Base Image updated to RHEL 9
Secure the Runtime
32.06.132
| The base image used by Defenders is now updated to Red Hat Enterprise Linux (RHEL) 9. | ## New Features | **Feature** | **Description** | | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | |Support for Vulnerability Management in Permission Groups
Secure the Infrastructure
24.6.2
|Prisma Cloud now supports vulnerability management for non-system admins in permission groups. They can use Search and Investigate to perform vulnerability searches, use the Vulnerability Dashboard, and Remediate Vulnerabilities.
New Compliance Support for DSPM
Secure the Data
24.6.2
|Prisma Cloud now supports the following compliance standards for Data Security Posture Management (DSPM):
Select Data Security > Compliance to see the available compliance standards. You can dive deep into each of the frameworks and see all the different risks related to them as well as the percentage, which is based on how many assets are in violation.
Update Code to Cloud Dashboard
Secure the Infrastructure
24.6.2
|You can now add up to 20 rows on your Code to Cloud dashboard. Previously, you could add only up to 5 rows.
Support for PackageJSON v3
Secure the Source
24.6.2
| Prisma Cloud now supports PackageJSON v3 for JavaScript projects that significantly enhances the SCA scanning capabilities. With this update, Prisma Cloud can successfully build dependency trees and identify both root and transitive packages, providing comprehensive visibility into your project’s dependencies. In addition, Prisma Cloud SCA scanning now matches CVEs to the vulnerable packages found in v3 files, allowing you to quickly address security risks. You can easily view SCA findings directly from Application Security > Projects in the Prisma Cloud console. Additionally, SCA findings are accessible in all supported IDEs, Checkov CLI, and PR comments for all supported version control systems, ensuring seamless integration into your development workflow. | |Support for Ansible Scanning
Secure the Source
24.6.2
| Prisma Cloud now offers support for [scanning](https://docs.prismacloud.io/en/enterprise-edition/content-collections/application-security/supported-technologies) Ansible, a leading Infrastructure as Code (IaC) framework. Prisma Cloud can now scan Ansible templates for misconfigurations throughout the software development lifecycle (SDLC) using it’s out of-the-box policies. | |Update Top Risks From Unmanaged Assets Widget
Secure the Infrastructure
24.6.1
|The Top Risks From Unmanaged Assets widget in the Discovery and Exposure Management Dashboard is enhanced to display the top risks based on various categories that affect your security posture due to public exposure of assets on the internet. The risks are categorized as Critical, Exploited, Patchable, Vulnerable, and Exposed. Links offer additional context and options to convert and inspect affected assets, helping you to quickly assess and address potential threats.
Vulnerabilities Tab
Secure the Infrastructure
24.6.1
|You can explore the new Vulnerabilities tab in the side panel while inspecting internet-exposed assets.
Improved IAM Risk Management
Secure the Infrastructure
24.6.1
| Enhancements to Prisma Cloud’s [IAM policies](https://docs.prismacloud.io/en/enterprise-edition/content-collections/governance/create-an-iam-policy) enable you to proactively manage IAM-related risks and improve your cloud security posture. Gain granular visibility into violations at the entity level by creating IAM policies based on queries that include **granters** (roles/groups/service accounts) as the violating resource. Next, develop remediation to fix IAM policy violations at the granter level or use the **Suggest Least Privileged Access** feature to remediate over-privileged access by select granters. | |Snooze Assets from Inventory Page
Secure the Infrastructure
24.6.1
|You now have the option to Snooze known internet-exposed assets, such as test or vendor assets, in the Inventory > Unmanaged Assets page. Snoozing assets help you to view Active assets separately from Snoozed assets using the Status filter. You can Snooze one or multiple assets at a time. Use the search bar to find your assets. Filter your search results by Domain name or IP Address.
Account Mapped Status Filter
Secure the Infrastructure
24.6.1
|The Inventory > Unmanaged Assets page now includes a new Account Mapped Status filter. Use this filter to view a comprehensive list of your Mapped assets separately from Unmapped assets.
Mapped — Shows exposed assets that are linked to a parent account or organizational unit (OU) accounts on Prisma Cloud. You can secure these assets by onboarding them to Prisma Cloud. Unmapped — Shows exposed assets that cannot be linked to a parent account or organizational unit (OU) accounts on Prisma Cloud. You can an Send Email to receive a summary of the assets for further investigation.
Update Removal of Select All and Deselect All Capabilities in Some Filters
Secure the Infrastructure
24.6.1
| For better performance, **Select All** and **Deselect All** are no longer supported for the Account Group, Cloud Account, Cloud Account ID, and Policy Name filters. | |Terraform Enterprise (Run Tasks) support for Transporter
Secure the Source
24.6.1
| [Terraform Enterprise (Run Tasks)](https://docs.prismacloud.io/en/enterprise-edition/content-collections/application-security/get-started/connect-code-and-build-providers/ci-cd-runs/add-terraform-enterprise-run-tasks#undefined) now includes support for Transporter. The Transporter serves as a communication proxy or broker, facilitating a secure channel between Prisma Cloud and Terraform Enterprise (Run Tasks). This enables seamless integration and management of Terraform Enterprise within your infrastructure while maintaining stringent security measures. | |Support for AWS CodeCommit Integration
Secure the Source
24.6.1
| Integrate prisma Cloud with [AWS Code Commit](https://docs.prismacloud.io/en/enterprise-edition/content-collections/application-security/get-started/connect-code-and-build-providers/code-repositories/add-aws-codecommit) version control system (VCS) to gain visibility into, and monitor the systems, technologies, configurations, and pipelines that make up the AWS CodeCommit platform. This integration enables security scans to identify Infrastructure-as-Code (IaC) misconfigurations, Software Composition Analysis (SCA) vulnerabilities, license non-compliance, exposed secrets and CI/CD pipeline risks in your AWS CodeCommit platform. Enhance the security posture for your organization by contextualizing, prioritizing and mitigating issues as soon as they are detected. | |Enhanced Security for JavaScript Projects: SCA Now Supports Lockfile v3
Secure the Source
24.6.1
|SCA support is now available for JavaScript Lockfile v3. This added support offers:
Go Symbol Extraction in Prisma Cloud
Secure the Runtime
32.06.132
|When scanning Golang binaries, Prisma Cloud extracts Go symbols, which allows for evaluating vulnerabilities accurately with specific package names and symbols. The feature flag for extracting Go symbols is enabled by default. Prisma Cloud also allows you to selectively disable symbol extraction when they are not needed, to optimize the scan.
To disable this feature, follow these steps:
Exporting Software Bill of Materials (SBOM) files in CycloneDX version 1.4
Secure the Runtime
32.06.132
|Prisma Cloud now supports exporting Software Bill of Materials (SBOM) files in CycloneDX version 1.4 for functions, images, and hosts scans. SBOM files can be generated in JSON or XML format.
SBOM Attributes
The SBOM files contain the following attributes:
SBOM files can be downloaded either through API calls or twistcli.
