Features Introduced in June 2024

Learn what’s new on Prisma® Cloud in June 2024.

• Announcement
• New Features
• API Ingestions
• New Policies
• IAM Policies
• Policy Updates
• New Compliance Benchmarks and Updates
• Changes in Existing Behavior
• REST API Updates
• Deprecation Notices

Announcement

Feature	Description
Base Image updated to RHEL 9 Secure the Runtime 32.06.132	The base image used by Defenders is now updated to Red Hat Enterprise Linux (RHEL) 9.

New Features

Feature	Description
Support for Vulnerability Management in Permission Groups Secure the Infrastructure 24.6.2	Prisma Cloud now supports vulnerability management for non-system admins in permission groups. They can use Search and Investigate to perform vulnerability searches, use the Vulnerability Dashboard, and Remediate Vulnerabilities.
New Compliance Support for DSPM Secure the Data 24.6.2	Prisma Cloud now supports the following compliance standards for Data Security Posture Management (DSPM): GDPR ISO27001 NIST PCI DSS v4 SOC 2 Type 2 Select Data Security > Compliance to see the available compliance standards. You can dive deep into each of the frameworks and see all the different risks related to them as well as the percentage, which is based on how many assets are in violation.
Update Code to Cloud Dashboard Secure the Infrastructure 24.6.2	You can now add up to 20 rows on your Code to Cloud dashboard. Previously, you could add only up to 5 rows.
Support for PackageJSON v3 Secure the Source 24.6.2	Prisma Cloud now supports PackageJSON v3 for JavaScript projects that significantly enhances the SCA scanning capabilities. With this update, Prisma Cloud can successfully build dependency trees and identify both root and transitive packages, providing comprehensive visibility into your project’s dependencies. In addition, Prisma Cloud SCA scanning now matches CVEs to the vulnerable packages found in v3 files, allowing you to quickly address security risks. You can easily view SCA findings directly from Application Security > Projects in the Prisma Cloud console. Additionally, SCA findings are accessible in all supported IDEs, Checkov CLI, and PR comments for all supported version control systems, ensuring seamless integration into your development workflow.
Support for Ansible Scanning Secure the Source 24.6.2	Prisma Cloud now offers support for scanning Ansible, a leading Infrastructure as Code (IaC) framework. Prisma Cloud can now scan Ansible templates for misconfigurations throughout the software development lifecycle (SDLC) using it’s out of-the-box policies.
Update Top Risks From Unmanaged Assets Widget Secure the Infrastructure 24.6.1	The Top Risks From Unmanaged Assets widget in the Discovery and Exposure Management Dashboard is enhanced to display the top risks based on various categories that affect your security posture due to public exposure of assets on the internet. The risks are categorized as Critical, Exploited, Patchable, Vulnerable, and Exposed. Links offer additional context and options to convert and inspect affected assets, helping you to quickly assess and address potential threats.
Vulnerabilities Tab Secure the Infrastructure 24.6.1	You can explore the new Vulnerabilities tab in the side panel while inspecting internet-exposed assets. Support for EPSS Scores - Prisma Cloud now supports EPSS in the Vulnerability Dashboard, Search and Investigate, and Common Vulnerabilities and Exposures (CVE) side panel. Support for Internet Exposure in Vulnerability Prioritization - The prioritization engine now supports Internet Exposure as a risk factor. Complete CVE Details - The CVE side panel now includes a new CVE Details tab that provides all the information about a given CVE, such as complete Common Vulnerability Scoring System (CVSS) Risk Factors, EPSS, Exploit information, CISA KEV, and external links.
Improved IAM Risk Management Secure the Infrastructure 24.6.1	Enhancements to Prisma Cloud’s IAM policies enable you to proactively manage IAM-related risks and improve your cloud security posture. Gain granular visibility into violations at the entity level by creating IAM policies based on queries that include granters (roles/groups/service accounts) as the violating resource. Next, develop remediation to fix IAM policy violations at the granter level or use the Suggest Least Privileged Access feature to remediate over-privileged access by select granters.
Snooze Assets from Inventory Page Secure the Infrastructure 24.6.1	You now have the option to Snooze known internet-exposed assets, such as test or vendor assets, in the Inventory > Unmanaged Assets page. Snoozing assets help you to view Active assets separately from Snoozed assets using the Status filter. You can Snooze one or multiple assets at a time. Use the search bar to find your assets. Filter your search results by Domain name or IP Address.
Account Mapped Status Filter Secure the Infrastructure 24.6.1	The Inventory > Unmanaged Assets page now includes a new Account Mapped Status filter. Use this filter to view a comprehensive list of your Mapped assets separately from Unmapped assets. Mapped — Shows exposed assets that are linked to a parent account or organizational unit (OU) accounts on Prisma Cloud. You can secure these assets by onboarding them to Prisma Cloud. Unmapped — Shows exposed assets that cannot be linked to a parent account or organizational unit (OU) accounts on Prisma Cloud. You can an Send Email to receive a summary of the assets for further investigation.
Update Removal of Select All and Deselect All Capabilities in Some Filters Secure the Infrastructure 24.6.1	For better performance, Select All and Deselect All are no longer supported for the Account Group, Cloud Account, Cloud Account ID, and Policy Name filters.
Terraform Enterprise (Run Tasks) support for Transporter Secure the Source 24.6.1	Terraform Enterprise (Run Tasks) now includes support for Transporter. The Transporter serves as a communication proxy or broker, facilitating a secure channel between Prisma Cloud and Terraform Enterprise (Run Tasks). This enables seamless integration and management of Terraform Enterprise within your infrastructure while maintaining stringent security measures.
Support for AWS CodeCommit Integration Secure the Source 24.6.1	Integrate prisma Cloud with AWS Code Commit version control system (VCS) to gain visibility into, and monitor the systems, technologies, configurations, and pipelines that make up the AWS CodeCommit platform. This integration enables security scans to identify Infrastructure-as-Code (IaC) misconfigurations, Software Composition Analysis (SCA) vulnerabilities, license non-compliance, exposed secrets and CI/CD pipeline risks in your AWS CodeCommit platform. Enhance the security posture for your organization by contextualizing, prioritizing and mitigating issues as soon as they are detected.
Enhanced Security for JavaScript Projects: SCA Now Supports Lockfile v3 Secure the Source 24.6.1	SCA support is now available for JavaScript Lockfile v3. This added support offers: Vulnerability detection and license compliance: Prisma Cloud can now parse, analyze, and report vulnerabilities, and ensure license compliance for projects using package-lock.json v3 Full dependency tree analysis: Provides a comprehensive view of all dependencies and sub-dependencies to identify potential risks Cross-platform support: Supported across Prisma Cloud platforms such as PR comments, Fix PRs, Enforcement, IDE, and CLI
Go Symbol Extraction in Prisma Cloud Secure the Runtime 32.06.132	When scanning Golang binaries, Prisma Cloud extracts Go symbols, which allows for evaluating vulnerabilities accurately with specific package names and symbols. The feature flag for extracting Go symbols is enabled by default. Prisma Cloud also allows you to selectively disable symbol extraction when they are not needed, to optimize the scan. To disable this feature, follow these steps: Self-hosted edition: Add the environment variable SYMBOL_EXTRACTION_ENABLED=False in the twistlock.cfg file. SaaS edition: Add the environment variable core-symbol-extraction-enabled=False in the Launch Darkly mode. Using twistcli: Add the --disable-symbol-extraction flag to the image scan command.
Exporting Software Bill of Materials (SBOM) files in CycloneDX version 1.4 Secure the Runtime 32.06.132	Prisma Cloud now supports exporting Software Bill of Materials (SBOM) files in CycloneDX version 1.4 for functions, images, and hosts scans. SBOM files can be generated in JSON or XML format. SBOM Attributes The SBOM files contain the following attributes: Name: Name of the package BOM-REF: Package URL (PURL) if it exists; otherwise, UUID (for applications) Package Version: Version number for the package Package Author: Applicable only for specific package types such as rpm, jem, apk, and deb PURL Identifier: Package URL (PURL) identifier License: Package license details Timestamp (metadata): Time of printing Type (metadata): Type of asset. In all the stages, images are categorized as containers, serverless functions as services, hosts and VMs as frameworks. Name (metadata): Asset ID of images, hosts, and functions SBOM files can be downloaded either through API calls or twistcli. For information about the SBOM API calls, see the REST API Updates section. twistcli Configuration Export SBOMs using the new flag: --SBOM [file_format] File Format Values: cyclonedx_json or cyclonedx_xml SBOM output is concatenated to the scan results output. Use the --output flag to print scan results and SBOM output to a specified file.
Resolving method for cluster name Secure the Runtime 32.06.132	When deploying Defender to your Kubernetes cluster, Prisma Cloud now provides you the option to use the API server address from the kube config file to resolve cluster names. This option ensures that each cluster has a unique cluster name in Prisma Cloud. A new field, Cluster name resolving method, has been added to the Manage → Defenders → “Manual Deploy” → Orchestrator → “Orchestrator type = Kubernetes" → Advanced Settings page. The Cluster name resolving method field has the following options: Default: Allows Prisma Cloud to automatically generate the name based on available information such as kube config, resource group information, and cloud provider metadata endpoints. Manual: Enables you to set the cluster name manually. When you select this option, the "Specify a cluster name" box appears, allowing you to enter the desired name. API Server: Uses the API server address from the kube config file to generate a unique cluster name in Prisma Cloud. This enhancement ensures that vulnerability information is accurately reported for each cluster and makes sure that the clean clusters are not misrepresented as vulnerable due to naming conflicts.

