Identify Cloud Workload Identities
Secure the Infrastructure
24.7.3
|Enhancements to Prisma Cloud’s CIEM capabilities enable you to extract relevant information about GCP service accounts with access to your AWS environment. Configure IAM roles to proactively defend against cross-cloud lateral threat vectors. Use the RQL query below to investigate trust policies, to securely handle identities and permissions across your multicloud environments.
config from IAM where source.cloud.type = GCP and dest.cloud.type = AWS and dest.cloud.resource.access.isadministrative = TrueSupport for Last Access Detection
Secure the Infrastructure
24.7.3
|Prisma Cloud’s IAM functionality now includes the ability to to detect inactive cloud service accounts, by querying the days passed since the last usage of the cloud service account. Available for AWS and Azure, you can use the RQL clause below to find last login information for AWS roles and Azure service principals.
grantedby.cloud.entity.lastloginAttribute Type: Number (Days since the last login/activity)
Values: - <, >, ⇐, >=, =, =!
| |Source Vendor RQL Support for AWS and GCP
Secure the Infrastructure
24.7.3
|RQL enhancements now provide greater visibility into validated vendor access including access type and usage in AWS and GCP environments. The following attribute is supported in both AWS and GCP:
source.cloud.account.isvendorRQL Support for MFA
Secure the Infrastructure
24.7.3
| Protect your cloud environment from infiltration by identifying users that do not use Multi-Factor Authentication (MFA). The Cloud Identity and Exposure Management (CIEM) enhancements allow you to identify users without MFA enabled. Use the new RQL query `source.MFAenabled` to create policies such as `user with high privileges and MFA disabled` with the appropriate severities. The query will return True/False values (whether MFA is active/inactive). | |Enhanced CVE Runtime Vulnerability Detection
Secure the Source
24.7.3
| Mitigate vulnerabilities at their source, and proactively prevent them from reaching runtime environments, with Prisma Cloud’s enhanced CVE vulnerability detection. Leverage the **Vulnerability Risk Factors** filter on the **Home > Application Security > Projects** page to identify vulnerabilities based on **Package in Runtime**, **Repository in Runtime**, and **Manifest in Runtime** filters. These [filters](https://docs.prismacloud.io/en/enterprise-edition/content-collections/application-security/risk-management/monitor-and-manage-code-build/software-composition-analysis/software-composition-analysis) allow you to hone in on the vulnerabilities at their source and prevent runtime access. | |Support for .NET Central Package Management
Secure the Source
24.7.3
| Prisma Cloud’s Application Security enhancements now offers support for additional package managers that help you manage common dependencies for multiple projects in a single location. Additional support for NuGet’s Central Package Management lets you store your varied packaged projects in the `Directory.Packages.props` file. Learn more about this [enhancement](https://docs.prismacloud.io/en/enterprise-edition/content-collections/application-security/supported-technologies) to Software Composition Analysis (SCA) capabilities. | |Identify Third-Party AI Libraries
Secure the Source
24.7.3
| Identify third-party AI Libraries with ease with Prisma Cloud’s enhanced [Software Bill of Material](https://docs.prismacloud.io/en/enterprise-edition/content-collections/application-security/visibility/sbom/sbom) (SBOM) enhancements. Navigate to **Home > Application Security > Visibility > SBOM** to detect Artificial Intelligence (AI) and Machine Learning (ML) functionality incorporated into your codebase through third-party libraries. Use this information to build a comprehensive inventory of the machine learning packages, to help you effectively mitigate risks and make informed security decisions. | |Improve Package Management with Application Graph
Secure the Source
24.7.3
| The [Application Graph](https://docs.prismacloud.io/en/enterprise-edition/content-collections/application-security/visibility/repositories#app-graph) now visualizes all packages in your repository, including the number of package files, and direct and indirect dependencies. This visual representation helps you identify potential dependency conflicts and manage package relationships effectively. Use the vulnerable packages filter to quickly find packages that include vulnerabilities. | |Effectively Allocate Security Resources with the Repository Importance Score
Secure the Source
24.7.3
| Enhancements to the [Repository Importance Score](https://docs.prismacloud.io/en/enterprise-edition/content-collections/application-security/visibility/repositories#repo-importance-score) allow you to prioritize security efforts across multiple code repositories, by quantifying the significance of each repository. Leverage this data-driven scoring system, to categorize important repositories, and prioritize fixing issues in the most critical repositories first. You can also customize this score to accommodate your organization’s specific security priorities, and secure your business-critical assets. | |A new registry scan status
Secure the Runtime
32.07.123
|A new status, Partially Completed, has been added to the scan statuses for registry scans. This status is assigned when at least one image has been successfully scanned in the registry.
The Partially Completed status appears as follows during the registry scan:
It also displays the number of images that have been scanned successfully.
| |Support for New Regions on OCI
Secure the Infrastructure
24.7.2
|Prisma Cloud now ingests data for resources deployed in Chicago, Madrid, Paris, Queretaro cloud regions on OCI.
To review the list of supported regions, select Inventory > Assets, and choose Cloud Region filter.
Network Flowlog Filter
Secure the Infrastructure
24.7.1
|The Inventory > Unmanaged Assets page now includes a new Network Flowlog filter. Use this filter to search for internet-exposed assets connected to secured assets on Prisma Cloud.
Update Vulnerabilities Dashboard
Secure the Infrastructure
24.7.1
|The Vulnerabilities dashboard now provides 3 new widgets:
You can also CVE Preview Card, which highlights the most important information about a CVE, without the need to click on it and open the sidecar.
Update CSV Bulk Download in Table View
Secure the Infrastructure
24.7.1
|Previously, you would have to download the CSV file per CVE, which was time consuming and tedious. Now, in the table view, you can select Download > Download all CVE data in a single CSV file. The CSV file is limited to 10K records.
Update Vulnerability Results in Table View
Secure the Infrastructure
24.7.1
|Previously, since no results count was displayed in the table view, you would not know how many CVEs, vulnerabilities, or assets were part of the RQL result. Now, the table view displays the updated number of unique CVEs, vulnerabilities, and affected assets in real time.
Severity Mapping Update for Intelligence Stream
Secure the Runtime
32.07.123
|The severity values for the Intelligence stream are now mapped into 2 predefined values: “ High” and “Medium”.
Note: The severity values are already normalized to create rules. The current change is only specific to the severity reporting name change.
The following list defines the new vendor severity mapping:
Note: End-of-life will be set in the vulnerability status.
Note: The previous “unimportant”, “unassigned”, “untriaged”, “negligible” and “not yet assigned” severity mapping behaviour remains unchanged.
All the other unrecognized severity values from the different feeds will be assigned according to the NVD severity.
For more information, see CVSS Scoring.
| |End of support for Debian 10 (Buster)
Secure the Runtime
32.07.123
|Debian 10 (Buster) reached end-of-life on June 30, 2024. Starting from July 2024, the Debian Long Term Support (LTS) team has stopped providing security information for Debian 10.
Consequently, vulnerabilities related to Debian 10 (Buster) were removed from the Prisma Cloud Intelligence Stream.
Impact: Starting from this version, customers using Debian Buster (LTS or ELTS) will no longer see vulnerability data related to this version.
| ## API Ingestions | **Service** | **API Details** | | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | |Amazon S3
24.7.3
|aws-s3api-get-bucket-acl
Additional permission required:
s3:GetAccelerateConfigurationThe Security Audit role includes the permission.