For information about the SBOM API calls, see the REST API Updates section.
twistcli Configuration
Resolving method for cluster name
Secure the Runtime
32.06.132
|When deploying Defender to your Kubernetes cluster, Prisma Cloud now provides you the option to use the API server address from the kube config file to resolve cluster names.
This option ensures that each cluster has a unique cluster name in Prisma Cloud.
A new field, Cluster name resolving method, has been added to the Manage → Defenders → “Manual Deploy” → Orchestrator → “Orchestrator type = Kubernetes" → Advanced Settings page.
The Cluster name resolving method field has the following options:
This enhancement ensures that vulnerability information is accurately reported for each cluster and makes sure that the clean clusters are not misrepresented as vulnerable due to naming conflicts.
| ## API Ingestions | **Service** | **API Details** | | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | |Amazon Comprehend
24.6.2
|aws-comprehend-pii-entities-detection-jobs
Additional permissions required:
comprehend:ListPiiEntitiesDetectionJobscomprehend:ListTagsForResourceThe Security Audit role includes the permissions.
| |Amazon Comprehend
24.6.2
|aws-comprehend-sentiment-detection-jobs
Additional permissions required:
comprehend:ListSentimentDetectionJobscomprehend:ListTagsForResourceThe Security Audit role includes the permissions.
| |Amazon Comprehend
24.6.2
|aws-comprehend-key-phrases-detection-jobs
Additional permissions required:
comprehend:ListKeyPhrasesDetectionJobscomprehend:ListTagsForResourceThe Security Audit role includes the permissions.
| |AWS Service Catalog
24.6.2
|aws-servicecatalog-principals-for-portfolio
Additional permissions required:
servicecatalog:ListPortfoliosservicecatalog:ListPrincipalsForPortfolioYou must manually add the above permissions to the CFT template to enable them.
| |Update Amazon Route53
24.6.2
|aws-route53-list-hosted-zones
The following fields are excluded from the resource JSON for this API:
resourceRecordSet\[*].regionresourceRecordSet\[*].trafficPolicyInstanceIdresourceRecordSet\[\*].ttlUpdate AWS Trusted Advisor
24.6.2
|aws-trusted-advisor-check-result
The flaggedResources field with the status OK is excluded from the resource JSON for this API.
Azure Active Directory
24.6.2
|azure-active-directory-user-registration-details
Additional permission required:
AuditLog.Read.AllThe Reader role includes the permission.
| |Azure App Service
24.6.2
|azure-app-service-web-apps-functions
Additional permissions required:
Microsoft.Web/sites/ReadMicrosoft.web/sites/functions/readThe Reader role includes the permissions.
| |Update Azure App Service
24.6.2
|azure-app-service-plan
The zoneRedundant field is now included in the resource JSON for this API. When zoneRedundant is set to true, the azure-app-service-plan API will automatically perform availability zone balancing.
Azure Compute
24.6.2
|azure-compute-disk-encryption-sets
Additional permission required:
Microsoft.Compute/diskEncryptionSets/readThe Reader role includes the permission.
| |Azure Databricks
24.6.2
|azure-databricks-diagnostic-settings
Additional permissions required:
Microsoft.Databricks/workspaces/readMicrosoft.Insights/DiagnosticSettings/ReadThe Reader role includes the permissions.
| |Azure NetApp Files
24.6.2
|azure-netappfiles-volumes
Additional permissions required:
Microsoft.NetApp/netAppAccounts/capacityPools/volumes/readMicrosoft.NetApp/netAppAccounts/readMicrosoft.NetApp/netAppAccounts/capacityPools/readThe Reader role includes the permissions.
| |Google Vertex AI
24.6.2
|gcloud-vertex-ai-workbench-instance
Additional permissions required:
notebooks.instances.listnotebooks.instances.getIamPolicyThe Viewer role includes the permissions.
| |Google Vertex AI AIPlatform
24.6.2
|gcloud-vertex-ai-aiplatform-monitoring-job
Additional permission required:
aiplatform.modelDeploymentMonitoringJobs.listThe Viewer role includes the permission.
| |Google Vertex AI AIPlatform
24.6.2
|gcloud-vertex-ai-aiplatform-persistent-resource
Additional permission required:
aiplatform.persistentResources.listThe Viewer role includes the permission.
| |Google Vertex AI AIPlatform
24.6.2
|gcloud-vertex-ai-aiplatform-vizier-study
Additional permission required:
aiplatform.studies.listThe Viewer role includes the permission.
| |Google Vertex AI AIPlatform
24.6.2
|gcloud-vertex-ai-aiplatform-tuning-job
Additional permission required:
aiplatform.tuningJobs.listThe Viewer role includes the permission.
| |Amazon CloudFront
24.6.1
|aws-cloudfront-response-headers-policy
Additional permissions required:
cloudfront:ListResponseHeadersPoliciescloudfront:GetResponseHeadersPolicyThe Security Audit role includes the permissions.
| |AWS Database Migration Service
24.6.1
|aws-dms-replication-task
Additional permissions required:
dms:DescribeReplicationTasksdms:ListTagsForResourceThe Security Audit role includes the permissions.
| |AWS Network Firewall
24.6.1
|aws-network-firewall-rule-group
Additional permissions required:
network-firewall:ListRuleGroupsnetwork-firewall:DescribeRuleGroupThe Security Audit role includes the permissions.
| |AWS Glue
24.6.1
|aws-glue-resource-policy
Additional permission required:
glue:GetResourcePoliciesYou must manually add the above permission to the CFT template to enable it.
| |AWS Macie
24.6.1
|aws-macie2-classification-job
Additional permission required:
macie2:ListClassificationJobsYou must manually add the above permission to the CFT template to enable it.
| |Azure Monitor
24.6.1
|azure-monitor-action-groups
Additional permission required:
Microsoft.Insights/ActionGroups/ReadThe Reader role includes the permission.
| |Azure Log Analytics
24.6.1
|azure-log-analytics-clusters
Additional permission required:
Microsoft.OperationalInsights/clusters/readThe Reader role includes the permission.
| |Azure App Service
24.6.1
|azure-app-service-private-endpoint-connections
Additional permissions required:
Microsoft.Web/sites/ReadMicrosoft.Web/sites/privateEndpointConnections/ReadThe Reader role includes the permissions.
| |Azure Event Grid
24.6.1
|azure-event-grid-namespaces
Additional permission required:
Microsoft.EventGrid/namespaces/readThe Reader role includes the permission.
| |Azure Virtual Network
24.6.1
|azure-network-private-dns-zone-groups
Additional permissions required:
Microsoft.Network/privateEndpoints/readMicrosoft.Network/privateEndpoints/privateDnsZoneGroups/readThe Reader role includes the permissions.
| |Google Storage Transfer
24.6.1
|gcloud-storage-transfer-agent-pool
Additional permission required:
storagetransfer.agentpools.listThe Viewer role includes the permission.
| |Google Storage Transfer
24.6.1
|gcloud-storage-transfer-job
Additional permission required:
storagetransfer.jobs.listThe Viewer role includes the permission.
| |Google Cloud Workstation
24.6.1
|gcloud-cloud-workstation-configuration
Additional permissions required:
workstations.workstationClusters.listworkstations.workstationConfigs.listworkstations.workstationConfigs.getIamPolicyThe Viewer role includes the permissions.