API Ingestions

Service	API Details
Amazon Comprehend 24.6.2	aws-comprehend-pii-entities-detection-jobs Additional permissions required: comprehend:ListPiiEntitiesDetectionJobs comprehend:ListTagsForResource The Security Audit role includes the permissions.
Amazon Comprehend 24.6.2	aws-comprehend-sentiment-detection-jobs Additional permissions required: comprehend:ListSentimentDetectionJobs comprehend:ListTagsForResource The Security Audit role includes the permissions.
Amazon Comprehend 24.6.2	aws-comprehend-key-phrases-detection-jobs Additional permissions required: comprehend:ListKeyPhrasesDetectionJobs comprehend:ListTagsForResource The Security Audit role includes the permissions.
AWS Service Catalog 24.6.2	aws-servicecatalog-principals-for-portfolio Additional permissions required: servicecatalog:ListPortfolios servicecatalog:ListPrincipalsForPortfolio You must manually add the above permissions to the CFT template to enable them.
Update Amazon Route53 24.6.2	aws-route53-list-hosted-zones The following fields are excluded from the resource JSON for this API: resourceRecordSet[*].region resourceRecordSet[*].trafficPolicyInstanceId resourceRecordSet[*].ttl
Update AWS Trusted Advisor 24.6.2	aws-trusted-advisor-check-result The flaggedResources field with the status OK is excluded from the resource JSON for this API.
Azure Active Directory 24.6.2	azure-active-directory-user-registration-details Additional permission required: AuditLog.Read.All The Reader role includes the permission.
Azure App Service 24.6.2	azure-app-service-web-apps-functions Additional permissions required: Microsoft.Web/sites/Read Microsoft.web/sites/functions/read The Reader role includes the permissions.
Update Azure App Service 24.6.2	azure-app-service-plan The zoneRedundant field is now included in the resource JSON for this API. When zoneRedundant is set to true, the azure-app-service-plan API will automatically perform availability zone balancing.
Azure Compute 24.6.2	azure-compute-disk-encryption-sets Additional permission required: Microsoft.Compute/diskEncryptionSets/read The Reader role includes the permission.
Azure Databricks 24.6.2	azure-databricks-diagnostic-settings Additional permissions required: Microsoft.Databricks/workspaces/read Microsoft.Insights/DiagnosticSettings/Read The Reader role includes the permissions.
Azure NetApp Files 24.6.2	azure-netappfiles-volumes Additional permissions required: Microsoft.NetApp/netAppAccounts/capacityPools/volumes/read Microsoft.NetApp/netAppAccounts/read Microsoft.NetApp/netAppAccounts/capacityPools/read The Reader role includes the permissions.
Google Vertex AI 24.6.2	gcloud-vertex-ai-workbench-instance Additional permissions required: notebooks.instances.list notebooks.instances.getIamPolicy The Viewer role includes the permissions.
Google Vertex AI AIPlatform 24.6.2	gcloud-vertex-ai-aiplatform-monitoring-job Additional permission required: aiplatform.modelDeploymentMonitoringJobs.list The Viewer role includes the permission.
Google Vertex AI AIPlatform 24.6.2	gcloud-vertex-ai-aiplatform-persistent-resource Additional permission required: aiplatform.persistentResources.list The Viewer role includes the permission.
Google Vertex AI AIPlatform 24.6.2	gcloud-vertex-ai-aiplatform-vizier-study Additional permission required: aiplatform.studies.list The Viewer role includes the permission.
Google Vertex AI AIPlatform 24.6.2	gcloud-vertex-ai-aiplatform-tuning-job Additional permission required: aiplatform.tuningJobs.list The Viewer role includes the permission.
Amazon CloudFront 24.6.1	aws-cloudfront-response-headers-policy Additional permissions required: cloudfront:ListResponseHeadersPolicies cloudfront:GetResponseHeadersPolicy The Security Audit role includes the permissions.
AWS Database Migration Service 24.6.1	aws-dms-replication-task Additional permissions required: dms:DescribeReplicationTasks dms:ListTagsForResource The Security Audit role includes the permissions.
AWS Network Firewall 24.6.1	aws-network-firewall-rule-group Additional permissions required: network-firewall:ListRuleGroups network-firewall:DescribeRuleGroup The Security Audit role includes the permissions.
AWS Glue 24.6.1	aws-glue-resource-policy Additional permission required: glue:GetResourcePolicies You must manually add the above permission to the CFT template to enable it.
AWS Macie 24.6.1	aws-macie2-classification-job Additional permission required: macie2:ListClassificationJobs You must manually add the above permission to the CFT template to enable it.
Azure Monitor 24.6.1	azure-monitor-action-groups Additional permission required: Microsoft.Insights/ActionGroups/Read The Reader role includes the permission.
Azure Log Analytics 24.6.1	azure-log-analytics-clusters Additional permission required: Microsoft.OperationalInsights/clusters/read The Reader role includes the permission.
Azure App Service 24.6.1	azure-app-service-private-endpoint-connections Additional permissions required: Microsoft.Web/sites/Read Microsoft.Web/sites/privateEndpointConnections/Read The Reader role includes the permissions.
Azure Event Grid 24.6.1	azure-event-grid-namespaces Additional permission required: Microsoft.EventGrid/namespaces/read The Reader role includes the permission.
Azure Virtual Network 24.6.1	azure-network-private-dns-zone-groups Additional permissions required: Microsoft.Network/privateEndpoints/read Microsoft.Network/privateEndpoints/privateDnsZoneGroups/read The Reader role includes the permissions.
Google Storage Transfer 24.6.1	gcloud-storage-transfer-agent-pool Additional permission required: storagetransfer.agentpools.list The Viewer role includes the permission.
Google Storage Transfer 24.6.1	gcloud-storage-transfer-job Additional permission required: storagetransfer.jobs.list The Viewer role includes the permission.
Google Cloud Workstation 24.6.1	gcloud-cloud-workstation-configuration Additional permissions required: workstations.workstationClusters.list workstations.workstationConfigs.list workstations.workstationConfigs.getIamPolicy The Viewer role includes the permissions.
Google Cloud Workstation 24.6.1	gcloud-cloud-workstation-cluster Additional permission required: workstations.workstationClusters.list The Viewer role includes the permission.
Google Cloud Workstation 24.6.1	gcloud-cloud-workstation Additional permissions required: workstations.workstationClusters.list workstations.workstationConfigs.list workstations.workstations.list workstations.workstationConfigs.getIamPolicy The Viewer role includes the permissions.
Update GCP Vertex AI Platform Pipeline Job 24.6.1	gcloud-vertex-ai-aiplatform-pipeline-job A new runtimeConfig field and it’s sub-fields are now ingested as part of this update.