Also, this API has been updated to include the following new field in the resource JSON:
bucketAccelerateConfigurationAWS Application Migration Service
24.7.3
|aws-mgn-replication-configuration-template
Additional permission required:
mgn:DescribeReplicationConfigurationTemplatesThe Security Audit role does not include the permission. You must manually add the above permission to the CFT template to enable it.
| |Amazon EMR
24.7.3
|aws-emr-serverless-application
Additional permissions required:
emr-serverless:ListApplicationsemr-serverless:GetApplicationThe Security Audit role includes the permissions.
| |Azure Compute
24.7.3
|azure-compute-snapshots
Additional permission required:
Microsoft.Compute/snapshots/readThe Reader role includes the permission.
| |Azure Monitor
24.7.3
|azure-monitor-smart-detector-alert-rules
Additional permission required:
Microsoft.AlertsManagement/smartDetectorAlertRules/readThe Reader role includes the permission.
| |Azure Monitor
24.7.3
|azure-monitor-prometheus-rule-groups
Additional permission required:
Microsoft.AlertsManagement/prometheusRuleGroups/readThe Reader role includes the permission.
| |Azure Monitor
24.7.3
|azure-monitor-query-packs
Additional permission required:
Microsoft.OperationalInsights/querypacks/readThe Reader role includes the permission.
| |Azure Resource Manager
24.7.3
|azure-template-specs
Additional permission required:
Microsoft.Resources/templateSpecs/readThe Reader role includes the permission.
| |Update Google Anthos GKE Fleet Management
24.7.3
|To improve performance, the gkehub.locations.list permission is no longer required for the following APIs:
Update Google Certificate Manager
24.7.3
|To improve performance, the certificatemanager.locations.list permission is no longer required for the following APIs:
Update Google Cloud Deploy
24.7.3
|To improve performance, the clouddeploy.locations.list permission is no longer required for the following APIs:
Update Google Cloud Memorystore for Memcached
24.7.3
| To improve performance, the `networkconnectivity.locations.list` permission is no longer required for the **gcloud-memorystore-memcached-instance** API. | |Update Google Cloud VMware Engine
24.7.3
|To improve performance, the vmwareengine.locations.list permission is no longer required for the following APIs:
Update Google Datastream
24.7.3
|To improve performance, the datastream.locations.list permission is no longer required for the following APIs:
Update Google Hybrid Connectivity
24.7.3
| To improve performance, the `memcache.locations.list` permission is no longer required for the **gcloud-hybrid-connectivity-spoke** API. | |Update Google Traffic Director
24.7.3
|To improve performance, the networkservices.locations.list permission is no longer required for the following APIs:
Update Google Workflows
24.7.3
| To improve performance, the `workflows.locations.list` permission is no longer required for the **gcloud-workflows-workflow** API. | |Amazon S3
24.7.3
|aws-s3api-get-bucket-acl
Additional permission required:
s3:GetAccelerateConfigurationThe Security Audit role includes the permission.
Also, this API has been updated to include the following new field in the resource JSON:
bucketAccelerateConfigurationAmazon Comprehend
24.7.2
|aws-comprehend-targeted-sentiment-detection-jobs
Additional permissions required:
comprehend:ListTargetedSentimentDetectionJobscomprehend:ListTagsForResourceThe Security Audit role does not include the permissions. You must manually add the above permissions to the CFT template to enable them.
| |Amazon EMR
24.7.2
|aws-emr-studio
Additional permissions required:
elasticmapreduce:ListStudioselasticmapreduce:DescribeStudioThe Security Audit role includes the elasticmapreduce:DescribeStudio permission.
The Security Audit role does not include the elasticmapreduce:ListStudios permission. You must manually add it to the CFT template to enable it.
Amazon SageMaker
24.7.2
|aws-sagemaker-labeling-job
Additional permissions required:
sagemaker:ListLabelingJobssagemaker:DescribeLabelingJobThe Security Audit role includes the permissions.
| |Amazon S3
24.7.2
|aws-s3api-get-bucket-acl
Additional permission required:
s3:GetBucketObjectLockConfigurationThe Security Audit role includes the permission.
Also, this API has been updated to include the following new field in the resource JSON:
objectLockConfigurationAWS Service Catalog
24.7.2
|aws-servicecatalog-product
Additional permission required:
servicecatalog:SearchProductsThe Security Audit role does not include the permission. You must manually add the above permission to the CFT template to enable it.
| |AWS Step Functions
24.7.2
|aws-step-functions-activity
Additional permission required:
states:ListActivitiesThe Security Audit role does not include the permission. You must manually add the above permission to the CFT template to enable it.
| |Azure DNS
24.7.2
|azure-dns-private-dns-zone-record-sets
Additional permissions required:
Microsoft.Network/privateDnsZones/readMicrosoft.Network/privateDnsZones/ALL/readThe Reader role includes the permissions.
| |Azure Event Grid
24.7.2
|azure-event-grid-partner-namespaces
Additional permission required:
Microsoft.EventGrid/partnerNamespaces/readThe Reader role includes the permission.
| |Azure Log Analytics
24.7.2
|azure-log-analytics-workspace-tables
Additional permissions required:
Microsoft.OperationalInsights/workspaces/readMicrosoft.OperationalInsights/workspaces/tables/readThe Reader role includes the permissions.
| |Azure Machine Learning
24.7.2
|azure-machine-learning-workspace-managed-network-outbound-rules
Additional permissions required:
Microsoft.MachineLearningServices/workspaces/readMicrosoft.MachineLearningServices/workspaces/outboundRules/readThe Reader role includes the permissions.
| |Azure Notification Hubs
24.7.2
|azure-notification-hub-namespace-diagnostic-settings
Additional permissions required:
Microsoft.NotificationHubs/Namespaces/readMicrosoft.Insights/DiagnosticSettings/ReadThe Reader role includes the permissions.
| |Google Cloud Build
24.7.2
|gcloud-cloud-build-trigger
Additional permission required:
cloudbuild.builds.listThe Viewer role includes the permission.
| |Google Firebase Hosting
24.7.2
|gcloud-firebase-hosting-site-custom-domain
Additional permission required:
firebasehosting.sites.getThe Viewer role includes the permission.
| |Google Firebase Hosting
24.7.2
|gcloud-firebase-hosting-site-channel
Additional permission required:
firebasehosting.sites.getThe Viewer role includes the permission.
| |Google Firebase Hosting
24.7.2
|gcloud-firebase-hosting-site
Additional permission required:
firebasehosting.sites.getThe Viewer role includes the permission.
| |Google reCAPTCHA Enterprise
24.7.2
|gcloud-recaptcha-enterprise-key
Additional permission required:
recaptchaenterprise.keys.listThe Viewer role includes the permission.
| |Update Google Certificate Authority Service
24.7.2
|To improve performance, the privateca.locations.list permission is no longer required for the following APIs:
Update OCI Cloud Guard
24.7.2
|oci-cloudguard-security-recipe
The oci-cloudguard-security-recipe API is updated to exclude the timeCreated and timeUpdated fields from JSON because it changes frequently causing too many resource snapshots.