| |Google Cloud Workstation
24.6.1
|gcloud-cloud-workstation-cluster
Additional permission required:
workstations.workstationClusters.listThe Viewer role includes the permission.
| |Google Cloud Workstation
24.6.1
|gcloud-cloud-workstation
Additional permissions required:
workstations.workstationClusters.listworkstations.workstationConfigs.listworkstations.workstations.listworkstations.workstationConfigs.getIamPolicyThe Viewer role includes the permissions.
| |Update GCP Vertex AI Platform Pipeline Job
24.6.1
|gcloud-vertex-ai-aiplatform-pipeline-job
A new runtimeConfig field and it’s sub-fields are now ingested as part of this update.
| Policies | Description |
AWS ECR private repository tag mutable 24.6.2 | This policy identifies AWS ECR private repositories whose tag immutability is not configured. AWS Elastic Container Registry (ECR) tag immutability ensures that once an image is pushed to a repository with tag immutability enabled, the tag cannot be overwritten or updated. This feature is useful for ensuring the security, integrity, and reliability of container images in production environments. It prevents tags from being overwritten, which can help prevent unauthorised changes to images. It is recommended to enable tag immutability on ECR repositories to maintain the integrity and security of the images pushed. Policy Severity— Informational Policy Type— Config |
AWS IAM group not in use 24.6.2 | This policy identifies AWS IAM groups that are not actively in use. An AWS IAM group is a collection of IAM users managed together, allowing for unified permission assignment. These groups, if not assigned any users, pose a potential security risk if left unmanaged and can inadvertently grant unauthorized access to AWS services and resources. It is recommended to review and remove any unused IAM groups to prevent attaching unauthorized IAM users. Policy Severity— Informational Policy Type— Config |
AWS Opensearch domain audit logging disabled 24.6.2 | This policy identifies AWS Opensearch domains with audit logging disabled. Opensearch audit logs enable you to monitor user activity on your Elasticsearch clusters, such as authentication successes and failures, OpenSearch requests, index updates, and incoming search queries. It is recommended to enable audit logging for an Elasticsearch domain to audit activity in the domain. Policy Severity— Informational Policy Type— Config |
AWS Opensearch domain Error logging disabled 24.6.2 | This policy identifies AWS Opensearch domains with no error logging configuration. Opensearch application logs contain information about errors and warnings raised during the operation of the service and can be useful for troubleshooting. Error logs from domains can aid in security assessments, access monitoring, and troubleshooting availability problems. It is recommended to enable the AWS Opensearch domain with error logs, which will help in security audits and troubleshooting. Policy Severity— Informational Policy Type— Config |
AWS S3 bucket used for storing AWS Sagemaker training job output 24.6.2 | This policy identifies the AWS S3 bucket used for storing AWS Sagemaker training job output. S3 buckets hold the results and artifacts generated from training machine learning models in Sagemaker. Ensuring proper configuration and access control is crucial to maintain the security and integrity of the training output. Improperly secured S3 buckets used for storing AWS Sagemaker training output can lead to unauthorized access, data breaches, and potential exposure of sensitive model information. It is recommended to implement strict access controls, enable encryption, and audit permissions to secure AWS S3 buckets for AWS Sagemaker training job output and ensure compliance. Policy Severity— Informational Policy Type— Config |
AWS S3 bucket is utilized for AWS Sagemaker training job data 24.6.2 | This policy identifies the AWS S3 bucket used for AWS Sagemaker training job data input. S3 buckets store the datasets required for training machine learning models in Sagemaker. Proper configuration and access control are essential to ensure the security and integrity of the training data. Improperly configured S3 buckets used for AWS Sagemaker training data can lead to unauthorized access, data breaches, and potential loss of sensitive information. It is recommended to implement strict access controls, enable encryption, and audit permissions to secure AWS S3 buckets for AWS Sagemaker training data and ensure compliance. Policy Severity— Informational Policy Type— Config |
Azure Key vault used for machine learning workspace secrets storage is not enabled with audit logging 24.6.2 | This policy identifies Azure Key vaults used for machine learning workspace secrets storage that are not enabled with audit logging. Azure Key vaults are used to store machine learning workspace secrets and other sensitive information that is needed by the workspace. Enabling key vaults with audit logging will help in monitoring how and when machine learning workspace secrets are accessed, and by whom. This audit log data enhances visibility by providing valuable insights into the trail of interactions involving confidential information. As a best practice, it is recommended to enable audit event logging for key vaults used for machine learning workspace secrets storage. Policy Severity— Informational Policy Type— Config |
Azure Storage Account storing Cognitive service diagnostic logs is publicly accessible 24.6.2 | This policy identifies Azure Storage Accounts storing Cognitive service diagnostic logs are publicly accessible. Azure Storage account stores Cognitive service diagnostic logs which might contain detailed information of platform logs, resource logs, trace logs and metrics. Diagnostic log data may contain sensitive data and helps in identifying potentially malicious activity. The attacker could exploit publicly accessible storage account to get cognitive diagnostic data logs and could breach into the system by leveraging exposed data and propagate across your system. As a best security practice, it is recommended to restrict storage account access to only the services as per business requirement. Policy Severity— Medium Policy Type— Config |
Azure Application Gateway WAF policy is not enabled in prevention mode 24.6.2 | This policy identifies the Azure Application Gateway WAF policies that are not enabled in prevention mode. Azure Application Gateway WAF policies support Prevention and Detection modes. Detection mode monitors and logs all threat alerts to a log file. Detection mode is useful for testing purposes and configures WAF initially but it does not provide protection. It logs the traffic, but it doesn’t take any actions such as allow or deny. Where as, in Prevention mode, WAF analyzes incoming traffic to the application gateway and blocks any requests that are determined to be malicious based on a set of rules. As a best security practice, it is recommended to enable Application Gateway WAF policies with Prevention mode to prevent malicious requests from reaching your application and potentially causing damage. Policy Severity— Low Policy Type— Config |
GCP Storage Bucket storing GCP Vertex AI training pipeline output model 24.6.2 | This policy identifies publicly exposed GCS buckets that are used to store the GCP Vertex AI training pipeline output model. GCP Vertex AI training pipeline output models are stored in the Storage bucket. Vertex AI training pipeline output model is considered sensitive and confidential intellectual property and its storage location should be checked regularly. The storage location should be as per your organization’s security and compliance requirements. It is recommended to monitor, identify, and evaluate storage location for the GCP Vertex AI training pipeline output model regularly to prevent unauthorized access and AI model thefts. Policy Severity— Informational Policy Type— Config |
GCP Storage Bucket storing Vertex AI model 24.6.2 | This policy identifies publicly exposed GCS buckets that are used to store the GCP Vertex AI model. GCP Vertex AI models (except AutoML Models) are stored in the Storage bucket. Vertex AI model is considered sensitive and confidential intellectual property and its storage location should be checked regularly. The storage location should be as per your organization’s security and compliance requirements. It is recommended to monitor, identify, and evaluate storage location for GCP Vertex AI model regularly to prevent unauthorized access and AI model thefts. Policy Severity— Informational Policy Type— Config |
