assigned to GCP VM instances. Current Description– This policy identifies the VM instances with the external IP address associated. To reduce your attack surface, VM instances should not have public/external IP addresses. Instead, instances should be configured behind load balancers, to minimize the instance’s exposure to the internet. This policy will not report instances created by GKE because some of them have external IP addresses and cannot be changed by editing the instance settings. Instances created by GKE should be excluded. These instances have names that start with 'gke-' and contains 'default-pool'. Updated Description– This policy identifies GCP VM instances that are assigned a public IP. Using a public IP with a GCP VM exposes it directly to the internet, increasing the risk of unauthorized access and attacks. This makes the VM vulnerable to threats such as brute force attempts, DDoS attacks, and other malicious activities. To mitigate these risks, it is safer to use private IPs and secure access methods like VPNs or load balancers. It is recommended to avoid assigning public IPs to VM instances. Current RQL– Updated RQL– Policy Type– Config Policy Severity– Low Impact– None. New alerts will be generated for the failing resources. This will cover the resources where a public IPv6 address is assigned to a VM. |
| Policy Delete | |
GCP VM instance is assigned with public IP 24.12.1 | This policy is deleted and combined with GCP VM instance with the external IP address as a single policy. Impact– Low. Existing alerts will be resolved as POLICY_DELETED. |
PCI DSS v4.0.1
24.12.1
|Prisma Cloud now supports the latest version of PCI DSS v4.0.1 compliance framework. This latest revision emphasizes a risk-based approach, incorporating new requirements that address evolving threats such as phishing and e-skimming attacks. Notably, the updated standard mandates stricter multi-factor authentication measures, increased password complexity, and enhanced controls for managing client-side scripts to safeguard against unauthorized modifications.
You can now access this built-in compliance standard and related policies on the Compliance > Standards page. Additionally, users can generate reports for immediate viewing or downloading, as well as set up scheduled reports to continuously monitor compliance with the PCI DSS v4.0.1 framework over time.
| |ACSC Information Security Manual (ISM)
24.12.1
|Prisma Cloud now supports the latest version (September 2024) of ACSC Information Security Manual (ISM) compliance framework. This framework provides a structured approach for managing compliance risks, ensuring that sensitive information is safeguarded while adapting to changing regulations.
You can now access this built-in compliance standard and related policies on the Compliance > Standards page. Additionally, users can generate reports for immediate viewing or downloading, as well as set up scheduled reports to continuously monitor compliance with the ACSC Information Security Manual (ISM) framework over time.
| |Update MLPS 2.0, MLPS 2.0 (Level 2) & MLPS 2.0 (Level 3)
24.12.1
|New mappings are added for Multi-Level Protection Scheme 2.0 - MLPS 2.0, MLPS 2.0 (Level 2) & MLPS 2.0 (Level 3) compliance standards for enhanced coverage.
Impact— As new mappings are added, compliance score may vary
| ## REST API Updates | **Change** | **Description** | | --------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | |Alert Evidence Graph
24.12.1
|The Alert API Alert Evidence Graph - GET /alert/v1/{id}/graph includes two new properties in the AlertEvidenceGraph response object:
CapabilityNodePrimaryAssetNode{}Action Plan Management APIs
24.12.1
|The following new endpoints are available in the Action Plan Management APIs:
End of support for AWS Polly Voices API
24.12.1
|aws-polly-voices API is planned for deprecation. Due to this change, Prisma Cloud will no longer ingest metadata for the aws-polly-voices API.
In RQL, the key will not be available in the api.name attribute auto-completion.
Impact: If you have a saved search based on this API, you must manually delete it.
| --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.prismacloud.io/release-notes/prisma-cloud-release-information/features-introduced-in-2024/features-introduced-in-december-2024.md?ask=