The Prisma Cloud Darwin Release is now available for Prisma Cloud environments on app.gov. With the Code to Cloud™ intelligence capabilities in this release, your security and development teams can work together to reduce application risks and prevent breaches.
With this change, your tenant will be updated with the new intuitive user interface and rich set of security capabilities.
When you are upgraded to the Darwin release, refer to the Enterprise Edition documentation.
Contact your Prisma Cloud Customer Success team for more details.
| ## New Features | **Feature** | **Description** | | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | |View Saved Filters as Saved Views
Secure the Infrastructure
24.2.2
|Saved Filters on Prisma Cloud are now available as Saved Views on the Alerts, Compliance, and Governance pages. Navigate to Home > Alerts/Compliance/Governance > Overview to find your filter combinations available as Saved Views. The following caveats apply:
You can also create new Saved Views to store select filter combinations and table configurations for a customizable look at your security posture.
OAuth 2.0 support for ServiceNow Integration
Secure the Infrastructure
24.2.2
| Prisma Cloud has enhanced its [ServiceNow integration](https://docs.prismacloud.io/en/enterprise-edition/content-collections/administration/configure-external-integrations-on-prisma-cloud/integrate-prisma-cloud-with-servicenow) with OAuth 2.0 support, establishing a standardized and secure authentication framework for heightened security. This enhancement simplifies access token management, allowing Prisma Cloud to interact seamlessly with ServiceNow on your behalf, without exposing sensitive credentials. The result reduces the risk of unauthorized access while ensuring a more efficient and secure integration experience. | |Update Enhancements
Secure the Infrastructure
24.2.2
|Prisma Cloud includes the following enhancements for config from network RQL searches and policies:
The following enhancements are specific to AWS:
The following enhancement is specific to Azure:
Support Amazon Linux 2023
Secure the Runtime
24.2.2
| Prisma Cloud now supports Amazon Linux 2023 OS scans and security feed integration for Amazon Linux 2023. | |Enhanced CSV Organization
Secure the Runtime
24.2.2
| Segregating vulnerability and compliance findings based on Download Context. | |Enhanced Compliance Report
Secure the Runtime
24.2.2
| Added a new **Result** column to the compliance report CSV file. To get the report, go to **Monitor > Compliance > Compliance Explorer** and select **Containers**, **Images**, or **Hosts**. The new column shows either **pass** or **fail** for each resource and the corresponding compliance check ID. | |Detect Go Stdlib Vulnerabilities at the Package Level
Secure the Runtime
24.2.2
| In O’Neal Update 3, Prisma Cloud has enhanced its capability to detect vulnerabilities in Go libraries. Previously, a broad approach was used for Go stdlib libraries, categorizing CVEs as "Go" vulnerabilities rather than associating them with specific vulnerable standard libraries. This update offers a more precise classification, allowing for the identification of specific vulnerable symbols within libraries. Moreover, the latest agents can now detect both stdlib with symbols they utilize and the installed Go runtime. This comprehensive approach enables Prisma Cloud to conduct more accurate vulnerability assessments, leading to a significant reduction in false positives. If you have utilized the Go detection capabilities previously, you are likely to experience a noticeable reduction in the number of reported vulnerabilities due to this improvement. | |Support for Just in Time (JIT) Auto-Provisioning
Secure the Infrastructure
24.2.1
| Prisma Cloud offers System Administrators the ability to auto-provision users using the Open ID Connect (OIDC) Single Sign-On (SSO) configuration. Configure [OIDC Just in Time (JIT)](https://docs.prismacloud.io/en/enterprise-edition/content-collections/administration/setup-sso-integration-on-prisma-cloud/get-started-with-oidc-sso/get-started-with-oidc-jit) provisioning to grant Prisma Cloud users limited real-time access when they log into their IdP with the appropriate credentials. | |Support for New Region on GCP
Secure the Infrastructure
24.2.1
|Prisma Cloud now ingests data for resources deployed in the Johannesburg region on GCP.
To review a list of supported regions, select Inventory > Assets, and choose Cloud Region from the filter drop-down.