GCP Storage Bucket storing GCP Vertex AI pipeline output data 24.6.2 | This policy identifies publicly exposed GCS buckets that are used to store GCP Vertex AI pipeline output data. GCP Vertex AI pipeline output data is stored in the Storage Bucket. This output data is considered sensitive and confidential intellectual property and its storage location should be checked regularly. The storage location should be as per the organization’s security and compliance requirements. It is recommended to monitor, identify, and evaluate storage location for GCP Vertex AI pipeline output data regularly to prevent unauthorized access and AI model thefts. Policy Severity— Informational Policy Type— Config |
OCI VCN subnet flow logging is disabled 24.6.2 | This policy identifies Virtual Cloud Network (VCN) subnets that have flow logs disabled. Enabling VCN flow logs enables you to monitor traffic flowing within your virtual network and can be used to detect anomalous traffic. Without the flow logs turned on, it is not possible to get any visibility into network traffic. It is recommended to enable a VCN flow log on each of your VCN subnets. Policy Severity— Low Policy Type— Config |
OCI Oracle Analytics Cloud (OAC) access is not restricted to allowed sources or deployed within a Virtual Cloud Network 24.6.2 | This policy identifies Oracle Analytics Cloud (OAC) instances that are not restricted to specific sources or not deployed within a Virtual Cloud Network (VCN). OAC is a scalable service for enterprise analytics, and restricting its access to corporate IP addresses or VCNs enhances security by reducing exposure to unauthorized access. Deploying OAC instances within a VCN and implementing access control rules is essential for protecting sensitive data. This ensures that only authorized sources can connect to OAC, mitigating risks and maintaining data integrity. As best practice, it is recommended to have new OAC instances deployed within a VCN, and existing instances should have access control rules configured to allow only approved sources. Policy Severity— Medium Policy Type— Config |
OCI Oracle Autonomous Database (ADB) access is not restricted to allowed sources or deployed within a Virtual Cloud Network 24.6.2 | This policy identifies Oracle Autonomous Databases (ADBs) that are not restricted to specific sources or not deployed within a Virtual Cloud Network (VCN). Autonomous Database automates critical database management tasks, and restricting its access to corporate IP addresses or VCNs is crucial for enhancing security. Deploying Autonomous Databases within a VCN and configuring access control rules ensure that only authorized sources can connect, significantly reducing the risk of unauthorized access. This protection is vital for maintaining the integrity and security of the databases. As best practice, it is recommended to have new Autonomous Database instances deployed within a VCN, and existing instances should have access control rules set to restrict connectivity to approved sources. Policy Severity— Medium Policy Type— Config |
Anthropic API key detected in code 24.6.2 | An Anthropic API Key is used to access Anthropic’s artificial intelligence services via API. This key enables developers to seamlessly connect to Anthropic’s AI models, facilitating a variety of applications such as natural language processing, predictive analytics, and machine learning tasks. The API key serves as a secure credential, ensuring that only authorized applications and users have access to Anthropic’s AI services, thus safeguarding the data and the integrity of the services provided. Regular review and management of API keys are vital to ensuring robust security in your integrations with Anthropic’s advanced AI platforms. Policy Severity— Medium Policy Type— Config Policy Subtype— Build |
Azure Functions HTTP Trigger Key detected in code 24.6.2 | An Azure Functions HTTP Trigger Key is crucial for securing HTTP-triggered Azure Functions, restricting access to authorized clients. This key is essential for preventing unauthorized data exposure and manipulation through the function. Securely managing this key is imperative to maintain the integrity and security of applications relying on Azure Functions. Regular checks and updates of your security settings and keys are crucial for maintaining a robust security posture. Policy Severity— Low Policy Type— Config Policy Subtype— Build |
GCP Cloud Function configured with overly permissive Ingress setting 24.6.2 | This policy checks whether GCP Cloud Functions are configured with overly permissive Ingress settings. Overly permissive Ingress settings allow all inbound requests to the function, both from the public and from resources within the same project. It is recommended to restrict the traffic to improve network-based access control, allowing traffic only from VPC networks within the same project or through the Cloud Load Balancer. Policy Severity— Low Policy Type— Config Policy Subtype— Run, Build |
GKE NodePool configuration managed at cluster level 24.6.2 | This policy checks whether Google Kubernetes Engine (GKE) clusters uses NodePools within their configuration. The reason for this check is that using NodePools in the cluster configuration can unnecessarily complicate cluster management. When NodePools are used at the cluster level, modifying the node configuration creates a new NodePool, increasing operational complexity. Additionally, failing to delete older NodePools after creating new ones can lead to excess resource consumption. It is recommended to manage node configurations separately from the cluster to prevent these issues. Policy Severity— Low Policy Type— Config Policy Subtype— Build |
Hugging Face token detected in code 24.6.2 | A Hugging Face Token is used to access Hugging Face’s API for machine learning services, including models, and datasets. This token verifies identity and grants API access, ensuring a secure connection between your application and Hugging Face’s services. Regular management of tokens is crucial for maintaining security, ensuring data privacy and integrity, and preventing unauthorized access. Policy Severity— Medium Policy Type— Config Policy Subtype— Build |
Microsoft Teams webhook detected in code 24.6.2 | Webhooks and connectors facilitate the connection of web services to channels and teams in Microsoft Teams. Webhooks are user-defined HTTP callbacks that notify users about any action that has occurred in the MS Teams channel. Regularly reviewing and managing webhooks and their usage within your Teams setup is vital for ongoing security. Policy Severity— Low Policy Type— Config Policy Subtype— Build |
Terraform module sources do not use a git url with a commit hash revision 24.6.2 | Terraform modules are a collection of multiple resource configuration to offer an easy way of repeatable and reusable code logic. The most common way is to consume them through the public Terraform registry, which are connected to a VCS, like GitHub. This approach is problematic, because the module versions are not immutable and the module can be changed without changing the version, which makes the code vulnerable to a Supply Chain Attack. Therefore it is recommended to leverage Git URLs with a commit hash revision to guarantee immutability and consistency. Policy Severity— Medium Policy Type— Config Policy Subtype— Build |
Terraform module sources do not use a git url with a tag or commit hash revision 24.6.2 | Terraform modules are a collection of multiple resource configuration to offer an easy way of repeatable and reusable code logic. The most common way is to consume them through the public Terraform registry, which are connected to a VCS, like GitHub. This approach is problematic, because the module versions are not immutable and the module can be changed without changing the version, which makes the code vulnerable to a Supply Chain Attack. Therefore it is recommended to leverage Git URLs with a commit hash revision to guarantee immutability and consistency. Git tags can be used as well, but are not as immutable as a hash and therefore acceptable, but less preferred. This policy is a less restrictive version of the Terraform module sources do not use a git url with a commit hash revision policy that only allows for hashes. Policy Severity— High Policy Type— Config Policy Subtype— Build |