AWS AppConfig
24.7.1
|aws-appconfig-application
Additional permissions required:
appconfig:ListApplicationsappconfig:ListEnvironmentsappconfig:ListConfigurationProfilesThe Security Audit role does not include the permissions. You must manually add the above permissions to the CFT template to enable them.
| |Amazon Route53 Resolver
24.7.1
|aws-route53resolver-resolver-endpoint
Additional permissions required:
route53resolver:ListResolverEndpointsroute53resolver:ListTagsForResourceThe Security Audit role includes the permissions.
| |AWS Service Catalog
24.7.1
|aws-servicecatalog-product-as-admin
Additional permission required:
servicecatalog:SearchProductsAsAdminThe Security Audit role does not include the permission. You must manually add the above permission to the CFT template to enable it.
| |Amazon SES
24.7.1
|aws-ses-receipt-rule-set
Additional permissions required:
ses:ListReceiptRuleSetsses:DescribeReceiptRuleSetThe Security Audit role includes the permissions.
| |Azure Cache
24.7.1
|azure-cache-redis-enterprise
Additional permission required:
Microsoft.Cache/redisEnterprise/readThe Reader role includes the permission.
| |Azure Monitor
24.7.1
|azure-monitor-data-collection-endpoints
Additional permission required:
Microsoft.Insights/DataCollectionEndpoints/ReadThe Reader role includes the permission.
| |Azure SignalR Service
24.7.1
|azure-signalr-diagnostic-settings
Additional permissions required:
Microsoft.SignalRService/SignalR/readMicrosoft.Insights/DiagnosticSettings/ReadThe Reader role includes the permissions.
| |Google Policy Analyzer
24.7.1
|gcloud-policy-analyzer-service-account-authentication
Additional permission required:
policyanalyzer.serviceAccountLastAuthenticationActivities.queryThe Viewer role includes the permission.
| |Google Eventarc
24.7.1
|gcloud-eventarc-trigger
Additional permissions required:
eventarc.triggers.listeventarc.triggers.getIamPolicyThe Viewer role includes the permissions.
| |Google Eventarc
24.7.1
|gcloud-eventarc-channel
Additional permissions required:
eventarc.channels.listeventarc.channels.getIamPolicyThe Viewer role includes the permissions.
| |Google Compute Engine
24.7.1
|gcloud-compute-machine-image
Additional permissions required:
compute.machineImages.listcompute.machineImages.getIamPolicyThe Viewer role includes the permissions.
| |Google Compute Engine
24.7.1
|gcloud-compute-reservation
Additional permissions required:
compute.reservations.listcompute.reservations.getIamPolicyThe Viewer role includes the permissions.
| |Update Google Dataproc Metastore
24.7.1
|gcloud-dataproc-metastore-service
The following permission is no longer required:
metastore.locations.listUpdate Google Dataproc Metastore
24.7.1
|gcloud-dataproc-metastore-federation
The following permission is no longer required:
metastore.locations.listUpdate Google API Gateway
24.7.1
|gcloud-apigateway-gateway
The following permission is no longer required:
apigateway.locations.list| Policies | Description |
AWS Elastic Load Balancer v2 (ELBv2) with deletion protection disabled 24.7.3 | This policy identifies Elastic Load Balancers v2 (ELBv2), which are configured with the deletion protection feature disabled. AWS Elastic Load Balancing automatically distributes incoming application traffic across multiple targets, such as EC2 instances, containers, and IP addresses, to improve the availability and fault tolerance of applications. To prevent your load balancer from being deleted accidentally, you can enable deletion protection. It is recommended to enable deletion protection on AWS Elastic load balancers to protect them from being deleted accidentally. Policy Severity— Low Policy Type— Config |
AWS MSK clusters not configured with enhanced monitoring 24.7.3 | This policy identifies MSK clusters that are not configured with enhanced monitoring. Amazon MSK is a fully managed Apache Kafka service on AWS that handles the provisioning, setup, and maintenance of Kafka clusters. Amazon MSK’s PER_TOPIC_PER_BROKER monitoring level provides granular insights into the audit, performance and resource utilization of individual topics and brokers, enabling you to identify and optimize bottlenecks in your Kafka cluster. It is recommended to enable at least PER_TOPIC_PER_BROKER monitoring on the MSK cluster to get enhanced monitoring capabilities. Policy Severity— Informational Policy Type— Config |
AWS Route53 public Hosted Zone query logging is not enabled 24.7.3 | This policy identifies the AWS Route53 public hosted zones DNS query logging is not enabled. Enabling DNS query logging for an AWS Route 53 hosted zone enhances DNS security and compliance by providing visibility into DNS queries. When enabled, Route 53 sends these log files to Amazon CloudWatch Logs. Disabling DNS query logging for AWS Route 53 limits visibility into DNS traffic, hampering anomaly detection, compliance efforts, and effective incident response. It is recommended to enable logging for all public hosted zones to enhance the visibility and compliance requirements. Policy Severity— Low Policy Type— Config |
AWS Network ACLs allow ingress traffic on Admin ports 22/3389 24.7.3 | This policy identifies the AWS Network Access Control List (NACL) which has a rule to allow ingress traffic to server administration ports. AWS NACL provides filtering of ingress and egress network traffic to AWS resources. Allowing ingress traffic on admin ports 22 (SSH) and 3389 (RDP) via AWS Network ACLs increases the vulnerability of EC2 instances and other network resources to unauthorized access and cyberattacks. It is recommended that no NACL allows unrestricted ingress access to server administration ports, such as SSH port 22 and RDP port 3389. This policy may report NACLs, which include the deny policy in the rule set. Make sure while remediating the rule set does not consist of the Allow and Deny rule set together; which leads to overlap on each ruleset. Policy Severity— Low Policy Type— Config |
Azure subscription permission for Microsoft Entra tenant is set to 'Allow everyone' 24.7.3 | This policy identifies Microsoft Entra tenant that are not configured with restrictions for 'Subscription entering Microsoft Entra tenant' and 'Subscription leaving Microsoft Entra tenant'. Users who are set as subscription owners can make administrative changes to the subscriptions and move them into and out of the Microsoft Entra tenant. Allowing subscriptions to enter or leave the Microsoft Entra tenant without restrictions can expose the organization to unauthorized access and potential security breaches. As a best practice, it is recommended to configure the settings for 'Subscription entering Microsoft Entra tenant' and 'Subscription leaving Microsoft Entra tenant' to 'Permit no one' to ensure only authorized subscriptions can interact with the tenant, thus enhancing the security of your Azure environment. Policy Severity— High Policy Type— Config |
Azure Key Vault Role Based Access control is disabled 24.7.3 | This policy identifies Azure Key Vault instances where Role-Based Access Control (RBAC) is not enabled. Without RBAC, managing access is less secure and can lead to improper access permissions, increasing the risk of unauthorized access to sensitive data. RBAC provides finer-grained access control, enabling secure and manageable permissions for key vault secrets, keys, and certificates. This allows for detailed permissions and the use of privileged identity management for enhanced security with Just-In-Time (JIT) access management. As best practice, it is recommended to enable RBAC for all Azure Key Vaults to ensure secure and manageable access control. Policy Severity— Medium Policy Type— Config |
Azure Microsoft Defender for IoT Hub not enabled 24.7.3 | This policy identifies Azure IoT Hubs without Microsoft Defender for IoT enabled. Azure IoT Hub is a managed service that acts as a central message hub for communication between IoT applications and IoT devices. Without Microsoft Defender for IoT enabled, IoT devices and hubs are more vulnerable to security threats. This increases the risk of unauthorized access, data breaches, and compromised IoT devices, which can lead to operational and security challenges. As best practice, it is recommended to enable Microsoft Defender for IoT on your Azure IoT Hub. This enhances the security posture of your IoT solutions by providing continuous monitoring, threat detection, and automated response capabilities to protect against cyber threats. Policy Severity— Low Policy Type— Config |
Azure Network Security Group having Inbound rule overly permissive to HTTP(S) traffic 24.7.3 | This policy identifies Network Security Groups (NSGs) that have inbound rules allowing overly permissive access to HTTP or HTTPS traffic. A network security group contains a list of security rules that allow or deny inbound or outbound network traffic based on source or destination IP address, port, and protocol. Overly permissive inbound rules for HTTP(S) traffic increase the risk of unauthorized access and potential attacks on your network resources. This can lead to data breaches, exposure of sensitive information, and other security incidents. As a best practice, it is recommended to configure NSGs to restrict HTTP(S) traffic to only necessary and trusted IP addresses. Policy Severity— Low Policy Type— Config |