Added non-default branch scanning
Secure the Source
24.2.1
| You can now scan branches other than the main or master, such as a feature branch or sprint branch, to obtain a comprehensive overview of the security issues in those branches before merging them into the main branch. For more information, under the Application Security documentation, select Get Started and navigate to [Non-Default Branch Scan](https://docs.prismacloud.io/en/enterprise-edition/content-collections/application-security/get-started/non-default-branch-scan). | ## API Ingestions | **Service** | **API Details** | | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | |AWS Batch
24.2.2
|aws-batch-job-definition
Additional permission required:
batch:DescribeJobDefinitionsThe Security Audit role includes the permission.
| |AWS CodeBuild
24.2.2
|aws-code-build-source-credential
Additional permission required:
codebuild:ListSourceCredentialsYou must manually add the above permission to the CFT template to enable it.
| |AWS CodeCommit
24.2.2
|aws-code-commit-repository
Additional permissions required:
codecommit:ListRepositoriescodecommit:GetRepositoryThe Security Audit Policy role includes the permissions.
| |AWS CodeCommit
24.2.2
|aws-code-commit-approval-rule-template
Additional permissions required:
codecommit:ListApprovalRuleTemplatescodecommit:GetApprovalRuleTemplateThe Security Audit Policy role includes the permission for codecommit:ListApprovalRuleTemplates.
Amazon CodePipeline
24.2.2
|aws-code-pipeline-webhook
Additional permission required:
codepipeline:ListWebhooksYou must manually add the codepipeline:ListWebhooks permission to the CFT template to enable it.
AWS Config
24.2.2
|aws-configservice-aggregator
Additional permission required:
config:DescribeConfigurationAggregatorsThe Security Audit role includes the permission.
| |AWS DataSync
24.2.2
|aws-datasync-agent
Additional permissions required:
datasync:ListAgentsdatasync:DescribeAgentThe Security Audit role includes the permissions.
| |Amazon EC2
24.2.2
|aws-ec2-vpc-endpoint-service
Additional permission required:
ec2:DescribeVpcEndpointServicesThe Security Audit Policy role includes the permission.
| | Update **Amazon Elastic Container Registry (ECR)** |aws-ecr-image
Prisma Cloud updated the aws-ecr-image API to exclude the lastRecordedPullTime field from the JSON because it changes frequently causing too many resource snapshots.
Update OCI APIs
24.2.2
|Prisma Cloud updated oci-compute-instance, oci-cloudguard-security-zone, and oci-apimanagement-apigateway-deployment APIs to prevent the ingestion of deleted resources from Oracle Cloud Service Provider.
oci-cloudguard-security-zone will be enhanced to ingest resources from multiple compartments, extending beyond the home region.
Amazon EC2 Image Builder
24.2.1
|aws-imagebuilder-component
Additional permissions required:
imagebuilder:ListComponentsimagebuilder:GetComponentYou must manually add the above permissions to the CFT template to enable them.
| |Amazon EC2 Image Builder
24.2.1
|aws-imagebuilder-image-recipe
Additional permissions required:
imagebuilder:ListImageRecipesimagebuilder:GetImageRecipeYou must manually add the above permissions to the CFT template to enable them.
| |Amazon EC2 Image Builder
24.2.1
|aws-imagebuilder-image-pipeline
Additional permissions required:
imagebuilder:ListImagePipelinesimagebuilder:GetImagePipelineYou must manually add the above permissions to the CFT template to enable them.
| |Amazon EC2 Image Builder
24.2.1
|aws-imagebuilder-infrastructure-configuration
Additional permissions required:
imagebuilder:ListInfrastructureConfigurationsimagebuilder:GetInfrastructureConfigurationYou must manually add the above permissions to the CFT template to enable them.
| |AWS Elastic Disaster Recovery
24.2.1
|aws-drs-job
Additional permission required:
drs:DescribeJobsYou must manually add the above permission to the CFT template to enable it.
| |AWS Elastic Disaster Recovery
24.2.1
|aws-drs-replication-configuration
Additional permissions required:
drs:DescribeSourceServersdrs:GetReplicationConfigurationYou must manually add the above permissions to the CFT template to enable them.
| |AWS Elastic Disaster Recovery
24.2.1
|aws-drs-source-server
Additional permission required:
drs:DescribeSourceServersYou must manually add the above permission to the CFT template to enable it.
| |Google Cloud VMware Engine
24.2.1
|gcloud-vmware-engine-network
Additional permissions required:
vmwareengine.locations.listvmwareengine.vmwareEngineNetworks.listThe Viewer role includes the permissions.