AWS Secret Manager secret not used for more than 90 days 24.6.1 | This policy identifies the AWS Secret Manager secret not accessed within 90 days. AWS Secret Manager securely stores and manages sensitive information like API keys, passwords, and certificates. Leaving unused secrets in AWS Secret Manager increases the risk of security breaches by providing unnecessary access points for attackers, potentially leading to unauthorized data access or leaks. It is recommended to routinely review and delete unused secrets to limit the attack surface and risk of unauthorized access. Policy Severity— Informational Policy Type— Config |
AWS Aurora MySQL DB cluster does not publish audit logs to CloudWatch Logs 24.6.1 | This policy identifies AWS Aurora MySQL DB cluster where audit logging is disabled or audit logs are not published to Amazon CloudWatch Logs. Aurora MySQL DB cluster integrates with Amazon CloudWatch for performance metrics gathering and analysis, supporting CloudWatch Alarms. While the Aurora MySQL DB cluster provides customizable audit logs for monitoring database operations, these logs are not automatically sent to CloudWatch Logs, limiting centralized monitoring and analysis of database activities. It is recommended to configure the Aurora MySQL DB cluster to enable audit logs and their publishing to CloudWatch. Policy Severity— Informational Policy Type— Config |
AWS AppSync GraphQL API is authenticated with API key 24.6.1 | This policy identifies the AWS AppSync Graphql API using the API key for primary or additional authentication methods. AWS AppSync GraphQL API is a fully managed service by Amazon Web Services for building scalable and secure GraphQL APIs. An API key is a hard-coded value in your application generated by the AWS AppSync service when you create an unauthenticated GraphQL endpoint. Using API keys for authentication can pose security risks such as exposure to unauthorized access and limited control over access privileges, potentially compromising sensitive data and system integrity. It is recommended to use authentication methods other than API Keys like IAM, Amazon Cognito User Pools, or OpenID Connect providers for securing AWS AppSync GraphQL APIs, to ensure enhanced security and access control. Policy Severity— Informational Policy Type— Config |
AWS Network Firewall is not configured with logging configuration 24.6.1 | This policy identifies an AWS Network Firewall where logging is not configured. AWS Network Firewall manages inbound and outbound traffic for the AWS resources within the AWS environment. Logging configuration for the network firewall involves enabling logging of network traffic, including allowed and denied requests, to provide visibility into network activity. Failure to configure logging results in a lack of visibility into potential security threats, making it difficult to detect and respond to malicious activity effectively and hindering threat detection and compliance. It is recommended to enable logging to ensure comprehensive monitoring, threat detection, compliance adherence, and effective incident response. Policy Severity— Informational Policy Type— Config |
AWS Security Hub is not enabled 24.6.1 | This policy identifies the AWS Security Hub that is not enabled in specific regions. AWS Security Hub is a centralized security management service by Amazon Web Services, providing a comprehensive view of your security posture and automating security checks across AWS accounts. Failure to enable AWS Security Hub in all regions may lead to limited visibility and compromised threat detection across your AWS environment. It is recommended to enable AWS Security Hub in all regions for consistent visibility and enhanced threat detection across your AWS environment. Policy Severity— Informational Policy Type— Config |
AWS ECS task definition logging configuration disabled 24.6.1 | This policy identifies AWS ECS task definitions that have logging configuration disabled. AWS ECS logging involves capturing and storing container logs for monitoring, troubleshooting, and analysis purposes within the Amazon ECS environment. Collecting data from task definitions gives visibility, which can aid in debugging processes and determining the source of issues. It is recommended to configure logging for an AWS ECS task definition. Policy Severity— Informational Policy Type— Config |
AWS EC2 Client VPN endpoints client connection logging disabled 24.6.1 | This policy identifies AWS EC2 client VPN endpoints with client connection logging disabled. AWS Client VPN endpoints enable remote clients to securely connect to resources in the Virtual Private Cloud (VPC). Connection logs enable you to track user behaviour on the VPN endpoint and gain visibility. It is recommended to enable connection logging for AWS EC2 client VPN endpoints. Policy Severity— Low Policy Type— Config |
AWS EventBridge event bus with no resource-based policy attached 24.6.1 | This policy identifies AWS EventBridge event buses with no resource-based policy attached. AWS EventBridge is a serverless event bus service that enables businesses to quickly and easily integrate applications, services, and data across multiple cloud environments. By default, an EventBridge custom event bus lacks a resource-based policy associated with it, which allows principals in the account to access the event bus. It is recommended to attach a resource based policy to the event bus to limit access scope to fewer entities. Policy Severity— Informational Policy Type— Config |
AWS WAF Rule Group CloudWatch metrics disabled 24.6.1 | This policy identifies the AWS WAF Rule Group having CloudWatch metrics disabled. AWS WAF rule groups have CloudWatch metrics that provide information about the number of allowed and blocked web requests, counted requests, and requests that pass through without matching any rule in the rule group. These metrics can be used to monitor and analyse the performance of the web access control list (web ACL) and its associated rules. It is recommended to enable CloudWatch metrics for a WAF rule group to help in monitoring and analysis of web requests. Policy Severity— Informational Policy Type— Config |
AWS Step Function state machines logging disabled 24.6.1 | This policy identifies AWS Step Function state machines with logging disabled. AWS Step Functions uses state machines to define and execute workflows that coordinate the components of distributed applications and microservices. Step Functions logs state machine executions to Amazon CloudWatch Logs for debugging and monitoring purposes. It is recommended to enable logging on the Step Function state machine to maintain reliability, availability, and performance. Policy Severity— Informational Policy Type— Config |
Azure Application Insights configured with overly permissive network access 24.6.1 | This policy identifies Application Insights configured with overly permissive network access. Virtual network access configuration in Application Insights allows you to restrict data ingestion and queries coming from the public networks. It is recommended to configure the Application Insight with virtual networks access configuration set to restrict; so that the Application Insight is accessible only to restricted Azure Monitor private link scopes. Policy Severity— Medium Policy Type— Config |
Azure Application Insights not configured with Azure Active Directory (Azure AD) authentication 24.6.1 | This policy identifies Application Insights that are not configured with Azure Active Directory (AAD) authentication and are enabled with local authentication. Disabling local authentication and using AAD-based authentication enhances the security and reliability of the telemetry used to make both critical operational and business decisions. It is recommended to configure the Application Insights with Azure Active Directory (AAD) authentication so that all actions are strongly authenticated. Policy Severity— Medium Policy Type— Config |
Azure Log Analytics configured with overly permissive network access 24.6.1 | This policy identifies Log Analytics configured with overly permissive network access. Virtual network access configuration in Log Analytics allows you to restrict data ingestion and queries coming from the public networks. It is recommended to configure the Log Analytics with virtual networks access configuration set to restrict; so that the Log Analytics is accessible only to restricted Azure Monitor private link scopes. Policy Severity— Medium Policy Type— Config |