Azure Machine learning workspace configured with overly permissive network access 24.7.3 | This policy identifies Load balancers that are not configured with Network Security Groups. Without Network Security Groups, load balancers may be exposed to unwanted traffic, increasing the risk of security breaches and unauthorized access. NSGs allow administrators to define security rules that specify the types of traffic allowed to flow in and out of the load balancer, enhancing overall network security. As a best practice, it is recommended to restrict access to the load balancer by configuring network security groups. Policy Severity— High Policy Type— Config/Run/Build |
Azure Machine learning workspace is not configured with private endpoint 24.7.3 | This policy detects whether an Azure Machine Learning workspace is configured with a private endpoint. Configuring a private endpoint for the Azure Machine Learning workspace is recommended to enhance security by restricting network access and preventing public internet access to the workspace. Policy Severity— Medium Policy Type— Config/Build |
OCI Load balancer not configured with Network Security Groups 24.7.3 | This policy identifies Load balancers that are not configured with Network Security Groups. Without Network Security Groups, load balancers may be exposed to unwanted traffic, increasing the risk of security breaches and unauthorized access. NSGs allow administrators to define security rules that specify the types of traffic allowed to flow in and out of the load balancer, enhancing overall network security. As a best practice, it is recommended to restrict access to the load balancer by configuring network security groups. Policy Severity— Medium Policy Type— Config |
OCI Load balancer backend set not configured with SSL certificate 24.7.3 | This policy identifies Load balancers for which the backend set is not configured with an SSL certificate. Without an SSL certificate, data transferred between the load balancer and backend servers is not encrypted, making it vulnerable to interception and attacks. Proper SSL configuration ensures data integrity and privacy, protecting sensitive information from unauthorized access. As a best practice, it is recommended to implement SSL between the load balancer and your backend servers so that traffic between the load balancer and the backend servers is encrypted. Policy Severity— Medium Policy Type— Config |
OCI API Gateway is not configured with Network Security Groups 24.7.3 | This policy identifies API Gateways that are not configured with Network Security Groups. Network security groups give fine-grained control of resources and help in restricting network access to your Private API Gateway with specific ports or with specific IP address range. As best practice, it is recommended to restrict access to the API Gateway by configuring network security groups. Policy Severity— Medium Policy Type— Config |
OCI Function Application is not configured with Network Security Groups 24.7.3 | This policy identifies Function Applications that are not configured with Network Security Groups. OCI Function Applications allow you to execute code in response to events without provisioning or managing infrastructure. When these function applications are not configured with NSGs, they are more vulnerable to unauthorized access and potential security breaches. NSGs help isolate and protect your functions by ensuring that only trusted sources can communicate with them. As a best practice, it is recommended to restrict access to the application traffic by configuring network security groups. Policy Severity— Medium Policy Type— Config |
OCI Data Catalog configured with overly permissive network access 24.7.3 | This policy identifies Data Catalogs configured with overly permissive network access. The OCI Data Catalog service provides a centralized repository to manage and govern data assets, including their metadata. When network access settings are too permissive, it can expose sensitive metadata to unauthorized users or malicious actors, potentially leading to data breaches and compliance issues. As a best practice, it is recommended to configure the Data catalog with private endpoints; so that the Data catalog is accessible only to restricted entities. Policy Severity— Medium Policy Type— Config |
AWS CodeBuild project not configured with logging configuration 24.7.2 | This policy identifies AWS CodeBuild project environments without a logging configuration. AWS CodeBuild is a fully managed service for building, testing, and deploying code. Logging is a crucial security feature that allows for future forensic work in the event of a security incident. Correlating abnormalities in CodeBuild projects with threat detections helps boost confidence in their accuracy. It is recommended to enable logging configuration on CodeBuild projects for monitoring and troubleshooting purposes. Policy Severity— Informational Policy Type— Config |
AWS CloudWatch log groups retention set to less than 365 days 24.7.2 | This policy identifies the AWS CloudWatch LogGroups as having a retention period set to less than 365 days. CloudWatch Logs centralize and store logs from AWS services and systems. 1-year retention of the logs aids in compliance with log retention standards. Shorter retention periods can lead to the loss of historical logs needed for audits, forensic analysis, and compliance, increasing the risk of undetected issues or non-compliance. It is recommended that AWS CloudWatch log group retention be set to at least 365 days to meet compliance needs and support audits, investigations, and analysis. Policy Severity— Informational Policy Type— Config |
AWS DAX cluster not configured with encryption at rest 24.7.2 | This policy identifies the AWS DAX cluster where encryption at rest is disabled. AWS DAX cluster encryption at rest provides an additional layer of data protection, helping secure your data from unauthorized access to underlying storage.Without encryption, anyone with access to the storage media could potentially intercept and view the data. It is recommended to enable encryption at rest for the AWS DAX cluster. Policy Severity— Informational Policy Type— Config |
AWS ECS task definition is not configured with read-only access to container root filesystems 24.7.2 | This policy identifies the AWS Elastic Container Service (ECS) task definitions with readonlyRootFilesystem parameter set to false or if the parameter does not exist in the container definition within the task definition. ECS root filesystem is the base filesystem that containers run on, providing the necessary environment and isolation for the containerized application. If a containerized application is compromised, it could enable an attacker to alter the root file system of the host machine, thus compromising the entire system or application. This could lead to significant data loss, system crashes, or a broader security breach. It is recommended to limit all ECS containers to have read-only access on ECS task definition to limit the potential impact of a compromised container. Policy Severity— Informational Policy Type— Config |
AWS ElastiCache cluster not using supported engine version 24.7.2 | This policy identifies AWS Elastic Redis or Memcache cluster not using the supported engine version. AWS ElastiCache simplifies deploying, operating, and scaling Redis and Memcached in-memory caches in the cloud. An ElastiCache cluster not using a supported engine version runs on outdated Redis or Memcached versions. These versions may be end-of-life (EOL) or lack current updates and patches from AWS. This exposes the cluster to unpatched vulnerabilities, compliance risks, and potential service instability. It is recommended to regularly update your ElastiCache clusters to the latest supported engine versions as recommended by AWS. Policy Severity— Informational Policy Type— Config |
AWS ElastiCache Redis cluster automatic version upgrade disabled 24.7.2 | This policy identifies the ElastiCache Redis clusters that do not have the auto minor version upgrade feature enabled. An ElastiCache Redis cluster is a fully managed in-memory data store used to cache frequently accessed data, reducing latency and improving application performance. Failure to enable automatic minor upgrades can leave your cache clusters vulnerable to security risks stemming from outdated software. It is recommended to enable automatic minor version upgrades on ElastiCache Redis clusters to receive timely patches and updates, reduce the risk of security vulnerabilities, and improve overall performance and stability. Policy Severity— Informational Policy Type— Config |
AWS Elastic Beanstalk environment managed platform updates are not enabled 24.7.2 | This policy identifies the AWS Elastic Beanstalk Environment where managed platform updates are not enabled. Elastic Beanstalk is a platform as a service (PaaS) product from Amazon Web Services (AWS) that provides automated application deployment and scaling features. Enabling managed platform updates ensures that the latest available platform fixes, updates, and features for the environment are installed. Users must not apply updates manually without automatic updates, risking missed critical updates and potential security vulnerabilities. This can result in high-severity security risks, loss of data, and possible system downtime. It is recommended to ensure platform updates are managed automatically is crucial for the overall security and performance of the applications running on the platform. Policy Severity— Informational Policy Type— Config |