| |Google Cloud VMware Engine
24.2.1
|gcloud-vmware-engine-network-policy
Additional permissions required:
vmwareengine.locations.listvmwareengine.networkPolicies.listThe Viewer role includes the permissions.
| |Google Vertex AI AIPlatform
24.2.1
|gcloud-vertex-ai-aiplatform-dataset
Additional permission required:
aiplatform.datasets.listThe Viewer role includes the permission.
| |Google Vertex AI AIPlatform
24.2.1
|gcloud-vertex-ai-aiplatform-hyperparameter-tuning-job
Additional permission required:
aiplatform.hyperparameterTuningJobs.listThe Viewer role includes the permission.
| |Google Vertex AI AIPlatform
24.2.1
|gcloud-vertex-ai-aiplatform-index
Additional permission required:
aiplatform.indexes.listThe Viewer role includes the permission.
| |Google Vertex AI AIPlatform
24.2.1
|gcloud-vertex-ai-aiplatform-feature-store-entity-type
Additional permissions required:
aiplatform.featurestores.listaiplatform.entityTypes.listaiplatform.entityTypes.getIamPolicyThe Viewer role includes the permissions.
| |Update Google Cloud Firestore
24.2.1
|gcloud-cloud-firestore-native-database
Prisma Cloud updated the gcloud-cloud-firestore-native-database API to exclude the earliestVersionTime field from the resource configuration because it changes frequently causing too many resource snapshots.
Update Google Compute Engine (GCE)
24.2.1
|gcloud-compute-autoscaler
Prisma Cloud updated the gcloud-compute-autoscaler API to exclude the recommendedSize field from the resource configuration because it changes frequently causing too many resource snapshots.
| Policies | Description |
Azure Batch Account configured with overly permissive network access 24.2.2 | This policy identifies Batch Accounts configured with overly permissive network access. By default, Batch accounts are accessible from the all networks. With an Account access IP firewall, you can restrict it further to only a set of IPv4 addresses or IPv4 address ranges. With Private access Virtual Networks, the network traffic path is secured on both ends. It is recommended to configure the Batch account with an IP firewall or by Virtual Network, so that the Batch account is accessible only to restricted entities. Policy Severity— High Policy Type— Config |
Azure Storage Account storing Machine Learning workspace high business impact data is publicly accessible 24.2.2 | This policy identifies Azure Storage Accounts storing Machine Learning workspace high business impact data that are publicly accessible. Azure Storage account stores machine learning artifacts such as job logs. By default, this storage account is used when you upload data to the workspace. The attacker could exploit publicly accessible storage account to get machine learning workspace high business impact data logs and could breach in to the system by leveraging data exposed. It is recommended to restrict storage account access to only to the machine learning services as per business requirement. Policy Severity— High Policy Type— Config |
AWS account security contact information is not set 24.2.2 | This policy identifies the AWS account which has not set security contact information. Providing dedicated contact information for security specific, AWS can directly communicate security advisories to the team responsible for handling security-related issues. Failure to specify security contact info in AWS risks missing critical advisories, leading to delayed incident response and increased vulnerability exposure. It is recommended to set security contact information to receive notifications. Policy Severity— Information Policy Type— Config |
Azure Cognitive Services account configured with local authentication 24.2.2 | This policy identifies Azure Cognitive Services accounts that are configured with local authentication methods instead of AD identity. Local authentication allows users to access the service using a local account and password, rather than an Azure Active Directory (Azure AD) account. Disabling local authentication methods improves security by ensuring that Cognitive Services accounts require Active Directory identities exclusively for authentication. It is recommended to disable local authentication methods on your Cognitive Services account, instead use Azure Active Directory identities. Policy Severity— Low Policy Type— Config |
Azure Machine learning workspace is not configured with private endpoint 24.2.2 | This policy identifies Azure Machine learning workspaces that are not configured with private endpoint. Private endpoints in workspace resources allow clients on a virtual network to securely access data over Azure Private Link. Configuring a private endpoint enables access to traffic coming from only known networks and prevents access from malicious or unknown IP addresses which includes IP addresses within Azure. It is recommended to create private endpoint for secure communication for your Machine learning workspaces. Policy Severity— Medium Policy Type— Config |