Azure storage account infrastructure encryption is disabled 24.6.1 | The policy identifies Azure storage accounts for which infrastructure encryption is disabled. Infrastructure double encryption adds a second layer of encryption using service-managed keys. When infrastructure encryption is enabled for a storage account or an encryption scope, data is encrypted twice. Once at the service level and once at the infrastructure level - with two different encryption algorithms and two different keys. Infrastructure encryption is recommended for scenarios where double encrypted data is necessary for compliance requirements. It is recommended to enable infrastructure encryption on Azure storage accounts so that encryption can be implemented at the layer closest to the storage device or network wires. Policy Severity— Informational Policy Type— Config |
Azure Activity log alert for Create or update public IP address rule does not exist 24.6.1 | The policy identifies Azure storage accounts for which infrastructure encryption is disabled. Infrastructure double encryption adds a second layer of encryption using service-managed keys. When infrastructure encryption is enabled for a storage account or an encryption scope, data is encrypted twice. Once at the service level and once at the infrastructure level - with two different encryption algorithms and two different keys. Infrastructure encryption is recommended for scenarios where double encrypted data is necessary for compliance requirements. It is recommended to enable infrastructure encryption on Azure storage accounts so that encryption can be implemented at the layer closest to the storage device or network wires. Policy Severity— Informational Policy Type— Config |
Azure Activity log alert for Delete public IP address rule does not exist 24.6.1 | This policy identifies the Azure accounts in which activity log alert for Delete public IP address rule does not exist. Creating an activity log alert for Delete public IP address rule gives insight into network rule access changes and may reduce the time it takes to detect suspicious activity. By enabling this monitoring, you get alerts whenever any deletions are made to public IP addresses rules. As a best practice, it is recommended to have an activity log alert for Delete public IP address rule to enhance network security monitoring and detect suspicious activities. Policy Severity— Informational Policy Type— Config |
GCP Vertex AI Workbench user-managed notebook auto-upgrade is disabled 24.6.1 | This policy identifies GCP Vertex AI Workbench user-managed notebooks that have auto-upgrade disabled. Auto-upgrading Google Cloud Vertex environments ensures timely security updates, bug fixes, and compatibility with APIs and libraries. It reduces security risks associated with outdated software, enhances stability, and enables access to new features and optimizations. It is recommended to enable auto-upgrade to minimize maintenance overhead and mitigate security risks. Policy Severity— Informational Policy Type— Config |
GCP Vertex AI Workbench user-managed notebook has vTPM disabled 24.6.1 | This policy identifies GCP Vertex AI Workbench user-managed notebooks that have Virtual Trusted Platform Module (vTPM) feature disabled. Virtual Trusted Platform Module (vTPM) validates guest VM pre-boot and boot integrity and offers key generation and protection. The vTPM’s root keys and the keys it generates can’t leave the vTPM, thus gaining enhanced protection from compromised operating systems or highly privileged project admins. It is recommended to enable virtual TPM device on supported virtual machines to facilitate measured Boot and other OS security features that require a TPM. Policy Severity— Low Policy Type— Config |
GCP Vertex AI Workbench user-managed notebook’s JupyterLab interface access mode is set to single user 24.6.1 | This policy identifies GCP Vertex AI Workbench user-managed notebooks with JupyterLab interface access mode set to single user. Vertex AI Workbench user-managed notebook can be accessed using the web-based JupyterLab interface. Access mode controls the control access to this interface. Allowing access to only a single user could limit collaboration, increase chances of credential sharing, and hinder security audits and reviews of the resource. It is recommended to avoid single user access and make use of the service account access mode for user-managed notebooks. Policy Severity— Informational Policy Type— Config |
GCP Vertex AI Workbench user-managed notebook has Integrity monitoring disabled 24.6.1 | This policy identifies GCP Vertex AI Workbench user-managed notebooks that have Integrity monitoring disabled. Integrity Monitoring continuously monitors the boot integrity, kernel integrity, and persistent data integrity of the underlying VM of the shielded user-managed notebooks. It detects unauthorized modifications or tampering, enhancing security by verifying the trusted state of VM components throughout their lifecycle. It provides active alerting allowing administrators to respond to integrity failures and prevent compromised nodes from being deployed into the cluster. It is recommended to enable integrity monitoring for user-managed notebooks to detect and mitigate advanced threats like rootkits and bootkit malware. Policy Severity— Low Policy Type— Config |
GCP Cloud Run service revision is using default service account with editor role 24.6.1 | This policy identifies GCP Cloud Run service revisions that are utilizing the default service account with the editor role. GCP Compute Engine Default service account is automatically created upon enabling the Compute Engine API. This service account is granted the IAM basic Editor role by default, unless explicitly disabled. Assigning default service account with the editor role to cloud run revisions could lead to privilege escalation. Granting minimal access rights helps in promoting a better security posture. Following the principle of least privileges, it is recommended to avoid assigning default service account with the editor role to cloud run revision. Policy Severity— Medium Policy Type— Config |
OCI Cloud Guard is not enabled in the root compartment of the tenancy 24.6.1 | This policy identifies the absence of OCI Cloud Guard enablement in the root compartment of the tenancy. OCI Cloud Guard is a vital service that detects misconfigured resources and insecure activities within an OCI tenancy. It offers security administrators visibility to identify and resolve these issues promptly. Cloud Guard not only detects but also suggests, assists, or takes corrective actions to mitigate security risks. By enabling Cloud Guard in the root compartment of the tenancy with default configuration, activity detectors, and responders, administrators can proactively monitor and secure their OCI resources against potential security threats. As best practice, it is recommended to have Cloud Guard enabled in the root compartment of your tenancy. Policy Severity— Informational Policy Type— Config |
OCI boot volume is not encrypted with Customer Managed Key (CMK) 24.6.1 | This policy identifies OCI boot volumes that are not encrypted with a Customer Managed Key (CMK). Encrypting boot volumes with a CMK enhances data security by providing an additional layer of protection. Effective management of encryption keys is crucial for safeguarding and accessing sensitive data. Customers should review boot volumes encrypted with Oracle service managed keys to determine if they prefer managing keys for specific volumes and implement their own key lifecycle management accordingly. As best practice, it is recommended to encrypt OCI boot volumes using a Customer Managed Key (CMK) to strengthen data security measures. Policy Severity— Informational Policy Type— Config |
| Policy Name | Description | RQL | Cloud | Policy Severity |
| AWS Compute Instance (EC2/Lambda) Assigned CloudFormation Creation Permissions Which Could Lead to Privilege Escalation | An adversary able to create CloudFormation stacks with any role would be able to escalate their permissions by attaching a privileged role to the stack while influencing the actions taken by the created resources. As such, they would obtain the ability to perform actions using the permissions of the attached role, allowing further enumeration and exploitation of the environment. | | AWS | High |
| AWS Compute Instance (EC2/Lambda) Assigned Permissions to Run EC2 Instances Which Could Lead to Privilege Escalation | An adversary able to run EC2 instances with any role would be able to escalate their permissions by attaching a privileged role to the instance. As such, they would obtain the permissions of the role attached to the EC2, allowing further enumeration and exploitation of the environment. | | AWS | High |