New Policies

Policies	Description
AWS ECR private repository tag mutable 24.6.2	This policy identifies AWS ECR private repositories whose tag immutability is not configured. AWS Elastic Container Registry (ECR) tag immutability ensures that once an image is pushed to a repository with tag immutability enabled, the tag cannot be overwritten or updated. This feature is useful for ensuring the security, integrity, and reliability of container images in production environments. It prevents tags from being overwritten, which can help prevent unauthorised changes to images. It is recommended to enable tag immutability on ECR repositories to maintain the integrity and security of the images pushed. Policy Severity— Informational Policy Type— Config config from cloud.resource where cloud.type = 'aws' AND api.name = 'aws-ecr-get-repository-policy' AND json.rule = imageTagMutability equal ignore case mutable
AWS IAM group not in use 24.6.2	This policy identifies AWS IAM groups that are not actively in use. An AWS IAM group is a collection of IAM users managed together, allowing for unified permission assignment. These groups, if not assigned any users, pose a potential security risk if left unmanaged and can inadvertently grant unauthorized access to AWS services and resources. It is recommended to review and remove any unused IAM groups to prevent attaching unauthorized IAM users. Policy Severity— Informational Policy Type— Config config from cloud.resource where api.name = 'aws-iam-list-users' as X; config from cloud.resource where api.name = 'aws-iam-list-groups' as Y; filter ' not ($.X.groupList[*] intersects $.Y.groupName)'; show Y;
AWS Opensearch domain audit logging disabled 24.6.2	This policy identifies AWS Opensearch domains with audit logging disabled. Opensearch audit logs enable you to monitor user activity on your Elasticsearch clusters, such as authentication successes and failures, OpenSearch requests, index updates, and incoming search queries. It is recommended to enable audit logging for an Elasticsearch domain to audit activity in the domain. Policy Severity— Informational Policy Type— Config config from cloud.resource where cloud.type = 'aws' AND api.name = 'aws-es-describe-elasticsearch-domain' AND json.rule = domainProcessingStatus equal ignore case active and (logPublishingOptions does not exist or logPublishingOptions.AUDIT_LOGS.enabled is false)
AWS Opensearch domain Error logging disabled 24.6.2	This policy identifies AWS Opensearch domains with no error logging configuration. Opensearch application logs contain information about errors and warnings raised during the operation of the service and can be useful for troubleshooting. Error logs from domains can aid in security assessments, access monitoring, and troubleshooting availability problems. It is recommended to enable the AWS Opensearch domain with error logs, which will help in security audits and troubleshooting. Policy Severity— Informational Policy Type— Config config from cloud.resource where cloud.type = 'aws' AND api.name = 'aws-es-describe-elasticsearch-domain' AND json.rule = domainProcessingStatus equal ignore case active and (logPublishingOptions does not exist or logPublishingOptions.ES_APPLICATION_LOGS.enabled is false)
AWS S3 bucket used for storing AWS Sagemaker training job output 24.6.2	This policy identifies the AWS S3 bucket used for storing AWS Sagemaker training job output. S3 buckets hold the results and artifacts generated from training machine learning models in Sagemaker. Ensuring proper configuration and access control is crucial to maintain the security and integrity of the training output. Improperly secured S3 buckets used for storing AWS Sagemaker training output can lead to unauthorized access, data breaches, and potential exposure of sensitive model information. It is recommended to implement strict access controls, enable encryption, and audit permissions to secure AWS S3 buckets for AWS Sagemaker training job output and ensure compliance. Policy Severity— Informational Policy Type— Config config from cloud.resource where api.name = 'aws-s3api-get-bucket-acl' as X; config from cloud.resource where api.name = 'aws-sagemaker-training-job' as Y; filter '$.Y.OutputDataConfig.bucketName equals $.X.bucketName'; show X;
AWS S3 bucket is utilized for AWS Sagemaker training job data 24.6.2	This policy identifies the AWS S3 bucket used for AWS Sagemaker training job data input. S3 buckets store the datasets required for training machine learning models in Sagemaker. Proper configuration and access control are essential to ensure the security and integrity of the training data. Improperly configured S3 buckets used for AWS Sagemaker training data can lead to unauthorized access, data breaches, and potential loss of sensitive information. It is recommended to implement strict access controls, enable encryption, and audit permissions to secure AWS S3 buckets for AWS Sagemaker training data and ensure compliance. Policy Severity— Informational Policy Type— Config config from cloud.resource where api.name = 'aws-s3api-get-bucket-acl' as X; config from cloud.resource where api.name = 'aws-sagemaker-training-job' as Y; filter '$.Y.InputDataConfig[*].DataSource.S3DataSource.bucketName intersects $.X.bucketName'; show X;
Azure Key vault used for machine learning workspace secrets storage is not enabled with audit logging 24.6.2	This policy identifies Azure Key vaults used for machine learning workspace secrets storage that are not enabled with audit logging. Azure Key vaults are used to store machine learning workspace secrets and other sensitive information that is needed by the workspace. Enabling key vaults with audit logging will help in monitoring how and when machine learning workspace secrets are accessed, and by whom. This audit log data enhances visibility by providing valuable insights into the trail of interactions involving confidential information. As a best practice, it is recommended to enable audit event logging for key vaults used for machine learning workspace secrets storage. Policy Severity— Informational Policy Type— Config config from cloud.resource where api.name = 'azure-machine-learning-workspace' AND json.rule = properties.keyVault exists as X; config from cloud.resource where api.name = 'azure-key-vault-list' AND json.rule = "not (diagnosticSettings.value[*].properties.logs[*].enabled any equal true and diagnosticSettings.value[*].properties.logs[*].enabled size greater than 0)" as Y; filter '$.X.properties.keyVault contains $.Y.name'; show Y;
Azure Storage Account storing Cognitive service diagnostic logs is publicly accessible 24.6.2	This policy identifies Azure Storage Accounts storing Cognitive service diagnostic logs are publicly accessible. Azure Storage account stores Cognitive service diagnostic logs which might contain detailed information of platform logs, resource logs, trace logs and metrics. Diagnostic log data may contain sensitive data and helps in identifying potentially malicious activity. The attacker could exploit publicly accessible storage account to get cognitive diagnostic data logs and could breach into the system by leveraging exposed data and propagate across your system. As a best security practice, it is recommended to restrict storage account access to only the services as per business requirement. Policy Severity— Medium Policy Type— Config config from cloud.resource where api.name = 'azure-cognitive-services-account-diagnostic-settings' AND json.rule = (properties.logs[?any(enabled equal ignore case "true")] exists or properties.metrics[?any( enabled equal ignore case "true" )] exists) and properties.storageAccountId exists as X; config from cloud.resource where api.name = 'azure-storage-account-list' AND json.rule = 'totalPublicContainers > 0 and (properties.allowBlobPublicAccess is true or properties.allowBlobPublicAccess does not exist)' as Y; filter '$.X.properties.storageAccountId contains $.Y.id'; show Y;
Azure Application Gateway WAF policy is not enabled in prevention mode 24.6.2	This policy identifies the Azure Application Gateway WAF policies that are not enabled in prevention mode. Azure Application Gateway WAF policies support Prevention and Detection modes. Detection mode monitors and logs all threat alerts to a log file. Detection mode is useful for testing purposes and configures WAF initially but it does not provide protection. It logs the traffic, but it doesn’t take any actions such as allow or deny. Where as, in Prevention mode, WAF analyzes incoming traffic to the application gateway and blocks any requests that are determined to be malicious based on a set of rules. As a best security practice, it is recommended to enable Application Gateway WAF policies with Prevention mode to prevent malicious requests from reaching your application and potentially causing damage. Policy Severity— Low Policy Type— Config config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-application-gateway-waf-policy' AND json.rule = properties.applicationGateways[*].id size greater than 0 and properties.policySettings.state equal ignore case Enabled and properties.policySettings.mode does not equal ignore case Prevention
GCP Storage Bucket storing GCP Vertex AI training pipeline output model 24.6.2	This policy identifies publicly exposed GCS buckets that are used to store the GCP Vertex AI training pipeline output model. GCP Vertex AI training pipeline output models are stored in the Storage bucket. Vertex AI training pipeline output model is considered sensitive and confidential intellectual property and its storage location should be checked regularly. The storage location should be as per your organization’s security and compliance requirements. It is recommended to monitor, identify, and evaluate storage location for the GCP Vertex AI training pipeline output model regularly to prevent unauthorized access and AI model thefts. Policy Severity— Informational Policy Type— Config config from cloud.resource where api.name = 'gcloud-storage-buckets-list' as X; config from cloud.resource where api.name = 'gcloud-vertex-ai-aiplatform-training-pipeline' as Y; filter ' $.Y.trainingTaskOutputDirectory contains $.X.id '; show X;
GCP Storage Bucket storing Vertex AI model 24.6.2	This policy identifies publicly exposed GCS buckets that are used to store the GCP Vertex AI model. GCP Vertex AI models (except AutoML Models) are stored in the Storage bucket. Vertex AI model is considered sensitive and confidential intellectual property and its storage location should be checked regularly. The storage location should be as per your organization’s security and compliance requirements. It is recommended to monitor, identify, and evaluate storage location for GCP Vertex AI model regularly to prevent unauthorized access and AI model thefts. Policy Severity— Informational Policy Type— Config config from cloud.resource where api.name = 'gcloud-storage-buckets-list' as X; config from cloud.resource where api.name = 'gcloud-vertex-ai-aiplatform-model' as Y; filter ' $.Y.artifactUri contains $.X.id '; show X;
GCP Storage Bucket storing GCP Vertex AI pipeline output data 24.6.2	This policy identifies publicly exposed GCS buckets that are used to store GCP Vertex AI pipeline output data. GCP Vertex AI pipeline output data is stored in the Storage Bucket. This output data is considered sensitive and confidential intellectual property and its storage location should be checked regularly. The storage location should be as per the organization’s security and compliance requirements. It is recommended to monitor, identify, and evaluate storage location for GCP Vertex AI pipeline output data regularly to prevent unauthorized access and AI model thefts. Policy Severity— Informational Policy Type— Config config from cloud.resource where api.name = 'gcloud-storage-buckets-list' as X; config from cloud.resource where api.name = 'gcloud-vertex-ai-aiplatform-pipeline-job' as Y; filter ' $.Y.runtimeConfig.gcsOutputDirectory contains $.X.id '; show X;
OCI VCN subnet flow logging is disabled 24.6.2	This policy identifies Virtual Cloud Network (VCN) subnets that have flow logs disabled. Enabling VCN flow logs enables you to monitor traffic flowing within your virtual network and can be used to detect anomalous traffic. Without the flow logs turned on, it is not possible to get any visibility into network traffic. It is recommended to enable a VCN flow log on each of your VCN subnets. Policy Severity— Low Policy Type— Config config from cloud.resource where api.name = 'oci-networking-subnet' as X; config from cloud.resource where api.name = 'oci-logging-logs' AND json.rule = lifecycleState equals ACTIVE and isEnabled is true and configuration.source.service contains flowlogs as Y; filter 'not ($.X.id contains $.Y.configuration.source.resource)'; show X;
OCI Oracle Analytics Cloud (OAC) access is not restricted to allowed sources or deployed within a Virtual Cloud Network 24.6.2	This policy identifies Oracle Analytics Cloud (OAC) instances that are not restricted to specific sources or not deployed within a Virtual Cloud Network (VCN). OAC is a scalable service for enterprise analytics, and restricting its access to corporate IP addresses or VCNs enhances security by reducing exposure to unauthorized access. Deploying OAC instances within a VCN and implementing access control rules is essential for protecting sensitive data. This ensures that only authorized sources can connect to OAC, mitigating risks and maintaining data integrity. As best practice, it is recommended to have new OAC instances deployed within a VCN, and existing instances should have access control rules configured to allow only approved sources. Policy Severity— Medium Policy Type— Config config from cloud.resource where api.name = 'oci-analytics-instance' AND json.rule = lifecycleState equal ignore case ACTIVE AND networkEndpointDetails.networkEndpointType equal ignore case PUBLIC AND (networkEndpointDetails.whitelistedServices is empty AND networkEndpointDetails.whitelistedIps is empty AND networkEndpointDetails.whitelistedVcns is empty)