AWS Systems Manager EC2 instance having NON_COMPLIANT patch compliance status 24.2.2 | This policy identifies if the AWS Systems Manager patch compliance status is "NON_COMPLIANT" with critical or high severity for managed instances. Instances labeled non-compliant might lack essential patches for security, stability, or meeting standards. Non-compliant instances pose security risks because attackers often target unpatched systems to exploit known weaknesses. As a security best practice, it’s recommended to apply any missing patches to the affected instances. Policy Severity— High Policy Type— Config |
Azure Microsoft Defender for Cloud set to Off for Databases 24.2.2 | This policy identifies Azure Microsoft Defender for Cloud which has defender setting for Databases set to Off. Enabling Azure Defender for Cloud provides advanced security capabilities like threat intelligence, anomaly detection, and behaviour analytics. Defender for Databases in Microsoft Defender for Cloud allows you to protect your entire database estate with attack detection and threat response for the most popular database types in Azure. It is highly recommended to enable Azure Defender for Databases. Policy Severity— Information Policy Type— Config |
Azure Microsoft Defender for Cloud set to Off for Open-Source Relational Databases 24.2.2 | This policy identifies Azure Microsoft Defender for Cloud which has defender setting for Open-Source Relational Databases set to Off. Enabling Azure Defender for cloud provides advanced security capabilities like threat intelligence, anomaly detection, and behaviour analytics. Microsoft Defender for Cloud detects anomalous activities indicating unusual and potentially harmful attempts to access or exploit databases. It is highly recommended to enable Azure Defender for Open-Source Relational Databases. Policy Severity— Information Policy Type— Config |
Azure Microsoft Defender for Cloud set to Off for Cosmos DB 24.2.2 | This policy identifies Azure Microsoft Defender for Cloud which has defender setting for Cosmos DB set to Off. Enabling Azure Defender for the cloud provides advanced security capabilities like threat intelligence, anomaly detection, and behaviour analytics. Microsoft Defender for Azure Cosmos DB detects potential SQL injections, known bad actors based on Microsoft Threat Intelligence, suspicious access patterns, and potential exploitation of your database through compromised identities, or malicious insiders. It is highly recommended to enable Azure Defender for Cosmos DB. Policy Severity— Information Policy Type— Config |
New to Configuration Build Policies 24.2.2 | Starting with 23.12.1 196 new Config policies of subtype Build are added in GA on Prisma Cloud platform. See Application Security Policy Reference Guide for more details. Here are the list of policies: Open API Policies The list of policies with High policy severity:
The list of policies with Medium policy severity:
The list of policies with Low policy severity:
AWS General Policies The list of policies with High policy severity:
The list of policies with Medium policy severity:
The list of policies with Low policy severity:
The list of policies with Informational policy severity:
AWS IAM Policies The list of policies with High policy severity:
The list of policies with Medium policy severity:
The list of policies with Low policy severity:
AWS Kubernetes Policies The list of policies with High policy severity:
AWS Logging Policies The list of policies with Medium policy severity:
The list of policies with Low policy severity:
AWS Networking Policies The list of policies with High policy severity:
The list of policies with Medium policy severity:
The list of policies with Low policy severity:
The list of policies with Informational policy severity:
Azure General Policies The list of policies with High policy severity:
The list of policies with Medium policy severity:
The list of policies with Low policy severity:
The list of policies with Informational policy severity:
Azure IAM Policies
The list of policies with Informational policy severity:
Azure Kubernets Policies The list of policies with High policy severity:
The policy with Medium policy severity:
Azure Logging Policies The policy with Medium policy severity:
Azure Networking Policies The list of policies with High policy severity:
The list of policies with Medium policy severity:
The policy with Low policy severity:
The list of policies with Informational policy severity:
Azure Storage Policies The list of policies with High policy severity:
The list of policies with Medium policy severity:
Docker Policies The policy with Medium policy severity:
Google Cloud General Policies The list of policies with High policy severity:
The list of policies with Medium policy severity:
Google Cloud IAM Policies The list of policies with High policy severity:
The policy with Medium policy severity:
Google Cloud Kubernetes Policies The policy with Informational policy severity:
Google Cloud Networking Policies The policy with Medium policy severity:
Google Cloud Storage GCS Policies The policy with Low policy severity:
Logging Policies The policy with Medium policy severity:
The list of policies with Low policy severity:
The policy with Informational policy severity:
OCI General Policies The policy with Medium policy severity:
The list of policies with Low policy severity:
OCI IAM Policies The policy with Medium policy severity:
OCI Networking Policies The list of policies with Informational policy severity:
Impact- You will view policy violations for these policies on Prisma Cloud switcher Application Security > Projects in IaC Misconfigurations code category. Enforcement levels for IaC Misconfigurations will now be applied to pipelines with these findings. You may enable additional subscriptions on Application Security > Settings to view violations and alerts for these policies. |
AWS Log metric filter and alarm does not exist for AWS Organization changes 24.2.1 | Identifies the AWS regions that do not have a log metric filter and alarm for AWS Organizations changes. Monitoring changes to AWS Organizations will help to ensure any unwanted, accidental, or intentional modifications that may lead to unauthorized access or other security breaches within the AWS account. It is recommended that a metric filter and alarm be established for detecting changes to AWS Organization’s configurations. This policy will trigger an alert if you have at least one Cloudtrail with the multi trial enabled, Logs all management events in your account, and is not set with a specific log metric filter and alarm. Policy Severity— Information Policy Type— Config |
AWS Log metric filter and alarm does not exist for usage of root account 24.2.1 | identifies the AWS regions that do not have a log metric filter and alarm for usage of a root account. Monitoring for root account logins will provide visibility into the use of a fully privileged account and an opportunity to reduce its use it. Failure to monitor root account logins may result in a lack of visibility into unauthorized use or attempts to access the root account, posing potential security risks to your AWS environment. It is recommended that a metric filter and alarm be established for detecting changes to CloudTrail’s configurations. This policy will trigger alert if you have at least one Cloudtrail with the multi trial is enabled, Logs all management events in your account and is not set with specific log metric filter and alarm. Policy Severity— Information Policy Type— Config |
AWS IAM AWSCloudShellFullAccess policy is attached to IAM roles, users, or IAM groups 24.2.1 | Identifies the AWSCloudShellFullAccess policy attached to IAM roles, users, or IAM groups. AWS CloudShell is a convenient way of running CLI commands against AWS services. The 'AWSCloudShellFullAccess' IAM policy, providing unrestricted CloudShell access, poses a risk of data exfiltration, allowing malicious admins to exploit file upload/download capabilities for unauthorized data transfer. As a security best practice, it is recommended to grant least privilege access like granting only the permissions required to perform a task, instead of providing excessive permissions. Policy Severity— Information Policy Type— Config |
| Policy Updates | Description |
| Policy Updates—RQL | |
| GCP Cloud Armor policy not configured with cve-canary rule | Changes— The policy RQL will be updated to exclude checking edge security type of policy as pre-built rules (such as cve-canary) cannot be applied to edge security policy. Severity— Medium Policy Type— Config Current RQL— Updated RQL— Impact— Low. Existing alerts will be resolved as |
| MWAA environment is publicly accessible | Changes— The policy is deleted from the Prisma Cloud platform. Severity— High Policy Type— Config Build Impact— You will no longer receive alerts. |
New policy mappings for Azure CIS
24.2.2
|The following compliance requirements in Azure CIS 1.5 Level 1, Azure CIS 1.5 Level 2 and Azure CIS v2.0.0 Level 2 are updated with new mappings.
Impact- As new mappings are introduced, compliance scoring might vary.
| |Risk Management in Technology includes mappings to support GCP
24.2.2
|Google Cloud Platform support is added for the Risk Management in Technology(RMiT) compliance standard.
Impact- As new mappings are introduced, compliance scoring might vary.
| ## REST API Updates | **Change** | **Description** | | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | |New incident policies based on traffic observation
Secure the Runtime
24.2.2
|This update adds two new policies that alert you to traffic that includes:
Split Vulnerability and Compliance CSV
Secure the Runtime
24.2.2
|The following APIs include a new parameter, issueType:
The issueType parameter can be set to vulnerabilities or compliance for downloading vulnerability or compliance issues respectively. If either value is not provided, both vulnerability and compliance issues are downloaded.
Just-In-Time (JIT) Support
24.2.1
|The following Single Sign-On (SSO) endpoints now support Just-In-Time (JIT) user provisioning:
Enterprise Settings APIs
24.2.1
|The following APIs have a new boolean field autoEnableAttackPathAndModulePolicies with false as default.
Unified Vulnerability Explorer
24.2.1
|The following new endpoints are now available to get details from the vulnerabilities dashboard:
Get Vulnerability Overview V2 - GET uve/api/v2/dashboard/vulnerabilities/overviewGet Vulnerabilities Burndown - GET uve/api/v2/dashboard/vulnerabilities/burndown