AWS Sagemaker data quality job not encrypting model artifacts with KMS 24.7.2 | This policy checks whether Amazon SageMaker Data Quality Jobs leverage AWS Key Management Service (KMS) to encrypt model artifacts. Unencrypted model artifacts pose a significant security concern. Without encryption, sensitive information within your models could be exposed to malicious actors. This could lead to data breaches, compromising the integrity and confidentiality of the data used by your models. KMS provides a secure solution for managing encryption keys, ensuring the protection of your machine learning assets. Policy Severity— Low Policy Type— Config Policy Subtype— Build |
AWS Sagemaker Data Quality Job not using KMS to encrypt data on attached storage volume 24.7.2 | This policy checks whether Amazon SageMaker Data Quality Jobs leverage AWS Key Management Service (KMS) to encrypt data on the attached storage volume. KMS encryption is crucial to safeguard sensitive information as it encrypts data on storage volumes attached to the Sagemaker instance. This prevents unauthorized access and data breaches and helps ensure compliance with regulations requiring the protection of specific data types. Policy Severity— Low Policy Type— Config Policy Subtype— Build |
AWS Sagemaker Data Quality Job not encrypting communications between instances used for monitoring jobs 24.7.2 | This policy checks whether all communications between instances used for monitoring jobs in Amazon SageMaker Data Quality Jobs are encrypted. Encryption is crucial to safeguard sensitive information during transmission. Unencrypted data can be easily intercepted by unauthorized individuals, potentially leading to data breaches or other security incidents. Policy Severity— Low Policy Type— Config Policy Subtype— Build |
AWS SageMaker Notebook Instance allows for IMDSv1 24.7.2 | This policy checks whether SageMaker Notebook Instances are configured to use Instance Metadata Service version 2 (IMDSv2). MDSv2 reduces security risks by requiring session-oriented requests, unlike the vulnerable IMDSv1 which is susceptible to server-side request forgery (SSRF) attacks and potential unauthorized access. This improves the overall security posture of your AWS resources. Policy Severity— Medium Policy Type— Config Policy Subtype— Build |
AWS SageMaker Flow Definition does not use KMS for output configurations 24.7.2 | This policy checks whether Amazon SageMaker Flow Definitions leverage Key Management Service (KMS) for output configurations. Unencrypted outputs expose sensitive data, increasing the risk of unauthorized access and breaches. KMS ensures data security by encrypting it before storage and physically separating the storage of key material. This strengthens your security posture and adheres to data protection regulations. Policy Severity— Low Policy Type— Config Policy Subtype— Build |
AWS Cognito identity pool allows unauthenticated guest access 24.7.2 | This policy checks whether AWS Cognito identity pools allow unauthenticated guest access. Guest access poses a security risk as it could enable unauthorized individuals to access sensitive data or functionality. Disabling guest access helps maintain system and data security. Policy Severity— Medium Policy Type— Config Policy Subtype— Run, Build |
AWS SageMaker notebook instance IAM policy is overly permissive 24.7.2 | This policy checks whether IAM policies for SageMaker Notebook Instances are overly permissive. Overly permissive IAM policies can grant unauthorized access, potentially leading to data breaches or loss. This includes unauthorized users modifying configurations or deleting resources. This policy enforces least privilege, ensuring users only have necessary permissions for their tasks, strengthening your security posture. Policy Severity— Medium Policy Type— Config Policy Subtype— Build |
AWS SageMaker model does not use network isolation 24.7.2 | This policy checks whether Amazon SageMaker models leverage network isolation. Network isolation restricts unauthorized network communication between computing resources, enhancing security. When enabled for SageMaker models, it ensures inference code runs in an internet-free environment, safeguarding your models and data sets from potential breaches. A violation of this policy indicates that the SageMaker model’s network isolation is disabled, potentially exposing your models and data to security threats. Enabling network isolation strengthens your security posture and protects your valuable assets. Policy Severity— Medium Policy Type— Config Policy Subtype— Build |
Azure Active Directory MFA is not enabled for user 24.7.2 | This policy identifies Azure users for whom AD MFA (Active Directory Multi-Factor Authentication) is not enabled. Azure AD is a simple best practice that adds an extra layer of protection on top of your user name and password. MFA provides increased security for your Azure account settings and resources. Enabling Azure AD Multi-Factor Authentication using Conditional Access policies is the recommended approach to protect users. As best practice, it is recommended to enable Azure AD Multi-Factor Authentication for users. Policy Severity— Low Policy Type— Config |
Azure Databricks Workspaces not using customer-managed key for root DBFS encryption 24.7.2 | This policy checks whether Databricks Workspaces leverage a customer-managed key for root DBFS encryption. DBFS (Databricks File System) is the distributed file system used by Databricks clusters. Encrypting the root DBFS adds an extra layer of security, ensuring that even in the event of unauthorized access, the data remains inaccessible and secure. Customer-managed keys enhance security by giving you control over encryption, strengthening your security posture. Policy Severity— Low Policy Type— Config Policy Subtype— Build |
Azure Container Registry dedicated data endpoint is disabled 24.7.2 | This policy checks whether dedicated data endpoints are enabled in Azure. Dedicated data endpoints enhance security by directing data connections through private IPs within your virtual network. Disabled endpoints expose data to the public internet, increasing the risk of interception or breaches. Enabling dedicated data endpoints strengthens your security posture. Policy Severity— Low Policy Type— Config Policy Subtype— Build |
Azure Storage Account storing Machine Learning workspace high business impact data is publicly accessible 24.7.2 | This policy checks whether Azure Storage Accounts for Machine Learning workspaces are publicly accessible. Public access to these accounts storing sensitive business data poses a significant security risk. Leaks or misuse could lead to financial and reputational damage. By ensuring private access, this policy safeguards data confidentiality and integrity. Policy Severity— High Policy Type— Config Policy Subtype— Run, Build |
Azure Cognitive Services account configured with local authentication 24.7.2 | This policy checks whether local authentication is disabled in Azure Cognitive Services accounts. Local authentication, when enabled, allows any authenticated user to make changes, regardless of location. This can be risky because it doesn’t enforce additional security measures beyond basic authentication, and can potentially lead to unauthorized access, data breaches, and other security issues. Disabling local authentication strengthens security by requiring users to utilize more secure methods. Policy Severity— Low Policy Type— Config Policy Subtype— Run, Build |
OCI Autonomous Database not registered in Data Safe 24.7.2 | This policy identifies Oracle Autonomous Databases that are not registered in Oracle Data Safe. Oracle Data Safe is a fully-integrated cloud service that focuses on the security of your data, providing comprehensive features for protecting sensitive and regulated information in Oracle databases. Through the Security Center, you can access functionalities such as user and security assessments, data discovery, data masking, activity auditing, and alerts. As best practice, it is recommended to register the Autonomous Database in Data Safe. Policy Severity— Medium Policy Type— Config |
OCI Network Load Balancer not configured with backend set 24.7.2 | This policy identifies OCI Network Load Balancers that have no backend set configured. A backend set is a crucial component of a Network Load Balancer, comprising a load balancing policy, a health check policy, and a list of backend servers. Without a backend set, the Network Load Balancer lacks the necessary configuration to distribute incoming traffic and monitor the health of backend servers. As best practice, it is recommended to properly configure the backend set for the Network Load Balancer to function effectively, distribute incoming data, and maintain the reliability of backend services. Policy Severity— Informational Policy Type— Config |
OCI Load Balancer not configured with backend set 24.7.2 | This policy identifies OCI Load Balancers that have no backend set configured. A backend set is a crucial component of a Load Balancer, comprising a load balancing policy, a health check policy, and a list of backend servers. Without a backend set, the Load Balancer lacks the necessary configuration to distribute incoming traffic and monitor the health of backend servers. As best practice, it is recommended to properly configure the backend set for the Load Balancer to function effectively, distribute incoming data, and maintain the reliability of backend services. Policy Severity— Informational Policy Type— Config |