OCI Oracle Autonomous Database (ADB) access is not restricted to allowed sources or deployed within a Virtual Cloud Network 24.6.2	This policy identifies Oracle Autonomous Databases (ADBs) that are not restricted to specific sources or not deployed within a Virtual Cloud Network (VCN). Autonomous Database automates critical database management tasks, and restricting its access to corporate IP addresses or VCNs is crucial for enhancing security. Deploying Autonomous Databases within a VCN and configuring access control rules ensure that only authorized sources can connect, significantly reducing the risk of unauthorized access. This protection is vital for maintaining the integrity and security of the databases. As best practice, it is recommended to have new Autonomous Database instances deployed within a VCN, and existing instances should have access control rules set to restrict connectivity to approved sources. Policy Severity— Medium Policy Type— Config config from cloud.resource where api.name = 'oci-database-autonomous-database' AND json.rule = lifecycleState contains AVAILABLE AND whitelistedIps is member of ("null") AND privateEndpoint is member of ("null")
Anthropic API key detected in code 24.6.2	An Anthropic API Key is used to access Anthropic’s artificial intelligence services via API. This key enables developers to seamlessly connect to Anthropic’s AI models, facilitating a variety of applications such as natural language processing, predictive analytics, and machine learning tasks. The API key serves as a secure credential, ensuring that only authorized applications and users have access to Anthropic’s AI services, thus safeguarding the data and the integrity of the services provided. Regular review and management of API keys are vital to ensuring robust security in your integrations with Anthropic’s advanced AI platforms. Policy Severity— Medium Policy Type— Config Policy Subtype— Build
Azure Functions HTTP Trigger Key detected in code 24.6.2	An Azure Functions HTTP Trigger Key is crucial for securing HTTP-triggered Azure Functions, restricting access to authorized clients. This key is essential for preventing unauthorized data exposure and manipulation through the function. Securely managing this key is imperative to maintain the integrity and security of applications relying on Azure Functions. Regular checks and updates of your security settings and keys are crucial for maintaining a robust security posture. Policy Severity— Low Policy Type— Config Policy Subtype— Build
GCP Cloud Function configured with overly permissive Ingress setting 24.6.2	This policy checks whether GCP Cloud Functions are configured with overly permissive Ingress settings. Overly permissive Ingress settings allow all inbound requests to the function, both from the public and from resources within the same project. It is recommended to restrict the traffic to improve network-based access control, allowing traffic only from VPC networks within the same project or through the Cloud Load Balancer. Policy Severity— Low Policy Type— Config Policy Subtype— Run, Build
GKE NodePool configuration managed at cluster level 24.6.2	This policy checks whether Google Kubernetes Engine (GKE) clusters uses NodePools within their configuration. The reason for this check is that using NodePools in the cluster configuration can unnecessarily complicate cluster management. When NodePools are used at the cluster level, modifying the node configuration creates a new NodePool, increasing operational complexity. Additionally, failing to delete older NodePools after creating new ones can lead to excess resource consumption. It is recommended to manage node configurations separately from the cluster to prevent these issues. Policy Severity— Low Policy Type— Config Policy Subtype— Build
Hugging Face token detected in code 24.6.2	A Hugging Face Token is used to access Hugging Face’s API for machine learning services, including models, and datasets. This token verifies identity and grants API access, ensuring a secure connection between your application and Hugging Face’s services. Regular management of tokens is crucial for maintaining security, ensuring data privacy and integrity, and preventing unauthorized access. Policy Severity— Medium Policy Type— Config Policy Subtype— Build
Microsoft Teams webhook detected in code 24.6.2	Webhooks and connectors facilitate the connection of web services to channels and teams in Microsoft Teams. Webhooks are user-defined HTTP callbacks that notify users about any action that has occurred in the MS Teams channel. Regularly reviewing and managing webhooks and their usage within your Teams setup is vital for ongoing security. Policy Severity— Low Policy Type— Config Policy Subtype— Build
Terraform module sources do not use a git url with a commit hash revision 24.6.2	Terraform modules are a collection of multiple resource configuration to offer an easy way of repeatable and reusable code logic. The most common way is to consume them through the public Terraform registry, which are connected to a VCS, like GitHub. This approach is problematic, because the module versions are not immutable and the module can be changed without changing the version, which makes the code vulnerable to a Supply Chain Attack. Therefore it is recommended to leverage Git URLs with a commit hash revision to guarantee immutability and consistency. Policy Severity— Medium Policy Type— Config Policy Subtype— Build
Terraform module sources do not use a git url with a tag or commit hash revision 24.6.2	Terraform modules are a collection of multiple resource configuration to offer an easy way of repeatable and reusable code logic. The most common way is to consume them through the public Terraform registry, which are connected to a VCS, like GitHub. This approach is problematic, because the module versions are not immutable and the module can be changed without changing the version, which makes the code vulnerable to a Supply Chain Attack. Therefore it is recommended to leverage Git URLs with a commit hash revision to guarantee immutability and consistency. Git tags can be used as well, but are not as immutable as a hash and therefore acceptable, but less preferred. This policy is a less restrictive version of the Terraform module sources do not use a git url with a commit hash revision policy that only allows for hashes. Policy Severity— High Policy Type— Config Policy Subtype— Build
AWS Secret Manager secret not used for more than 90 days 24.6.1	This policy identifies the AWS Secret Manager secret not accessed within 90 days. AWS Secret Manager securely stores and manages sensitive information like API keys, passwords, and certificates. Leaving unused secrets in AWS Secret Manager increases the risk of security breaches by providing unnecessary access points for attackers, potentially leading to unauthorized data access or leaks. It is recommended to routinely review and delete unused secrets to limit the attack surface and risk of unauthorized access. Policy Severity— Informational Policy Type— Config config from cloud.resource where cloud.type = 'aws' AND api.name = 'aws-secretsmanager-describe-secret' AND json.rule = '(lastAccessedDate does not exist and _DateTime.ageInDays(createdDate) > 90) or (lastAccessedDate exists and _DateTime.ageInDays(lastAccessedDate) > 90)'
AWS Aurora MySQL DB cluster does not publish audit logs to CloudWatch Logs 24.6.1	This policy identifies AWS Aurora MySQL DB cluster where audit logging is disabled or audit logs are not published to Amazon CloudWatch Logs. Aurora MySQL DB cluster integrates with Amazon CloudWatch for performance metrics gathering and analysis, supporting CloudWatch Alarms. While the Aurora MySQL DB cluster provides customizable audit logs for monitoring database operations, these logs are not automatically sent to CloudWatch Logs, limiting centralized monitoring and analysis of database activities. It is recommended to configure the Aurora MySQL DB cluster to enable audit logs and their publishing to CloudWatch. Policy Severity— Informational Policy Type— Config config from cloud.resource where api.name = 'aws-rds-db-cluster' AND json.rule = engine equals "aurora-mysql" and status equals "available" as X; config from cloud.resource where api.name = 'aws-rds-db-cluster-parameter-group' AND json.rule = DBParameterGroupFamily contains "aurora-mysql" as Y; filter '$.X.dBclusterParameterGroupArn equals $.Y.DBClusterParameterGroupArn and (($.Y.parameters.server_audit_logging.ParameterValue does not exist or $.Y.parameters.server_audit_logging.ParameterValue equals 0) or ($.X.enabledCloudwatchLogsExports does not contain "audit" and $.Y.parameters.server_audit_logs_upload.ParameterValue equals 0))' ; show X;
AWS AppSync GraphQL API is authenticated with API key 24.6.1	This policy identifies the AWS AppSync Graphql API using the API key for primary or additional authentication methods. AWS AppSync GraphQL API is a fully managed service by Amazon Web Services for building scalable and secure GraphQL APIs. An API key is a hard-coded value in your application generated by the AWS AppSync service when you create an unauthenticated GraphQL endpoint. Using API keys for authentication can pose security risks such as exposure to unauthorized access and limited control over access privileges, potentially compromising sensitive data and system integrity. It is recommended to use authentication methods other than API Keys like IAM, Amazon Cognito User Pools, or OpenID Connect providers for securing AWS AppSync GraphQL APIs, to ensure enhanced security and access control. Policy Severity— Informational Policy Type— Config config from cloud.resource where cloud.type = 'aws' AND api.name = 'aws-appsync-graphql-api' AND json.rule = authenticationType equals "API_KEY" or additionalAuthenticationProviders[?any( authenticationType equals "API_KEY" )] exists
AWS Network Firewall is not configured with logging configuration 24.6.1	This policy identifies an AWS Network Firewall where logging is not configured. AWS Network Firewall manages inbound and outbound traffic for the AWS resources within the AWS environment. Logging configuration for the network firewall involves enabling logging of network traffic, including allowed and denied requests, to provide visibility into network activity. Failure to configure logging results in a lack of visibility into potential security threats, making it difficult to detect and respond to malicious activity effectively and hindering threat detection and compliance. It is recommended to enable logging to ensure comprehensive monitoring, threat detection, compliance adherence, and effective incident response. Policy Severity— Informational Policy Type— Config config from cloud.resource where api.name = 'aws-networkfirewall-firewall' AND json.rule = FirewallStatus.Status equals "READY" as X; config from cloud.resource where api.name = 'aws-network-firewall-logging-configuration' AND json.rule = LoggingConfiguration.LogDestinationConfigs[*].LogType does not exist as Y; filter '$.X.Firewall.FirewallArn equal ignore case $.Y.FirewallArn' ; show X;
AWS Security Hub is not enabled 24.6.1	This policy identifies the AWS Security Hub that is not enabled in specific regions. AWS Security Hub is a centralized security management service by Amazon Web Services, providing a comprehensive view of your security posture and automating security checks across AWS accounts. Failure to enable AWS Security Hub in all regions may lead to limited visibility and compromised threat detection across your AWS environment. It is recommended to enable AWS Security Hub in all regions for consistent visibility and enhanced threat detection across your AWS environment. Policy Severity— Informational Policy Type— Config config from cloud.resource where cloud.type = 'aws' AND api.name = 'aws-securityhub-hub' AND json.rule = SubscribedAt exists as X; count(X) less than 1
AWS ECS task definition logging configuration disabled 24.6.1	This policy identifies AWS ECS task definitions that have logging configuration disabled. AWS ECS logging involves capturing and storing container logs for monitoring, troubleshooting, and analysis purposes within the Amazon ECS environment. Collecting data from task definitions gives visibility, which can aid in debugging processes and determining the source of issues. It is recommended to configure logging for an AWS ECS task definition. Policy Severity— Informational Policy Type— Config config from cloud.resource where cloud.type = 'aws' AND api.name = 'aws-ecs-describe-task-definition' AND json.rule = status equals ACTIVE and containerDefinitions[?any(logConfiguration.logDriver does not exist)] exists
AWS EC2 Client VPN endpoints client connection logging disabled 24.6.1	This policy identifies AWS EC2 client VPN endpoints with client connection logging disabled. AWS Client VPN endpoints enable remote clients to securely connect to resources in the Virtual Private Cloud (VPC). Connection logs enable you to track user behaviour on the VPN endpoint and gain visibility. It is recommended to enable connection logging for AWS EC2 client VPN endpoints. Policy Severity— Low Policy Type— Config config from cloud.resource where cloud.type = 'aws' AND api.name = 'aws-ec2-client-vpn-endpoint' AND json.rule = status.code equal ignore case available and connectionLogOptions.Enabled is false
AWS EventBridge event bus with no resource-based policy attached 24.6.1	This policy identifies AWS EventBridge event buses with no resource-based policy attached. AWS EventBridge is a serverless event bus service that enables businesses to quickly and easily integrate applications, services, and data across multiple cloud environments. By default, an EventBridge custom event bus lacks a resource-based policy associated with it, which allows principals in the account to access the event bus. It is recommended to attach a resource based policy to the event bus to limit access scope to fewer entities. Policy Severity— Informational Policy Type— Config config from cloud.resource where cloud.type = 'aws' AND api.name = 'aws-events-eventbus' AND json.rule = Policy does not exist