| AWS Compute Instance (EC2/Lambda) Assigned Lambda Creation Permissions Which Could Lead to Privilege Escalation | An adversary able to create a Lambda Function with any role and give themselves the permissions to invoke it would be able to escalate their permissions by attaching a privileged role to the function while defining the Lambda’s actions. As such, they would obtain the ability to perform actions using the permissions of the attached role, allowing further enumeration and exploitation of the environment. | | AWS | High |
| AWS Compute Instance (EC2/Lambda) Assigned IAM Policy Management Permissions Which Could Lead to Privilege Escalation | An adversary able to influence or change IAM policies could grant themselves extensive permissions using the policies. As such, they would obtain the ability to perform actions allowed by the policies, allowing further enumeration and exploitation of the environment. | | AWS | High |
| AWS Compute Instance (EC2/Lambda) Assigned Glue DevEndpoint Creation Permissions Which Could Lead to Privilege Escalation | An adversary able to create a Glue DevEndpoint with any role would be able to escalate their permissions by attaching a privileged role to the endpoint and configuring authentication to the endpoint using a key which they control. As such, they would obtain the ability to perform actions using the permissions of the attached role, allowing further enumeration and exploitation of the environment. | | AWS | High |
| AWS Compute Instance (EC2/Lambda) Assigned Glue DevEndpoint Creation Permissions Which Could Lead to Privilege Escalation | An adversary able to create a Glue DevEndpoint with any role would be able to escalate their permissions by attaching a privileged role to the endpoint and configuring authentication to the endpoint using a key which they control. As such, they would obtain the ability to perform actions using the permissions of the attached role, allowing further enumeration and exploitation of the environment. | | AWS | High |
| Azure Compute Resource Assigned Role & Role Assignment Related Permissions Which Could Lead to Privilege Escalation | An adversary able to edit role assignments or role definitions could grant themselves additional roles, or grant additional permissions to roles they already have access to, escalating their privileges within the environment. This would allow them to further enumerate and exploit the environment. | | Azure | High |
| Azure Compute Resource Assigned Managed Identity Assignment Permissions Which Could Lead to Privilege Escalation | An adversary able to assign managed identities could assign them to themselves, obtaining the additional permissions granted to the managed identity, escalating their privileges within the environment. This would allow them to further enumerate and exploit the environment. | | Azure | High |
| AWS Role With Administrative Permissions Can Be Assumed By All Users | A globally assumable role with administartive permissions could allow an adversary to assume it (regardless of their original role as the target role is globally assumable) and utilize its administrative permissions to further compromise the environment. | | AWS | High |
| GCP Compute Instance (VM/Cloud Function) Assigned Cloud Function Creation Permissions Which Could Lead to Privilege Escalation | An adversary able to create Cloud Function instances with Service Account impersonation privileges would be able to escalate their permissions creating an instance which performs attacker controlled actions using the permissions of an impersonated Service Account. This would allow them to further enumerate and exploit the environment. | | GCP | High |
| GCP Compute Instance (VM/Cloud Function) Assigned Cloud Run Creation Permissions Which Could Lead to Privilege Escalation | An adversary able to create Cloud Run instances with Service Account impersonation privileges would be able to escalate their permissions creating an instance which performs attacker controlled actions using the permissions of an impersonated Service Account. This would allow them to further enumerate and exploit the environment. | | GCP | High |
| GCP Compute Instance (VM/Cloud Function) Assigned Cloud Function IAM Policy Edit Permissions Which Could Lead to Privilege Escalation | An adversary able to edit the IAM policy for Cloud Function instances, in conjunction with Service Account impersonation privileges would be able to escalate their permissions by adding edit permissions to an instance, causing it to perform attacker controlled actions using the permissions of an impersonated Service Account. This would allow them to further enumerate and exploit the environment. | | GCP | High |
| GCP Compute Instance (VM/Cloud Function) Assigned Cloud Run IAM Policy Edit Permissions Which Could Lead to Privilege Escalation | An adversary able to edit the IAM policy for Cloud Run instances, in conjunction with Service Account impersonation privileges would be able to escalate their permissions by adding edit permissions to an instance, causing it to perform attacker controlled actions using the permissions of an impersonated Service Account. This would allow them to further enumerate and exploit the environment. | | GCP | High |
| GCP Compute Instance (VM/Cloud Function) Assigned Cloud Run Jobs IAM Policy Edit Permissions Which Could Lead to Privilege Escalation | An adversary able to edit the IAM policy for Cloud Run Jobs, in conjunction with Service Account impersonation privileges would be able to escalate their permissions by adding edit permissions to an instance, causing it to perform attacker controlled actions using the permissions of an impersonated Service Account. This would allow them to further enumerate and exploit the environment. | | GCP | High |
| GCP Compute Instance (VM/Cloud Function) Assigned IAM Role Update Permissions Which Could Lead to Privilege Escalation | An adversary able to retrieve and edit IAM roles could grant themselves additional permissions within the environment, escalating their privileges. This would allow them to further enumerate and exploit the environment. | | GCP | High |
| GCP Compute Instance (VM/Cloud Function) Assigned Permissions to Retrieve Service Account Tokens Which Could Lead to Privilege Escalation | An adversary able to retrieve Service Account tokens could authenticate as high-privileged Service Accounts, escalating their original privileges. This would allow them to further enumerate and exploit the environment. | | GCP | High |
| GCP Compute Instance (VM/Cloud Function) Assigned Permissions to Edit IAM Policy for Service Accounts Which Could Lead to Privilege Escalation | An adversary able to edit Service Accounts' IAM Policies could grant themselves additional permissions within the environment, escalating their privileges. This would allow them to further enumerate and exploit the environment. | | GCP | High |
| GCP Compute Instance (VM/Cloud Function) Assigned Resource Manager Permissions Which Could Lead to Privilege Escalation | An adversary able to edit IAM Policies at the organization, folder or project levels could grant themselves additional permissions within the environment, escalating their privileges. This would allow them to further enumerate and exploit the environment. | | GCP | High |
| GCP Cloud Run Instance Assigned Cloud Function Creation Permissions Which Could Lead to Privilege Escalation | An adversary able to create Cloud Function instances with Service Account impersonation privileges would be able to escalate their permissions creating an instance which performs attacker controlled actions using the permissions of an impersonated Service Account. This would allow them to further enumerate and exploit the environment. | | GCP | High |
| GCP Cloud Run Instance Assigned Cloud Run Creation Which Could Lead to Privilege Escalation | An adversary able to create Cloud Run instances with Service Account impersonation privileges would be able to escalate their permissions creating an instance which performs attacker controlled actions using the permissions of an impersonated Service Account. This would allow them to further enumerate and exploit the environment. | | GCP | High |
| GCP Cloud Run Instance Assigned Cloud Function IAM Policy Edit Permissions Which Could Lead to Privilege Escalation | An adversary able to edit the IAM policy for Cloud Function instances, in conjunction with Service Account impersonation privileges would be able to escalate their permissions by adding edit permissions to an instance, causing it to perform attacker controlled actions using the permissions of an impersonated Service Account. This would allow them to further enumerate and exploit the environment. | | GCP | High |