OCI Network Load Balancer not configured with inbound rules or listeners 24.7.2 | This policy identifies Network Load Balancers that are not configured with inbound rules or listeners. A Network Load Balancer’s subnet security lists should include ingress rules, and the Network Load Balancer should have at least one listener to handle incoming traffic. Without these configurations, the Network Load Balancer cannot receive and route incoming traffic, rendering it ineffective. As best practice, it is recommended to configure Network Load Balancers with proper inbound rules and listeners. Policy Severity— Informational Policy Type— Config |
OCI Load Balancer not configured with inbound rules or listeners 24.7.2 | This policy identifies Load Balancers that are not configured with inbound rules or listeners. A Load Balancer’s subnet security lists should include ingress rules, and the Load Balancer should have at least one listener to handle incoming traffic. Without these configurations, the load balancer cannot receive and route incoming traffic, rendering it ineffective. As best practice, it is recommended to configure Load Balancers with proper inbound rules and listeners. Policy Severity— Informational Policy Type— Config |
Azure Machine learning workspace configured with high business impact data have unrestricted network access 24.7.2 | This policy identifies Azure Machine learning workspaces configured with high business impact data with unrestricted network access. Overly permissive public network access allows access to resource through the internet using a public IP address and that resource having High Business Impact (HBI) data could lead to sensitive data exposure. As a best practice, it is recommended to limit access to your workspace and endpoint to specific public internet IP addresses, ensuring that only authorized entities can access them according to business requirements. Policy Severity— High Policy Type— Config |
AWS DMS replication task for the source database have logging not set to the minimum severity level 24.7.1 | This policy identifies DMS replication tasks where logging is either not enabled or set below the minimum severity level, such as LOGGER_SEVERITY_DEFAULT, for SOURCE_CAPTURE and SOURCE_UNLOAD. Logging is indispensable in DMS replication for various purposes, including monitoring, troubleshooting, auditing, performance analysis, error detection, recovery, and historical reporting. SOURCE_CAPTURE captures ongoing replication or CDC data from the source database, while SOURCE_UNLOAD unloads data during full load. Logging these tasks is crucial for ensuring data integrity, compliance, and accountability during migration. It is recommended to enable logging for AWS DMS replication tasks and set a minimal logging level of DEFAULT for SOURCE_CAPTURE and SOURCE_UNLOAD to ensure that essential messages are logged, facilitating effective monitoring, troubleshooting, and compliance efforts. Policy Severity— Informational Policy Type— Config |
AWS DMS replication task for the target database have logging not set to the minimum severity level 24.7.1 | This policy identifies the DMS replication tasks that are logging isn’t enabled or the minimum severity level is less than LOGGER_SEVERITY_DEFAULT for TARGET_APPLY and TARGET_LOAD. Amazon DMS Logging is crucial in DMS replication for monitoring, troubleshooting, auditing, performance analysis, error detection, recovery, and historical reporting. TARGET_APPLY and TARGET_LOAD must be logged because they manage to apply data and DDL changes, as well as loading data into the target database, crucial for maintaining data integrity during migration. The absence of logging for TARGET_APPLY and TARGET_LOAD components hampers monitoring, compliance, auditing, troubleshooting, and accountability efforts during migration. It is recommended to enable logging for AWS DMS replication tasks and set a minimal logging level of DEFAULT for TARGET_APPLY and TARGET_LOAD to ensure that informational messages, warnings, and error messages are written to the logs. Policy Severity— Informational Policy Type— Config |
AWS CodeBuild project environment variables contain plaintext AWS credentials 24.7.1 | This policy identifies the AWS CodeBuild project that contains the environment variables AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY and Password in plaintext. AWS CodeBuild environment variables configure build settings, pass contextual information, and manage sensitive data during the build process. Authentication credentials like AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY should never be stored in clear text, as this could lead to unintended data exposure and unauthorized access. It is recommended that AWS CodeBuild environment variables be securely managed using AWS Secrets Manager or AWS Systems Manager Parameter Store to store sensitive data and remove plaintext credentials. Policy Severity— Informational Policy Type— Config |
AWS ElastiCache Redis cluster is not configured with automatic backup 24.7.1 | This policy identifies Amazon ElastiCache Redis clusters where automatic backup is disabled by checking if SnapshotRetentionLimit is less than 1. Amazon ElastiCache for Redis clusters can back up their data. Automatic backups in ElastiCache Redis clusters ensure data durability and enable point-in-time recovery, protecting against data loss or corruption. Without backups, data loss from breaches or corruption could be irreversible, compromising data integrity and availability. It is recommended to enable automatic backups to adhere to compliance requirements and enhance security measures, ensuring data integrity and resilience against potential threats. Policy Severity— Informational Policy Type— Config |
AWS Log metric filter and alarm does not exist for management console sign-in without MFA 24.7.1 | This policy identifies the AWS regions that do not have a log metric filter and alarm for management console sign-in without MFA. A log metric filter in AWS CloudWatch scans log data for specific patterns and generates metrics based on those patterns. Unauthorized access attempts may go undetected without a log metric filter and alarm for console sign-ins without MFA. This increases the risk of account compromise and potential data breaches due to inadequate security monitoring. It is recommended that a metric filter and alarm be established for management console sign-in without MFA to increase visibility into accounts that are not protected by MFA. This policy will trigger an alert if you have at least one Cloudtrail with the multi-trail is enabled, Logs all management events in your account, and is not set with a specific log metric filter and alarm. Policy Severity— Informational Policy Type— Config |
AWS Log metric filter and alarm does not exist for AWS Security group changes 24.7.1 | This policy identifies the AWS regions that do not have a log metric filter and alarm for security group changes. Security groups act as virtual firewalls that control inbound and outbound traffic to AWS resources. If changes to these groups go unmonitored, it could result in unauthorized access or expose sensitive data to the public internet. It is recommended to create a metric filter and alarm for security group changes to promptly detect and respond to any unauthorized modifications, thereby maintaining the integrity and security of your AWS environment. This policy will trigger an alert if you have at least one Cloudtrail with the multi-trail enabled, Logs all management events in your account, and is not set with a specific log metric filter and alarm. Policy Severity— Informational Policy Type— Config |
Azure Logic App does not utilize HTTP 2.0 version 24.7.1 | This policy identifies Azure Logic apps that are not utilizing HTTP 2.0 version. Azure Logic app using HTTP 1.0 for its connection is considered as not secure as HTTP 2.0 version has additional performance improvements on the head-of-line blocking problem of old HTTP version, header compression, and prioritisation of requests. HTTP 2.0 no longer supports HTTP 1.1’s chunked transfer encoding mechanism, as it provides its own, more efficient, mechanisms for data streaming. As a security best practice, it is recommended to configure HTTP 2.0 version for Logic apps connections. Policy Severity— Medium Policy Type— Config |
Azure Logic app using insecure TLS version 24.7.1 | This policy identifies Azure Logic apps that are using insecure TLS version. Azure Logic apps configured to use insecure TLS versions are at risk as they may be vulnerable to security threats due to the known vulnerabilities, weaker encryption methods, and support for compromised hash functions. Logic apps using TLS 1.2 or higher will secure communication and protect against potential cyber attacks. As a security best practice, it is recommended to configure Logic apps with TLS 1.2 or higher to ensure secure communication. Policy Severity— Medium Policy Type— Config |
Azure Logic app is not configured with managed identity 24.7.1 | This policy identifies Azure Logic apps that are not configured with managed identity. Managed identity can be used to authenticate to any service that supports Azure AD authentication, without having credentials in your code. Including credentials in code heightens the risk in the event of a security breach and increases the threat surface in case of exploitation and also managed identities eliminate the need for developers to manage credentials. As a security best practice, it is recommended to set up managed identity rather than embedding credentials within the code. Policy Severity— Low Policy Type— Config |