AWS WAF Rule Group CloudWatch metrics disabled 24.6.1	This policy identifies the AWS WAF Rule Group having CloudWatch metrics disabled. AWS WAF rule groups have CloudWatch metrics that provide information about the number of allowed and blocked web requests, counted requests, and requests that pass through without matching any rule in the rule group. These metrics can be used to monitor and analyse the performance of the web access control list (web ACL) and its associated rules. It is recommended to enable CloudWatch metrics for a WAF rule group to help in monitoring and analysis of web requests. Policy Severity— Informational Policy Type— Config config from cloud.resource where cloud.type = 'aws' AND api.name = 'aws-waf-v2-rule-group' AND json.rule = VisibilityConfig.CloudWatchMetricsEnabled is false or Rules[?any( VisibilityConfig.CloudWatchMetricsEnabled is false)] exists
AWS Step Function state machines logging disabled 24.6.1	This policy identifies AWS Step Function state machines with logging disabled. AWS Step Functions uses state machines to define and execute workflows that coordinate the components of distributed applications and microservices. Step Functions logs state machine executions to Amazon CloudWatch Logs for debugging and monitoring purposes. It is recommended to enable logging on the Step Function state machine to maintain reliability, availability, and performance. Policy Severity— Informational Policy Type— Config config from cloud.resource where cloud.type = 'aws' AND api.name = 'aws-step-functions-statemachine' AND json.rule = loggingConfiguration.level equal ignore case off
Azure Application Insights configured with overly permissive network access 24.6.1	This policy identifies Application Insights configured with overly permissive network access. Virtual network access configuration in Application Insights allows you to restrict data ingestion and queries coming from the public networks. It is recommended to configure the Application Insight with virtual networks access configuration set to restrict; so that the Application Insight is accessible only to restricted Azure Monitor private link scopes. Policy Severity— Medium Policy Type— Config config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-application-insights-component' AND json.rule = properties.provisioningState equals Succeeded and (properties.publicNetworkAccessForQuery equals Enabled or properties.publicNetworkAccessForIngestion equals Enabled)
Azure Application Insights not configured with Azure Active Directory (Azure AD) authentication 24.6.1	This policy identifies Application Insights that are not configured with Azure Active Directory (AAD) authentication and are enabled with local authentication. Disabling local authentication and using AAD-based authentication enhances the security and reliability of the telemetry used to make both critical operational and business decisions. It is recommended to configure the Application Insights with Azure Active Directory (AAD) authentication so that all actions are strongly authenticated. Policy Severity— Medium Policy Type— Config config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-application-insights-component' AND json.rule = properties.provisioningState equals Succeeded and (properties.DisableLocalAuth does not exist or properties.DisableLocalAuth is false)
Azure Log Analytics configured with overly permissive network access 24.6.1	This policy identifies Log Analytics configured with overly permissive network access. Virtual network access configuration in Log Analytics allows you to restrict data ingestion and queries coming from the public networks. It is recommended to configure the Log Analytics with virtual networks access configuration set to restrict; so that the Log Analytics is accessible only to restricted Azure Monitor private link scopes. Policy Severity— Medium Policy Type— Config config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-log-analytics-workspace' AND json.rule = properties.provisioningState equals Succeeded and (properties.publicNetworkAccessForQuery equals Enabled or properties.publicNetworkAccessForIngestion equals Enabled)
Azure storage account infrastructure encryption is disabled 24.6.1	The policy identifies Azure storage accounts for which infrastructure encryption is disabled. Infrastructure double encryption adds a second layer of encryption using service-managed keys. When infrastructure encryption is enabled for a storage account or an encryption scope, data is encrypted twice. Once at the service level and once at the infrastructure level - with two different encryption algorithms and two different keys. Infrastructure encryption is recommended for scenarios where double encrypted data is necessary for compliance requirements. It is recommended to enable infrastructure encryption on Azure storage accounts so that encryption can be implemented at the layer closest to the storage device or network wires. Policy Severity— Informational Policy Type— Config config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-storage-account-list' AND json.rule = properties.provisioningState equal ignore case Succeeded and (properties.encryption.requireInfrastructureEncryption does not exist or properties.encryption.requireInfrastructureEncryption is false)
Azure Activity log alert for Create or update public IP address rule does not exist 24.6.1	The policy identifies Azure storage accounts for which infrastructure encryption is disabled. Infrastructure double encryption adds a second layer of encryption using service-managed keys. When infrastructure encryption is enabled for a storage account or an encryption scope, data is encrypted twice. Once at the service level and once at the infrastructure level - with two different encryption algorithms and two different keys. Infrastructure encryption is recommended for scenarios where double encrypted data is necessary for compliance requirements. It is recommended to enable infrastructure encryption on Azure storage accounts so that encryption can be implemented at the layer closest to the storage device or network wires. Policy Severity— Informational Policy Type— Config config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-activity-log-alerts' AND json.rule = "location equal ignore case Global and properties.enabled equals true and properties.scopes[*] does not contain resourceGroups and properties.condition.allOf[?(@.field=='operationName')].equals equals Microsoft.Network/publicIPAddresses/write" as X; count(X) less than 1
Azure Activity log alert for Delete public IP address rule does not exist 24.6.1	This policy identifies the Azure accounts in which activity log alert for Delete public IP address rule does not exist. Creating an activity log alert for Delete public IP address rule gives insight into network rule access changes and may reduce the time it takes to detect suspicious activity. By enabling this monitoring, you get alerts whenever any deletions are made to public IP addresses rules. As a best practice, it is recommended to have an activity log alert for Delete public IP address rule to enhance network security monitoring and detect suspicious activities. Policy Severity— Informational Policy Type— Config config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-activity-log-alerts' AND json.rule = "location equal ignore case Global and properties.enabled equals true and properties.scopes[*] does not contain resourceGroups and properties.condition.allOf[?(@.field=='operationName')].equals equals Microsoft.Network/publicIPAddresses/delete" as X; count(X) less than 1
GCP Vertex AI Workbench user-managed notebook auto-upgrade is disabled 24.6.1	This policy identifies GCP Vertex AI Workbench user-managed notebooks that have auto-upgrade disabled. Auto-upgrading Google Cloud Vertex environments ensures timely security updates, bug fixes, and compatibility with APIs and libraries. It reduces security risks associated with outdated software, enhances stability, and enables access to new features and optimizations. It is recommended to enable auto-upgrade to minimize maintenance overhead and mitigate security risks. Policy Severity— Informational Policy Type— Config config from cloud.resource where cloud.type = 'gcp' AND api.name = 'gcloud-vertex-ai-notebook-instance' AND json.rule = state equals "ACTIVE" and metadata.notebook-upgrade-schedule does not exist
GCP Vertex AI Workbench user-managed notebook has vTPM disabled 24.6.1	This policy identifies GCP Vertex AI Workbench user-managed notebooks that have Virtual Trusted Platform Module (vTPM) feature disabled. Virtual Trusted Platform Module (vTPM) validates guest VM pre-boot and boot integrity and offers key generation and protection. The vTPM’s root keys and the keys it generates can’t leave the vTPM, thus gaining enhanced protection from compromised operating systems or highly privileged project admins. It is recommended to enable virtual TPM device on supported virtual machines to facilitate measured Boot and other OS security features that require a TPM. Policy Severity— Low Policy Type— Config config from cloud.resource where cloud.type = 'gcp' AND api.name = 'gcloud-vertex-ai-notebook-instance' AND json.rule = state equals "ACTIVE" and shieldedInstanceConfig.enableVtpm is false
GCP Vertex AI Workbench user-managed notebook’s JupyterLab interface access mode is set to single user 24.6.1	This policy identifies GCP Vertex AI Workbench user-managed notebooks with JupyterLab interface access mode set to single user. Vertex AI Workbench user-managed notebook can be accessed using the web-based JupyterLab interface. Access mode controls the control access to this interface. Allowing access to only a single user could limit collaboration, increase chances of credential sharing, and hinder security audits and reviews of the resource. It is recommended to avoid single user access and make use of the service account access mode for user-managed notebooks. Policy Severity— Informational Policy Type— Config config from cloud.resource where cloud.type = 'aws' AND api.name = 'aws-step-functions-statemachine' AND json.rule = loggingConfiguration.level equal ignore case off
GCP Vertex AI Workbench user-managed notebook has Integrity monitoring disabled 24.6.1	This policy identifies GCP Vertex AI Workbench user-managed notebooks that have Integrity monitoring disabled. Integrity Monitoring continuously monitors the boot integrity, kernel integrity, and persistent data integrity of the underlying VM of the shielded user-managed notebooks. It detects unauthorized modifications or tampering, enhancing security by verifying the trusted state of VM components throughout their lifecycle. It provides active alerting allowing administrators to respond to integrity failures and prevent compromised nodes from being deployed into the cluster. It is recommended to enable integrity monitoring for user-managed notebooks to detect and mitigate advanced threats like rootkits and bootkit malware. Policy Severity— Low Policy Type— Config config from cloud.resource where cloud.type = 'gcp' AND api.name = 'gcloud-vertex-ai-notebook-instance' AND json.rule = state equals "ACTIVE" and shieldedInstanceConfig.enableIntegrityMonitoring is false
GCP Cloud Run service revision is using default service account with editor role 24.6.1	This policy identifies GCP Cloud Run service revisions that are utilizing the default service account with the editor role. GCP Compute Engine Default service account is automatically created upon enabling the Compute Engine API. This service account is granted the IAM basic Editor role by default, unless explicitly disabled. Assigning default service account with the editor role to cloud run revisions could lead to privilege escalation. Granting minimal access rights helps in promoting a better security posture. Following the principle of least privileges, it is recommended to avoid assigning default service account with the editor role to cloud run revision. Policy Severity— Medium Policy Type— Config config from cloud.resource where api.name = 'gcloud-projects-get-iam-user' AND json.rule = user contains "[e-mail]" and roles[*] contains "roles/editor" as X; config from cloud.resource where api.name = 'gcloud-cloud-run-revisions-list' AND json.rule = spec.serviceAccountName contains "[e-mail]" as Y; filter ' $.X.user equals $.Y.spec.serviceAccountName '; show Y;
OCI Cloud Guard is not enabled in the root compartment of the tenancy 24.6.1	This policy identifies the absence of OCI Cloud Guard enablement in the root compartment of the tenancy. OCI Cloud Guard is a vital service that detects misconfigured resources and insecure activities within an OCI tenancy. It offers security administrators visibility to identify and resolve these issues promptly. Cloud Guard not only detects but also suggests, assists, or takes corrective actions to mitigate security risks. By enabling Cloud Guard in the root compartment of the tenancy with default configuration, activity detectors, and responders, administrators can proactively monitor and secure their OCI resources against potential security threats. As best practice, it is recommended to have Cloud Guard enabled in the root compartment of your tenancy. Policy Severity— Informational Policy Type— Config config from cloud.resource where api.name = 'oci-cloudguard-configuration' AND json.rule = status does not equal ignore case ENABLED
OCI boot volume is not encrypted with Customer Managed Key (CMK) 24.6.1	This policy identifies OCI boot volumes that are not encrypted with a Customer Managed Key (CMK). Encrypting boot volumes with a CMK enhances data security by providing an additional layer of protection. Effective management of encryption keys is crucial for safeguarding and accessing sensitive data. Customers should review boot volumes encrypted with Oracle service managed keys to determine if they prefer managing keys for specific volumes and implement their own key lifecycle management accordingly. As best practice, it is recommended to encrypt OCI boot volumes using a Customer Managed Key (CMK) to strengthen data security measures. Policy Severity— Informational Policy Type— Config config from cloud.resource where api.name = 'oci-block-storage-boot-volume' AND json.rule = lifecycleState equal ignore case "AVAILABLE" AND kmsKeyId is member of ("null")

IAM Policies

The 24.6.1 release includes the following OOTB IAM policies:

Policy Name	Description	RQL	Cloud	Policy Severity
AWS Compute Instance (EC2/Lambda) Assigned CloudFormation Creation Permissions Which Could Lead to Privilege Escalation	An adversary able to create CloudFormation stacks with any role would be able to escalate their permissions by attaching a privileged role to the stack while influencing the actions taken by the created resources. As such, they would obtain the ability to perform actions using the permissions of the attached role, allowing further enumeration and exploitation of the environment.	config from iam where dest.cloud.type = 'AWS' AND action.name CONTAINS ALL ('iam:PassRole', 'cloudformation:CreateStack') AND source.cloud.resource.type IN ('instance', 'function')	AWS	High
AWS Compute Instance (EC2/Lambda) Assigned Permissions to Run EC2 Instances Which Could Lead to Privilege Escalation	An adversary able to run EC2 instances with any role would be able to escalate their permissions by attaching a privileged role to the instance. As such, they would obtain the permissions of the role attached to the EC2, allowing further enumeration and exploitation of the environment.	config from iam where dest.cloud.type = 'AWS' AND action.name CONTAINS ALL ('iam:PassRole', 'ec2:RunInstances') AND source.cloud.resource.type IN ('instance', 'function')	AWS	High
AWS Compute Instance (EC2/Lambda) Assigned Lambda Creation Permissions Which Could Lead to Privilege Escalation	An adversary able to create a Lambda Function with any role and give themselves the permissions to invoke it would be able to escalate their permissions by attaching a privileged role to the function while defining the Lambda’s actions. As such, they would obtain the ability to perform actions using the permissions of the attached role, allowing further enumeration and exploitation of the environment.	config from iam where dest.cloud.type = 'AWS' AND action.name CONTAINS ALL ('iam:PassRole', 'lambda:CreateFunction', 'lambda:AddPermission') AND source.cloud.resource.type IN ('instance', 'function')	AWS	High
AWS Compute Instance (EC2/Lambda) Assigned IAM Policy Management Permissions Which Could Lead to Privilege Escalation	An adversary able to influence or change IAM policies could grant themselves extensive permissions using the policies. As such, they would obtain the ability to perform actions allowed by the policies, allowing further enumeration and exploitation of the environment.	config from iam where dest.cloud.type = 'AWS' AND action.name in ('iam:PutGroupPolicy', 'iam:PutRolePolicy', 'iam:AttachGroupPolicy', 'iam:AttachUserPolicy', 'iam:CreatePolicyVersion') AND source.cloud.resource.type IN ('instance', 'function')	AWS	High
AWS Compute Instance (EC2/Lambda) Assigned Glue DevEndpoint Creation Permissions Which Could Lead to Privilege Escalation	An adversary able to create a Glue DevEndpoint with any role would be able to escalate their permissions by attaching a privileged role to the endpoint and configuring authentication to the endpoint using a key which they control. As such, they would obtain the ability to perform actions using the permissions of the attached role, allowing further enumeration and exploitation of the environment.	config from iam where dest.cloud.type = 'AWS' AND action.name CONTAINS ALL ('iam:PassRole', 'glue:CreateDevEndpoint') AND source.cloud.resource.type IN ('instance', 'function')	AWS	High
AWS Compute Instance (EC2/Lambda) Assigned Glue DevEndpoint Creation Permissions Which Could Lead to Privilege Escalation	An adversary able to create a Glue DevEndpoint with any role would be able to escalate their permissions by attaching a privileged role to the endpoint and configuring authentication to the endpoint using a key which they control. As such, they would obtain the ability to perform actions using the permissions of the attached role, allowing further enumeration and exploitation of the environment.	config from iam where dest.cloud.type = 'AWS' AND action.name CONTAINS ALL ('iam:PassRole', 'glue:CreateDevEndpoint') AND source.cloud.resource.type IN ('instance', 'function')	AWS	High
Azure Compute Resource Assigned Role & Role Assignment Related Permissions Which Could Lead to Privilege Escalation	An adversary able to edit role assignments or role definitions could grant themselves additional roles, or grant additional permissions to roles they already have access to, escalating their privileges within the environment. This would allow them to further enumerate and exploit the environment.	config from iam where dest.cloud.type = 'AZURE' AND source.cloud.type = 'AZURE' AND source.cloud.service.name = 'Microsoft.Compute' AND source.cloud.resource.type = 'VirtualMachines' and action.name IN ('Microsoft.Authorization/roleAssignments/write', 'Microsoft.Authorization/roleDefinitions/write')	Azure	High
Azure Compute Resource Assigned Managed Identity Assignment Permissions Which Could Lead to Privilege Escalation	An adversary able to assign managed identities could assign them to themselves, obtaining the additional permissions granted to the managed identity, escalating their privileges within the environment. This would allow them to further enumerate and exploit the environment.	config from iam where dest.cloud.type = 'AZURE' AND source.cloud.type = 'AZURE' AND source.cloud.service.name = 'Microsoft.Compute' AND source.cloud.resource.type = 'VirtualMachines' and action.name = 'Microsoft.ManagedIdentity/userAssignedIdentities/assign/action'	Azure	High
AWS Role With Administrative Permissions Can Be Assumed By All Users	A globally assumable role with administartive permissions could allow an adversary to assume it (regardless of their original role as the target role is globally assumable) and utilize its administrative permissions to further compromise the environment.	config from iam where source.public = true AND grantedby.cloud.entity.type='role' and action.access.isAdministrative = true	AWS	High
GCP Compute Instance (VM/Cloud Function) Assigned Cloud Function Creation Permissions Which Could Lead to Privilege Escalation	An adversary able to create Cloud Function instances with Service Account impersonation privileges would be able to escalate their permissions creating an instance which performs attacker controlled actions using the permissions of an impersonated Service Account. This would allow them to further enumerate and exploit the environment.	config from iam where dest.cloud.type = 'GCP' AND source.cloud.resource.type IN ('Instances', 'functions') AND action.name CONTAINS ALL ( 'cloudfunctions.functions.create', 'cloudfunctions.functions.sourceCodeSet', 'iam.serviceAccounts.actAs' )	GCP	High
GCP Compute Instance (VM/Cloud Function) Assigned Cloud Run Creation Permissions Which Could Lead to Privilege Escalation	An adversary able to create Cloud Run instances with Service Account impersonation privileges would be able to escalate their permissions creating an instance which performs attacker controlled actions using the permissions of an impersonated Service Account. This would allow them to further enumerate and exploit the environment.	config from iam where dest.cloud.type = 'GCP' AND source.cloud.resource.type IN ('Instances', 'functions') AND action.name CONTAINS ALL ( 'run.services.create', 'run.routes.invoke', 'iam.serviceAccounts.actAs' )	GCP	High
GCP Compute Instance (VM/Cloud Function) Assigned Cloud Function IAM Policy Edit Permissions Which Could Lead to Privilege Escalation	An adversary able to edit the IAM policy for Cloud Function instances, in conjunction with Service Account impersonation privileges would be able to escalate their permissions by adding edit permissions to an instance, causing it to perform attacker controlled actions using the permissions of an impersonated Service Account. This would allow them to further enumerate and exploit the environment.	config from iam where dest.cloud.type = 'GCP' AND source.cloud.resource.type IN ('Instances', 'functions') AND action.name CONTAINS ALL ( 'cloudfunctions.functions.setIamPolicy', 'iam.serviceAccounts.actAs' )	GCP	High
GCP Compute Instance (VM/Cloud Function) Assigned Cloud Run IAM Policy Edit Permissions Which Could Lead to Privilege Escalation	An adversary able to edit the IAM policy for Cloud Run instances, in conjunction with Service Account impersonation privileges would be able to escalate their permissions by adding edit permissions to an instance, causing it to perform attacker controlled actions using the permissions of an impersonated Service Account. This would allow them to further enumerate and exploit the environment.	config from iam where dest.cloud.type = 'GCP' AND source.cloud.resource.type IN ('Instances', 'functions') AND action.name CONTAINS ALL ( 'run.services.setIamPolicy', 'iam.serviceAccounts.actAs' )	GCP	High
GCP Compute Instance (VM/Cloud Function) Assigned Cloud Run Jobs IAM Policy Edit Permissions Which Could Lead to Privilege Escalation	An adversary able to edit the IAM policy for Cloud Run Jobs, in conjunction with Service Account impersonation privileges would be able to escalate their permissions by adding edit permissions to an instance, causing it to perform attacker controlled actions using the permissions of an impersonated Service Account. This would allow them to further enumerate and exploit the environment.	config from iam where dest.cloud.type = 'GCP' AND source.cloud.resource.type IN ('Instances', 'functions') AND action.name CONTAINS ALL ( 'run.jobs.setIamPolicy', 'iam.serviceAccounts.actAs' )	GCP	High
GCP Compute Instance (VM/Cloud Function) Assigned IAM Role Update Permissions Which Could Lead to Privilege Escalation	An adversary able to retrieve and edit IAM roles could grant themselves additional permissions within the environment, escalating their privileges. This would allow them to further enumerate and exploit the environment.	config from iam where dest.cloud.type = 'GCP' AND source.cloud.resource.type IN ('Instances', 'functions') AND action.name CONTAINS ALL ( 'iam.roles.update', 'iam.roles.get' )	GCP	High
GCP Compute Instance (VM/Cloud Function) Assigned Permissions to Retrieve Service Account Tokens Which Could Lead to Privilege Escalation	An adversary able to retrieve Service Account tokens could authenticate as high-privileged Service Accounts, escalating their original privileges. This would allow them to further enumerate and exploit the environment.	config from iam where dest.cloud.type = 'GCP' AND source.cloud.resource.type IN ('Instances', 'functions') AND action.name CONTAINS ALL ( 'iam.serviceAccounts.getAccessToken', 'iam.serviceAccounts.get' )	GCP	High
GCP Compute Instance (VM/Cloud Function) Assigned Permissions to Edit IAM Policy for Service Accounts Which Could Lead to Privilege Escalation	An adversary able to edit Service Accounts' IAM Policies could grant themselves additional permissions within the environment, escalating their privileges. This would allow them to further enumerate and exploit the environment.	config from iam where dest.cloud.type = 'GCP' AND source.cloud.resource.type IN ('Instances', 'functions') AND action.name = 'iam.serviceAccounts.setIamPolicy'	GCP	High
GCP Compute Instance (VM/Cloud Function) Assigned Resource Manager Permissions Which Could Lead to Privilege Escalation	An adversary able to edit IAM Policies at the organization, folder or project levels could grant themselves additional permissions within the environment, escalating their privileges. This would allow them to further enumerate and exploit the environment.	config from iam where dest.cloud.type = 'GCP' AND source.cloud.resource.type IN ('Instances', 'functions') AND action.name IN ('resourcemanager.organizations.setIamPolicy', 'resourcemanager.folders.setIamPolicy', 'resourcemanager.projects.setIamPolicy')	GCP	High
GCP Cloud Run Instance Assigned Cloud Function Creation Permissions Which Could Lead to Privilege Escalation	An adversary able to create Cloud Function instances with Service Account impersonation privileges would be able to escalate their permissions creating an instance which performs attacker controlled actions using the permissions of an impersonated Service Account. This would allow them to further enumerate and exploit the environment.	config from iam where dest.cloud.type = 'GCP' AND source.cloud.service.name = 'run' AND action.name CONTAINS ALL ( 'cloudfunctions.functions.create', 'cloudfunctions.functions.sourceCodeSet', 'iam.serviceAccounts.actAs' )	GCP	High
GCP Cloud Run Instance Assigned Cloud Run Creation Which Could Lead to Privilege Escalation	An adversary able to create Cloud Run instances with Service Account impersonation privileges would be able to escalate their permissions creating an instance which performs attacker controlled actions using the permissions of an impersonated Service Account. This would allow them to further enumerate and exploit the environment.	config from iam where dest.cloud.type = 'GCP' AND source.cloud.service.name = 'run' AND action.name CONTAINS ALL ( 'run.services.create', 'run.routes.invoke', 'iam.serviceAccounts.actAs' )	GCP	High
GCP Cloud Run Instance Assigned Cloud Function IAM Policy Edit Permissions Which Could Lead to Privilege Escalation	An adversary able to edit the IAM policy for Cloud Function instances, in conjunction with Service Account impersonation privileges would be able to escalate their permissions by adding edit permissions to an instance, causing it to perform attacker controlled actions using the permissions of an impersonated Service Account. This would allow them to further enumerate and exploit the environment.	config from iam where dest.cloud.type = 'GCP' AND source.cloud.service.name = 'run' AND action.name CONTAINS ALL ( 'cloudfunctions.functions.setIamPolicy', 'iam.serviceAccounts.actAs' )	GCP	High
GCP Cloud Run Instance Assigned Cloud Run IAM Policy Edit Permissions Which Could Lead to Privilege Escalation	An adversary able to edit the IAM policy for Cloud Run instances, in conjunction with Service Account impersonation privileges would be able to escalate their permissions by adding edit permissions to an instance, causing it to perform attacker controlled actions using the permissions of an impersonated Service Account. This would allow them to further enumerate and exploit the environment.	config from iam where dest.cloud.type = 'GCP' AND source.cloud.service.name = 'run' AND action.name CONTAINS ALL ( 'run.services.setIamPolicy', 'iam.serviceAccounts.actAs' )	GCP	High
GCP Cloud Run Instance Assigned Cloud Run Jobs IAM Policy Edit Permissions Which Could Lead to Privilege Escalation	An adversary able to edit the IAM policy for Cloud Run Jobs, in conjunction with Service Account impersonation privileges would be able to escalate their permissions by adding edit permissions to an instance, causing it to perform attacker controlled actions using the permissions of an impersonated Service Account. This would allow them to further enumerate and exploit the environment.	config from iam where dest.cloud.type = 'GCP' AND source.cloud.service.name = 'run' AND action.name CONTAINS ALL ( 'run.jobs.setIamPolicy', 'iam.serviceAccounts.actAs' )	GCP	High
GCP Cloud Run Instance Assigned IAM Role Update Permissions Which Could Lead to Privilege Escalation	An adversary able to retrieve and edit IAM roles could grant themselves additional permissions within the environment, escalating their privileges. This would allow them to further enumerate and exploit the environment.	config from iam where dest.cloud.type = 'GCP' AND source.cloud.service.name = 'run' AND action.name CONTAINS ALL ( 'iam.roles.update', 'iam.roles.get' )	GCP	High
GCP Cloud Run Instance Assigned Permissions to Retrieve Service Account Tokens Which Could Lead to Privilege Escalation	An adversary able to retrieve Service Account tokens could authenticate as high-privileged Service Accounts, escalating their original privileges. This would allow them to further enumerate and exploit the environment.	config from iam where dest.cloud.type = 'GCP' AND source.cloud.service.name = 'run' AND action.name CONTAINS ALL ( 'iam.serviceAccounts.getAccessToken', 'iam.serviceAccounts.get' )	GCP	High
GCP Cloud Run Instance Assigned Permissions to Edit IAM Policy for Service Accounts Which Could Lead to Privilege Escalation	An adversary able to edit Service Accounts' IAM Policies could grant themselves additional permissions within the environment, escalating their privileges. This would allow them to further enumerate and exploit the environment.	config from iam where dest.cloud.type = 'GCP' AND source.cloud.service.name = 'run' AND action.name = 'iam.serviceAccounts.setIamPolicy'	GCP	High
GCP Cloud Run Instance Assigned Resource Manager Permissions Which Could Lead to Privilege Escalation	An adversary able to edit IAM Policies at the organization, folder or project levels could grant themselves additional permissions within the environment, escalating their privileges. This would allow them to further enumerate and exploit the environment.	config from iam where dest.cloud.type = 'GCP' AND source.cloud.service.name = 'run' AND action.name IN ('resourcemanager.organizations.setIamPolicy', 'resourcemanager.folders.setIamPolicy', 'resourcemanager.projects.setIamPolicy')	GCP	High
GCP App Engine Web Service Assigned Cloud Function Creation Permissions Which Could Lead to Privilege Escalation	An attacker who successfully exploits a vulnerability or misconfiguration in the web service can leverage the permissions associated with the App Engine service. By creating Cloud Function instances with service account impersonation privileges, the attacker can escalate their permissions. This enables the creation of instances that perform actions under the guise of the impersonated service account, further allowing the attacker to enumerate and exploit the environment.	config from iam where dest.cloud.type = 'GCP' AND source.cloud.service.name = 'appengine' AND action.name CONTAINS ALL ( 'cloudfunctions.functions.create', 'cloudfunctions.functions.sourceCodeSet', 'iam.serviceAccounts.actAs' )	GCP	High
GCP App Engine Web Service Assigned Cloud Run Creation Which Could Lead to Privilege Escalation	An attacker who successfully exploits a vulnerability or misconfiguration in the web service can leverage the permissions associated with the App Engine service. By creating Cloud Run instances with Service Account impersonation privileges they would be able to escalate their permissions creating an instance which performs attacker controlled actions using the permissions of an impersonated Service Account. This would allow them to further enumerate and exploit the environment.	config from iam where dest.cloud.type = 'GCP' AND source.cloud.service.name = 'appengine' AND action.name CONTAINS ALL ( 'run.services.create', 'run.routes.invoke', 'iam.serviceAccounts.actAs' )	GCP	High
GCP App Engine Web Service Assigned Cloud Function IAM Policy Edit Permissions Which Could Lead to Privilege Escalation	An attacker who successfully exploits a vulnerability or misconfiguration in the web service can leverage the permissions associated with the App Engine service. By editing the IAM policy for Cloud Function instances, in conjunction with Service Account impersonation privileges they would be able to escalate their permissions by adding edit permissions to an instance, causing it to perform attacker controlled actions using the permissions of an impersonated Service Account. This would allow them to further enumerate and exploit the environment.	config from iam where dest.cloud.type = 'GCP' AND source.cloud.service.name = 'appengine' AND action.name CONTAINS ALL ( 'cloudfunctions.functions.setIamPolicy', 'iam.serviceAccounts.actAs' )	GCP	High
GCP App Engine Web Service Assigned Cloud Run IAM Policy Edit Permissions Which Could Lead to Privilege Escalation	An attacker who successfully exploits a vulnerability or misconfiguration in the web service can leverage the permissions associated with the App Engine service. By editing the IAM policy for Cloud Run instances, in conjunction with Service Account impersonation privileges they would be able to escalate their permissions by adding edit permissions to an instance, causing it to perform attacker controlled actions using the permissions of an impersonated Service Account. This would allow them to further enumerate and exploit the environment.	config from iam where dest.cloud.type = 'GCP' AND source.cloud.service.name = 'appengine' AND action.name CONTAINS ALL ( 'run.services.setIamPolicy', 'iam.serviceAccounts.actAs' )	GCP	High
GCP App Engine Web Service Assigned Cloud Run Jobs IAM Policy Edit Permissions Which Could Lead to Privilege Escalation	An attacker who successfully exploits a vulnerability or misconfiguration in the web service can leverage the permissions associated with the App Engine service. By editing the IAM policy for Cloud Run Jobs, in conjunction with Service Account impersonation privileges they will be able to escalate their permissions by adding edit permissions to an instance, causing it to perform attacker controlled actions using the permissions of an impersonated Service Account. This would allow them to further enumerate and exploit the environment.	config from iam where dest.cloud.type = 'GCP' AND source.cloud.service.name = 'appengine' AND action.name CONTAINS ALL ( 'run.jobs.setIamPolicy', 'iam.serviceAccounts.actAs' )	GCP	High
GCP App Engine Web Service Assigned IAM Role Update Permissions Which Could Lead to Privilege Escalation	An attacker who successfully exploits a vulnerability or misconfiguration in the web service can leverage the permissions associated with the App Engine service. With the ability to retrieve and edit IAM roles could grant themselves additional permissions within the environment, escalating their privileges. This would allow them to further enumerate and exploit the environment.	config from iam where dest.cloud.type = 'GCP' AND source.cloud.service.name = 'appengine' AND action.name CONTAINS ALL ( 'iam.roles.update', 'iam.roles.get' )	GCP	High
GCP App Engine Web Service Assigned Permissions to Retrieve Service Account Tokens Which Could Lead to Privilege Escalation	An attacker who successfully exploits a vulnerability or misconfiguration in the web service can leverage the permissions associated with the App Engine service. With the ability to retrieve Service Account tokens could authenticate as high-privileged Service Accounts, escalating their original privileges. This would allow them to further enumerate and exploit the environment.	config from iam where dest.cloud.type = 'GCP' AND source.cloud.service.name = 'appengine' AND action.name CONTAINS ALL ( 'iam.serviceAccounts.getAccessToken', 'iam.serviceAccounts.get' )	GCP	High
GCP App Engine Web Service Assigned Permissions to Edit IAM Policy for Service Accounts Which Could Lead to Privilege Escalation	An attacker who successfully exploits a vulnerability or misconfiguration in the web service can leverage the permissions associated with the App Engine service. With the ability to edit Service Accounts' IAM Policies they could grant themselves additional permissions within the environment, escalating their privileges. This would allow them to further enumerate and exploit the environment.	config from iam where dest.cloud.type = 'GCP' AND source.cloud.service.name = 'appengine' AND action.name = 'iam.serviceAccounts.setIamPolicy'	GCP	High
GCP App Engine Web Service Assigned Resource Manager Permissions Which Could Lead to Privilege Escalation	An attacker who successfully exploits a vulnerability or misconfiguration in the web service can leverage the permissions associated with the App Engine service. With the ability to edit IAM Policies at the organization, folder or project levels they can grant themselves additional permissions within the environment, escalating their privileges. This would allow them to further enumerate and exploit the environment.	config from iam where dest.cloud.type = 'GCP' AND source.cloud.service.name = 'appengine' AND action.name IN ('resourcemanager.organizations.setIamPolicy', 'resourcemanager.folders.setIamPolicy', 'resourcemanager.projects.setIamPolicy')	GCP	High