Azure Logic app configured with public network access 24.7.1 | This policy identifies Azure Logic apps that are configured with public network access. Exposing Logic Apps directly to the public internet increases the attack surface, making them more susceptible to unauthorized access, security threats, and potential breaches. By limiting Logic Apps to private network access, they are securely managed and less prone to external vulnerabilities. As a security best practice, it is recommended to configure private network access or restrict the public exposure only to the required entities instead of wide ranges. Policy Severity— Medium Policy Type— Config |
Azure Logic app does not redirect HTTP requests to HTTPS 24.7.1 | This policy identifies Azure Logic apps that fail to redirect HTTP traffic to HTTPS. By default, Azure Logic app data is accessible through unsecured HTTP traffic. HTTP does not include any encryption and data sent over HTTP is susceptible to interception and eavesdropping. To secure web traffic, use HTTPS which incorporates encryption through SSL/TLS protocols, providing a secure channel over which data can be transmitted safely. As a security best practice, it is recommended to configure HTTP to HTTPS redirection to prevent unauthorized parties from being able to read or modify the data in transit. Policy Severity— Medium Policy Type— Config |
OCI Load balancer listener allows connection requests over HTTP 24.7.1 | This policy identifies Oracle Cloud Infrastructure (OCI) Load Balancer listeners that accept connection requests over HTTP instead of HTTPS or HTTP/2 or TCP protocols. Accepting connections over HTTP can expose data to potential interception and unauthorized access, as HTTP traffic is transmitted in plaintext. OCI Load Balancer allow all traffic to be submitted over HTTPS or HTTP/2 or TCP, ensuring all communications are encrypted. These protocols provide encrypted communication channels, safeguarding sensitive information from eavesdropping, tampering, and man-in-the-middle attacks. As a security best practice, it is recommended to configure the listeners to accept connections through HTTPS, HTTP/2, or TCP, thereby enhancing the protection of data in-transit. Policy Severity— Medium Policy Type— Config |
OCI Load balancer listener is not configured with SSL certificate 24.7.1 | This policy identifies Load balancers for which the listener is not configured with an SSL certificate. Enforcing an SSL connection helps prevent unauthorized users from reading sensitive data that is intercepted as it travels through the network, between clients/applications and cache servers. It is recommended to implement SSL between the load balancer and your client; so that the load balancer can accept encrypted traffic from a client. Policy Severity— Medium Policy Type— Config |
OCI Database system is not configured with Network Security Groups 24.7.1 | This policy identifies Oracle Cloud Infrastructure (OCI) Database Systems that are not configured with Network Security Groups (NSGs). Network Security Groups provide granular security controls at the instance level, allowing for more precise management of inbound and outbound traffic to database systems. It is recommended to configure database systems with NSGs to enhance their security thereby mitigating the risk of unauthorized access and potential data breaches. Policy Severity— Medium Policy Type— Config |
Azure AD MFA is not enabled for the user
24.7.2
|Changes— This policy has been deleted as the underlying API is no longer supported by Azure CSP. Also, all the compliance standards mapped to this policy is removed.
Impact— Low. Alerts generated for the policy will be resolved as Policy\_Deleted.
| ## IAM Policy Updates The following IAM OOTB policies are updated in the 24.7.3 release.| Policies | Description |
| AWS Users and Machine Identities with Excessive Policies | Changes— The policy RQL will be updated to narrow down the resource based policies and remove false positives. Severity— High Cloud— AWS Updated RQL— |
| Roles with high privileges can be assumed by a service in an external account | Changes— This policy descrption and recommendation steps will be updated to better match the policy. Severity— High Cloud— AWS Updated Description— Identifies roles which have administrative permissions and can be assumed by an identity in an "external account". An external account is one not known to Prisma cloud as part of your organization and not that of a known vendor. This policy relies on the default account group, therefore if the group is changed this policy will not reflect the environment entirely. The default account group is created upon onboarding to Prisma Cloud, and contains all instance-related accounts known to Prisma Cloud. External accounts are considered as such if Prisma are unaware of them in the context of your environment (i.e not part of the onboarded accounts). As we do not have visibility or control over the external entity, giving it the ability to gain administartive permissions in the environment is considered high risk. Recommendation Steps— How to investigate?
3a. If results are returned, this is an indicator that Prisma is scanning the account, and as such is aware of it If this is the case, select 'settings' and then 'Account Groups' Search for the default account group, under 'Actions' select 'Edit'. Search for the account in question and add it 3b. If no results are returned, this means Prisma has no knowledge of the account in question (i.e it is not onboarded and in the eyes of Prisma, external) In order to continue the investigation, using the AWS CLI, run 'aws organizations list-accounts', and you will recieve a list of all the accounts within the AWS organization Repeat this process for every AWS organization you own. If the account in question does not appear, it can be concluded as external In order to remove its access, use the following remediation steps: Log in to your AWS account Navigate to the affected role, and select the 'Trusted entities' tab. Select 'Edit trust policy' and remove the entries allowing assumption from external sources. Ensure the remaining entries are required, and save your changes. |
| AWS Role With Administrative Permissions Can Be Assumed By All Users | Changes— This policy will be updated include recommendation steps on how to investigate and remediate isAdmin policies. Severity— High Cloud— AWS Recommendation Steps— How to investigate?
In order to remove any administrative permissions and minimize trusted entities which can assume the role, use the following remediation steps: Browse to the role in the AWS Console and select "Trust relationships"→"Edit trust policy". Modify the role’s trust relationship as per requirements. Under the "Permissions" tab, select the relevant policy and remove unnecessary administrative permissions by either editing the policy or replacing it (notice: editing a managed policy could affect other roles). |
| GCP Cloud Run with administrative permissions | Changes— This policy will be updated include recommendation steps on how to investigate and remediate isAdmin policies. Severity— Medium Cloud— GCP Recommendation Steps— How to investigate?
Once examining the policies and determining which permissions are unnecessary and can be removed based on the Cloud Run instance’s intended use, sign in to your GCP account. In order to remove any unnecessary permissions , use the following remediation steps: Navigate to the IAM service, and search for the Service account. Select the pencil icon to edit it’s permissions, removing the relevant policy for a less privileged one sufficient for the account intended purpose. |
| User account with excessive admin privileges | Changes— This policy will be updated include recommendation steps on how to investigate and remediate isAdmin policies. Severity— Medium Cloud— All Recommendation Steps— How to investigate?
Once examining the permissions and determining which permissions are unnecessary and can be removed based on their last usage, in order to remove them, use the following remediation steps: Log in to your Cloud instance, navigate to the affected user, and edit the user’s permissions following the principle of least privilege and based on the information collected. |
| Cloud service account with excessive admin privileges | Changes— This policy will be updated include recommendation steps on how to investigate and remediate isAdmin policies. Severity— Medium Cloud— All Recommendation Steps— How to investigate?
Once examining the permissions and determining which permissions are unnecessary and can be removed based on their last usage, in order to remove them, use the following remediation steps: Log in to your Cloud instance, and navigate to the affected service account, and edit the entity’s permissions following the principle of least privilege and based on the information collected. |
| Third-party service account can assume a service account with high privileges | Changes— This policy will be updated include recommendation steps on how to investigate and remediate isAdmin policies. Severity— High Cloud— AWS Recommendation Steps— How to investigate?