Policy Updates

Policies	Description
Policy Updates—RQL
Azure Function App doesn’t have a Managed Service Identity 24.6.2	Changes— The policy RQL will be updated to exclude logic apps and web apps from reporting, focusing solely on Azure function apps within its scope. Severity— Low Policy Type— Config Current RQL— config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-app-service' AND json.rule = properties.state equal ignore case Running and kind contains functionapp and (identity.type does not exist or identity.principalId is empty) Updated RQL— config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-app-service' AND json.rule = properties.state equal ignore case "Running" AND kind contains "functionapp" AND kind does not contain "workflowapp" AND kind does not equal "app" AND (identity.type does not exist or identity.principalId is empty)---- Impact— Medium. Existing alerts generated for logicapp and webapps will be resolved as Policy_Updated.
Azure Function app configured with public network access 24.6.2	Changes— The policy RQL will be updated to exclude logic apps and web apps from reporting, focusing solely on Azure function apps within its scope. Severity— Medium Policy Type— Config Current RQL— config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-app-service' AND json.rule = 'kind starts with functionapp and properties.state equal ignore case running and ((properties.publicNetworkAccess exists and properties.publicNetworkAccess equal ignore case Enabled) or (properties.publicNetworkAccess does not exist)) and config.ipSecurityRestrictions[?any((action equals Allow and ipAddress equals Any) or (action equals Allow and ipAddress equals 0.0.0.0/0))] exists' Updated RQL— config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-app-service' AND json.rule = 'kind contains functionapp and kind does not contain workflowapp and kind does not equal app and properties.state equal ignore case running and ((properties.publicNetworkAccess exists and properties.publicNetworkAccess equal ignore case Enabled) or (properties.publicNetworkAccess does not exist)) and config.ipSecurityRestrictions[?any((action equals Allow and ipAddress equals Any) or (action equals Allow and ipAddress equals 0.0.0.0/0))] exists' Impact— Medium. Existing alerts generated for logicapp and webapps will be resolved as Policy_Updated.
Azure Function App doesn’t use latest TLS version 24.6.2	Changes— The policy RQL will be updated to exclude logic apps and web apps from reporting, focusing solely on Azure function apps within its scope. Severity— Low Policy Type— Config Current RQL— config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-app-service' AND json.rule = properties.state equal ignore case "Running" AND kind contains "functionapp" AND config.minTlsVersion does not equal "1.2" Updated RQL— config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-app-service' AND json.rule = properties.state equal ignore case "Running" AND kind contains "functionapp" AND kind does not contain "workflowapp" AND kind does not equal "app" AND config.minTlsVersion does not equal "1.2" Impact— Medium. Existing alerts generated for logicapp and webapps will be resolved as Policy_Updated.
Azure Function App doesn’t use HTTP 2.0 24.6.2	Changes— The policy RQL will be updated to exclude logic apps and web apps from reporting, focusing solely on Azure function apps within its scope. Severity— Informational Policy Type— Config Current RQL— config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-app-service' AND json.rule = properties.state equal ignore case "Running" AND kind contains "functionapp" AND config.http20Enabled is false Updated RQL— config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-app-service' AND json.rule = properties.state equal ignore case "Running" AND kind contains "functionapp" AND kind does not contain "workflowapp" AND kind does not equal "app" AND config.http20Enabled is false Impact— Medium. Existing alerts generated for logicapp and webapps will be resolved as Policy_Updated.
Azure Function App doesn’t redirect HTTP to HTTPS 24.6.2	Changes— The policy RQL will be updated to exclude logic apps and web apps from reporting, focusing solely on Azure function apps within its scope. Severity— Medium Policy Type— Config Current RQL— config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-app-service' AND json.rule = properties.state equal ignore case "Running" AND kind contains "functionapp" AND properties.httpsOnly is false Updated RQL— config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-app-service' AND json.rule = properties.state equal ignore case "Running" AND kind contains "functionapp" AND kind does not contain "workflowapp" AND kind does not equal "app" AND properties.httpsOnly is false Impact— Medium. Existing alerts generated for logicapp and webapps will be resolved as Policy_Updated.
Azure Function App client certificate is disabled 24.6.2	Changes— The policy RQL will be updated to exclude logic apps and web apps from reporting, focusing solely on Azure function apps within its scope. Severity— Informational Policy Type— Config Current RQL— config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-app-service' AND json.rule = properties.state equal ignore case Running and kind contains functionapp and properties.clientCertEnabled is false Updated RQL— config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-app-service' AND json.rule = properties.state equal ignore case "Running" AND kind contains "functionapp" AND kind does not contain "workflowapp" AND kind does not equal "app" AND properties.clientCertEnabled is false Impact— Medium. Existing alerts generated for logicapp and webapps will be resolved as Policy_Updated.
Policy Deletions
AWS role having iam:PassRole and lambda:InvokeFunction permissions attached to EC2 instance [Beta] 24.6.2	Changes— This policy is deleted because it is replaced by the following policy: AWS role having iam:PassRole and lambda:InvokeFunction permissions attached to EC2 instance
EC2 with IAM role attached has iam:PassRole and ec2:RunInstances permissions [Beta] 24.6.2	Changes— This policy is deleted because it is replaced by the following policy: EC2 with IAM role attached has iam:PassRole and ec2:Run Instances permissions

New Compliance Benchmarks and Updates

Compliance Benchmark	Description
Policy Mapping Update for CIS AWS v2.0 24.6.2	New Policy mappings are added to CIS v2.0.0 (AWS) - Level 1 compliance standard. Impact— No impact on existing alerts. The compliance score may vary because a new mapping has been added.
Policy Mapping Update for CIS GCP v2.0 24.6.2	New Policy mappings are added to CIS v2.0.0 (GCP) Level 1 and CIS v2.0.0 (GCP) Level 2 compliance standards. Impact— No impact on existing alerts. The compliance score may vary because a new mapping has been added.
Policy Mapping Update for ISO/IEC 27001:2022 24.6.2	New Policy mappings are added to ISO/IEC 27001:2022 compliance standard. Impact— No impact on existing alerts. The compliance score may vary because a new mapping has been added.
Support for CIS GKE v1.5 24.6.1	Prisma Cloud now supports CIS GKE version 1.5. The latest version has new controls and new Prisma cloud policies are mapped to the controls increasing the overall coverage. You can view this built-in standard and the associated policies on Compliance > Standards. Generate reports for immediate viewing or download, or schedule recurring reports to track this compliance standard over time.
Support for CIS OCI v2.0 24.6.1	Prisma Cloud now supports CIS OCI version 2.0. The latest version has new controls and new Prisma cloud policies are mapped to the controls increasing the overall coverage. You can view this built-in standard and the associated policies on Compliance > Standards. Generate reports for immediate viewing or download, or schedule recurring reports to track this compliance standard over time.
Support for CIS Azure Foundation benchmark v2.1 24.6.1	Prisma Cloud now supports CIS Azure Foundation benchmark version 2.1. The latest version has new controls and new Prisma cloud policies are mapped to the controls increasing the overall coverage. You can view this built-in standard and the associated policies on Compliance > Standards. Generate reports for immediate viewing or download, or schedule recurring reports to track this compliance standard over time.
Support for CIS AWS Foundation benchmark 3.0 24.6.1	Prisma Cloud now supports CIS AWS Foundation Benchmark version 3.0. This latest version has new controls and new Prisma cloud policies are mapped to the controls increasing the overall coverage. You can now view this built-in standard and the associated policies on the Compliance > Standards page. Generate reports for immediate viewing or download, or schedule recurring reports to track this compliance standard over time.

Changes in Existing Behavior

Feature	Description
API Rate Limits 24.6.1	Prisma Cloud uses API rate limits at the endpoint level to protect the performance and availability of its services. Rate limits will be applied to the additional APIs listed below.

Endpoint	Rate Limit (tps)	Burst Rate (tps)
Resource Lists
Get Resource Lists - GET /v1/resource_list	80	80
Get Resource List by ID - GET /v1/resource_list/#id	4	4
Get Resource List Types - GET /v1/resource_list/types	4	4
Get Resource List Names - GET /v1/resource_list/names	80	80
Account Groups
List Account Groups - GET /cloud/group	32	32
Account Group Info - GET /cloud/group/#id	80	80
List Account Group Names - GET /cloud/group/name	32	32
List Account Group Names by Cloud Type - GET cloud/group/name/#cloud_type	4	4
Collections
Get All Collections - GET /entitlement/api/v1/collection	4	4
Get Collection by ID - GET /entitlement/api/v1/collection/#id	8	8

REST API Updates

Change	Description
Vulnerabilities Dashboard APIs Secure the Infrastructure 24.6.2	The Vulnerabilities Dashboard endpoints now require specific access permissions to get the dashboard data and create remediation requests. For details on the required permissions, see the respective endpoint description. Also, the Get Vulnerabilities by RQL endpoint will now contain the following new parameters in the response: vulnerabilities - Total number of vulnerabilities assetCount - Total number of unique assets
CI/CD Risks API Secure the Source 24.6.2	The following new endpoints have been added to the API: Get All CI/CD Risks Summary Get CI/CD Risk Events Get CI/CD Risk Details Suppress CI/CD Risk Events Unsuppress CI/CD Risk Events
Technologies API Secure the Source 24.6.2	The following new endpoints have been added to the API: Get VCS 3rd Party Apps Get VCS 3rd Party Webhooks List Technologies Get Pipeline Tools
Repositories API Secure the Source 24.6.2	The following new endpoint has been added to the API: Get Repositories Page
SBOM API Secure the Source 24.6.2	The following new endpoint has been added to the API: Get Dependencies Also, the existing Get BOM Report endpoint is listed under the new SBOM category now.
Update Alerts APIs Secure the Infrastructure 24.6.1	The POST /alert/v1/policy and POST /alert/v1/aggregate APIs have an additional countDetails parameter in the response that includes totalAlerts and totalPolicies. The countDetails parameter allows you to view the total number of alerts across the total number of policies on the Alerts Overview page.
IAM APIs Secure the Infrastructure 24.6.1	Get least privilege access suggestions and resource metadata with the following new APIs: Get least Privilege Access Metadata of a Resource - GET iam/api/v1/resources/:resourceId/over-permissive-metadata Get existing Least Privilege Access Suggestions for a Resource - GET iam/api/v1/resources/:resourceId/existing-least-privileged-access Get new Least Privilege Access Suggestions for a Resource - GET iam/api/v1/resources/:resourceId/custom-least-privileged-access
Cloud Discovery and Exposure Management (CDEM) APIs Secure the Infrastructure 24.6.1	New Endpoints: The following endpoints are now available to fetch vulnerability details, distributions impacted by a vulnerability, and snooze patterns: Get Vulnerabilities of Unmanaged Asset - GET /asm/api/v1/asset/{asset_id}/vulnerability Get Impacted Distros of a Vulnerability - GET /asm/api/v1/asset/vulnerability Get Snooze Regex Pattern - GET asm/api/v1/asset/snoozed-regex Updates to the existing Endpoints: Introducing support to snooze or unsnooze a set of assets that match a regular expression by adding the regex parameter in the following endpoints: Snooze Unmanaged Assets - POST asm/api/v1/asset/snooze Unsnooze Unmanaged Assets - POST asm/api/v1/asset/reopen You can now filter assets by the account mapping status, which indicates if the asset is associated with a parent account on Prisma Cloud. The accountMappingStatus parameter is now added to the request or response of the following endpoints: Get Assets List - GET asm/api/v1/asset Get Asset Filters - GET asm/api/v1/asset/filters Get Aggregated Asset Count by Asset Type - GET asm/api/v1/asset/aggregation-by-resource-type Get Aggregated Asset Count by Cloud Type - GET asm/api/v1/asset/aggregation-by-cloud-type
Vulnerabilities Dashboard (UVE) APIs Secure the Infrastructure 24.6.1	New Endpoints: The following new versions of the existing endpoints are introduced to fetch additional details about the vulnerabilities: Get Prioritized Vulnerabilities V3 - GET uve/api/v3/dashboard/vulnerabilities/prioritised Get Top Impacting Vulnerabilities V2 - GET uve/api/v2/dashboard/vulnerabilities/prioritised-vuln Get CVE Overview V2 - GET uve/api/v1/cve-overview Updates to the existing Endpoints: The EPSS score and its details are added to the response to the following endpoints: Get Vulnerabilities by RQL - GET uve/api/v1/vulnerabilities/search Get CVE Overview - GET uve/api/v1/dashboard/vulnerabilities/cve-overview The atRisk and internetExposed parameters are added to the response of Get Vulnerable Assets by RQL. GET uve/api/v1/vulnerabilities/search/asset endpoint.
Download the Software Bill of Materials (SBOM) Secure the Runtime 32.06.132	The following new API endpoints enable you to download the Software Bill of Materials (SBOM) details: Download SBOM Images Download SBOM Hosts Download SBOM VMs Download SBOM Serverless Download SBOM Registry Download SBOM CLI Serverless Download SBOM CLI Images For more details on the SBOM feature, refer to the New Features section.
Remove hostname from registry progress response Secure the Runtime 32.06.132	The response of the View Registry Scan Progress API has the following changes: A new “specScanStartTime” field is added The existing “discovery” and “imageScan” properties have been modified to: Include a new “type” field Remove the “hostname” and “scanTime” fields`
Documentation update for Add Registry Settings Secure the Runtime 32.06.132	A new registry type - “Harbor” is added to the “version” field for the Add Registry Settings API. This option enables you to configure a Harbor registry for scanning.
Component documentation for API address resolving method for cluster name Secure the Runtime 32.06.132	A new optional field clusterNameResolvingMethod is added to the following APIs: Generate Daemonset Deployment YAML File Generate a Helm Deployment Chart for Defender The permissible values for this field are default, manual, and api-server.

Deprecation Notices

Change

Description

End of support for Azure Data Lake Analytics and Azure Data Lake Storage Gen1 Services 24.6.1

The following APIs are planned for deprecation because Azure has announced the retirement of Azure Data Lake Analytics and Azure Data Lake Storage Gen1 Services. Due to this, Prisma Cloud will no longer ingest metadata for the following APIs: azure-data-lake-analytics-account azure-data-lake-analytics-diagnostic-settings azure-data-lake-store-gen1-account azure-data-lake-store-gen1-diagnostic-settings In RQL, the key will not be available in the api.name attribute auto-completion. Impact— If you have a saved search or custom policies based on this API, you must delete those manually. The policy alerts will be resolved as Policy_Deleted.