In order to remove any unnecessary permissions and minimize trusted entities which can assume the role, use the following remediation steps: To revoke the vendor’s access to assume the role altogether, browse to the role in the AWS Console and select "Trust relationships"→"Edit trust policy". Modify the role’s trust relationship as per requirements. To minimize the access the vendor has using the role, under the "Permissions" tab, select the relevant policy and remove unnecessary permissions by either editing the policy or replacing it (notice: editing a managed policy could affect other roles). |
| GCP Cloud Run Job Public Execution via Default Compute SA Modification | Changes— The policy RQL will be updated to narrow down results (for example remove basic roles which are caught by other policies) and provide a more effective view. Severity— High Cloud— GCP Updated RQL— |
| GCP Lateral Access Expansion by Making Cloud Run Publicly Executable | Changes— The policy RQL will be updated to narrow down results (for example remove basic roles which are caught by other policies) and provide a more effective view. Severity— High Cloud— GCP Updated RQL— |
Policy Mapping Update for CIS GCP v2.0.0 Level 1/Level 2 and v3.0.0 Level 2
24.7.3
|New Policy mappings will be added to CIS v2.0.0 (GCP) Level 1, CIS v2.0.0 (GCP) Level 2, and CIS v3.0.0 (GCP) Level 2 compliance standards.
Impact— No impact on existing alerts. The compliance score may vary as new mappings are added.
| |Support for Digital Operational Resilience Act
24.7.2
|Prisma Cloud now supports the Digital Operational Resilience Act (DORA) compliance standard. This includes a focus on specific controls, data governance enhancements, robust logging and auditing capabilities, strengthened security patching and vulnerability management, enhanced consent management features, and fortified incident response and breach notification capabilities.
You can now view this built-in standard and the associated policies on the Compliance > Standards page with this support. You can also generate reports for immediate viewing or download, or schedule recurring reports to track this compliance standard over time.
| |Australian Cyber Security Centre (ACSC) Essential Eight - Level 1, Level 2 and Level 3
24.7.2
|Prisma Cloud now supports Australian Cyber Security Centre (ACSC) Essential Eight with all the three maturity levels. The Essential Eight has been designed to protect organisations’ internet-connected information technology networks. This latest version has new controls and new Prisma cloud policies are mapped to the controls increasing the overall coverage.
You can now view this built-in standard and the associated policies on the Compliance > Standards page with this support. You can also generate reports for immediate viewing or download, or schedule recurring reports to track this compliance standard over time.
| |Policy Mapping Update for GCP v3.0.0 Level 1
24.7.2
|Updated policy mappings for the CIS v3.0.0 (GCP) Level 1 compliance standard.
Impact— No impact on existing alerts. The compliance score may vary as mappings are updated.
| |Policy Mapping Update for SOC2
24.7.1
|New Policy mappings are added to SOC 2 compliance standard.
Impact— No impact on existing alerts. The compliance score may vary as new mappings are added.
| |Policy Mapping Update for CIS v3.0.0 (GCP) Level 1 and Level 2
24.7.1
|New Policy mappings are added to CIS v3.0.0 (GCP) Level 1 and Level 2 compliance standard.
Impact— No impact on existing alerts. The compliance score may vary as new mappings are added.
| ## Changes in Existing Behavior | **Feature** | **Description** | | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | |Azure Onboarding Terraform Permission Deprecations
24.7.3
|The following Azure permissions have been deprecated by the Cloud Service Provider (CSP), as a result they are no longer required to run the Prisma Cloud Azure Onboarding Terraform template.
Enhancement to Photon OS and Amazon Linux OS Feeds Secure the Runtime
32.07.123
| Prisma Cloud now parses Photon OS and Amazon Linux OS feeds using CVE IDs as the primary vulnerability identifier instead of advisory IDs. This change enhances Prisma Cloud’s ability to correlate third-party data, and use vendor-provided information, including backports, severity assessments, and vulnerability scores. | |Google Cloud Source Repositories
24.7.2
|The sourcerepo.googleapis.com service has been deprecated by GCP CSP. As a result, the sourcerepo.googleapis.com service has been removed from Terraform.
Impact— Due to this change, Prisma Cloud will no longer ingest metadata from the gcloud-cloud-source-repository API for accounts newly onboarded after June 6th, 2024. However, for accounts onboarded before this date, the API will continue to be supported. The permissions check for source.repos.list and source.repos.getIamPolicy will no longer be conducted for these already onboarded accounts.
Tag-based Resource Lists
24.7.2
|The following limits are enforced for Tag-based Resource Lists:
Impact— These changes will affect Tag-based Resource Lists and Roles after the release. Existing configurations will not be affected.
| |Tag-based Resource List Support for Asset Explorer
24.7.2
|Tag-based Resource Lists RBAC is enforced for Asset Explorer— uai/v1/asset endpoint.
Impact— If user assigned role is non system admin and has assigned resource list, user will be able to fetch asset having assigned tag. No impact for user without any assigned resource list.
| |Change to Compliance Trendline
24.7.2
| The Compliance or Asset Inventory trendline will display data only from the past one year to provide better performance. Prisma Cloud will not retain the snapshots of data older than one year. | |New Limits for Audit Logs API
24.7.1
|To improve the user experience, a response size limit of 100K records is now implemented for the GET - /audit/redlock Audit Logs endpoint.
Impact— Requests exceeding 100K records limit results in a 413 Payload Too Large error with X-Record-Count header, which indicates the number of records that were being requested.
| |API Rate Limits — Update User Role API
24.7.1
|To resolve a critical performance issue with the Update User Role API (PUT /user/role), a rate limit with the following parameters is now implemented:
Limit=3, Burst=3
Impact— Requests exceeding these limits result in an HTTP 429 Too Many Requests response.
| ## REST API Updates | **Change** | **Description** | | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | |Vulnerabilities Dashboard (UVE) APIs
Secure the Infrastructure
24.7.3
| A new version of the [Get Vulnerability Overview](https://pan.dev/prisma-cloud/api/cspm/vulnerability-dashboard-overview-v-3/) endpoint is available to fetch additional details about vulnerabilities. | |Vulnerabilities Dashboard API
Secure the Infrastructure
24.7.2
| A new [Get Vulnerable Asset](https://pan.dev/prisma-cloud/api/cspm/vulnerable-assets/) endpoint is introduced to get the summary of vulnerable assets and detailed vulnerability statistics across different stages of the application lifecycle. | |Vulnerabilities Dashboard APIs
Secure the Infrastructure
24.7.1
|The following new endpoints are introduced to get the vulnerabilities displayed in the Vulnerabilities dashboard:
Discovery and Exposure Management (CDEM) APIs
Secure the Infrastructure
24.7.1
|The managedCommunication parameter is now added to the request or response of the endpoints listed below. Use this parameter to filter the internet-exposed assets connected to secured assets on Prisma Cloud.
End of support for Azure Test Base API
24.7.2
|The azure-test-base-account API is deprecated. Due to this change, Prisma Cloud will no longer ingest metadata for azure-test-base-account API.
In RQL, the key will not be available in the api.name attribute auto-completion.
Impact— If you have a saved search or custom policies based on this API, you must delete those manually. The policy alerts will be resolved as Policy\_Deleted.
| |End of support for Azure Media Service
24.7.2
|The azure-media-service-account API is deprecated. Due to this change, Prisma Cloud will no longer ingest metadata for azure-media-service-account API.
In RQL, the key will not be available in the api.name attribute auto-completion.
Impact— If you have a saved search or custom policies based on this API, you must delete those manually. The policy alerts will be resolved as Policy\_Deleted.
| --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.prismacloud.io/release-notes/prisma-cloud-release-information/features-introduced-in-2024/features-introduced-in-july-2024.md?ask=