| GCP Cloud Run Instance Assigned Cloud Run IAM Policy Edit Permissions Which Could Lead to Privilege Escalation | An adversary able to edit the IAM policy for Cloud Run instances, in conjunction with Service Account impersonation privileges would be able to escalate their permissions by adding edit permissions to an instance, causing it to perform attacker controlled actions using the permissions of an impersonated Service Account. This would allow them to further enumerate and exploit the environment. | | GCP | High |
| GCP Cloud Run Instance Assigned Cloud Run Jobs IAM Policy Edit Permissions Which Could Lead to Privilege Escalation | An adversary able to edit the IAM policy for Cloud Run Jobs, in conjunction with Service Account impersonation privileges would be able to escalate their permissions by adding edit permissions to an instance, causing it to perform attacker controlled actions using the permissions of an impersonated Service Account. This would allow them to further enumerate and exploit the environment. | | GCP | High |
| GCP Cloud Run Instance Assigned IAM Role Update Permissions Which Could Lead to Privilege Escalation | An adversary able to retrieve and edit IAM roles could grant themselves additional permissions within the environment, escalating their privileges. This would allow them to further enumerate and exploit the environment. | | GCP | High |
| GCP Cloud Run Instance Assigned Permissions to Retrieve Service Account Tokens Which Could Lead to Privilege Escalation | An adversary able to retrieve Service Account tokens could authenticate as high-privileged Service Accounts, escalating their original privileges. This would allow them to further enumerate and exploit the environment. | | GCP | High |
| GCP Cloud Run Instance Assigned Permissions to Edit IAM Policy for Service Accounts Which Could Lead to Privilege Escalation | An adversary able to edit Service Accounts' IAM Policies could grant themselves additional permissions within the environment, escalating their privileges. This would allow them to further enumerate and exploit the environment. | | GCP | High |
| GCP Cloud Run Instance Assigned Resource Manager Permissions Which Could Lead to Privilege Escalation | An adversary able to edit IAM Policies at the organization, folder or project levels could grant themselves additional permissions within the environment, escalating their privileges. This would allow them to further enumerate and exploit the environment. | | GCP | High |
| GCP App Engine Web Service Assigned Cloud Function Creation Permissions Which Could Lead to Privilege Escalation | An attacker who successfully exploits a vulnerability or misconfiguration in the web service can leverage the permissions associated with the App Engine service. By creating Cloud Function instances with service account impersonation privileges, the attacker can escalate their permissions. This enables the creation of instances that perform actions under the guise of the impersonated service account, further allowing the attacker to enumerate and exploit the environment. | | GCP | High |
| GCP App Engine Web Service Assigned Cloud Run Creation Which Could Lead to Privilege Escalation | An attacker who successfully exploits a vulnerability or misconfiguration in the web service can leverage the permissions associated with the App Engine service. By creating Cloud Run instances with Service Account impersonation privileges they would be able to escalate their permissions creating an instance which performs attacker controlled actions using the permissions of an impersonated Service Account. This would allow them to further enumerate and exploit the environment. | | GCP | High |
| GCP App Engine Web Service Assigned Cloud Function IAM Policy Edit Permissions Which Could Lead to Privilege Escalation | An attacker who successfully exploits a vulnerability or misconfiguration in the web service can leverage the permissions associated with the App Engine service. By editing the IAM policy for Cloud Function instances, in conjunction with Service Account impersonation privileges they would be able to escalate their permissions by adding edit permissions to an instance, causing it to perform attacker controlled actions using the permissions of an impersonated Service Account. This would allow them to further enumerate and exploit the environment. | | GCP | High |
| GCP App Engine Web Service Assigned Cloud Run IAM Policy Edit Permissions Which Could Lead to Privilege Escalation | An attacker who successfully exploits a vulnerability or misconfiguration in the web service can leverage the permissions associated with the App Engine service. By editing the IAM policy for Cloud Run instances, in conjunction with Service Account impersonation privileges they would be able to escalate their permissions by adding edit permissions to an instance, causing it to perform attacker controlled actions using the permissions of an impersonated Service Account. This would allow them to further enumerate and exploit the environment. | | GCP | High |
| GCP App Engine Web Service Assigned Cloud Run Jobs IAM Policy Edit Permissions Which Could Lead to Privilege Escalation | An attacker who successfully exploits a vulnerability or misconfiguration in the web service can leverage the permissions associated with the App Engine service. By editing the IAM policy for Cloud Run Jobs, in conjunction with Service Account impersonation privileges they will be able to escalate their permissions by adding edit permissions to an instance, causing it to perform attacker controlled actions using the permissions of an impersonated Service Account. This would allow them to further enumerate and exploit the environment. | | GCP | High |
| GCP App Engine Web Service Assigned IAM Role Update Permissions Which Could Lead to Privilege Escalation | An attacker who successfully exploits a vulnerability or misconfiguration in the web service can leverage the permissions associated with the App Engine service. With the ability to retrieve and edit IAM roles could grant themselves additional permissions within the environment, escalating their privileges. This would allow them to further enumerate and exploit the environment. | | GCP | High |
| GCP App Engine Web Service Assigned Permissions to Retrieve Service Account Tokens Which Could Lead to Privilege Escalation | An attacker who successfully exploits a vulnerability or misconfiguration in the web service can leverage the permissions associated with the App Engine service. With the ability to retrieve Service Account tokens could authenticate as high-privileged Service Accounts, escalating their original privileges. This would allow them to further enumerate and exploit the environment. | | GCP | High |
| GCP App Engine Web Service Assigned Permissions to Edit IAM Policy for Service Accounts Which Could Lead to Privilege Escalation | An attacker who successfully exploits a vulnerability or misconfiguration in the web service can leverage the permissions associated with the App Engine service. With the ability to edit Service Accounts' IAM Policies they could grant themselves additional permissions within the environment, escalating their privileges. This would allow them to further enumerate and exploit the environment. | | GCP | High |
| GCP App Engine Web Service Assigned Resource Manager Permissions Which Could Lead to Privilege Escalation | An attacker who successfully exploits a vulnerability or misconfiguration in the web service can leverage the permissions associated with the App Engine service. With the ability to edit IAM Policies at the organization, folder or project levels they can grant themselves additional permissions within the environment, escalating their privileges. This would allow them to further enumerate and exploit the environment. | | GCP | High |
| Policies | Description |
| Policy Updates—RQL | |
Azure Function App doesn’t have a Managed Service Identity 24.6.2 | Changes— The policy RQL will be updated to exclude logic apps and web apps from reporting, focusing solely on Azure function apps within its scope. Severity— Low Policy Type— Config Current RQL— Updated RQL— Impact— Medium. Existing alerts generated for logicapp and webapps will be resolved as Policy_Updated. |
Azure Function app configured with public network access 24.6.2 | Changes— The policy RQL will be updated to exclude logic apps and web apps from reporting, focusing solely on Azure function apps within its scope. Severity— Medium Policy Type— Config Current RQL— Updated RQL— Impact— Medium. Existing alerts generated for logicapp and webapps will be resolved as Policy_Updated. |
Azure Function App doesn’t use latest TLS version 24.6.2 | Changes— The policy RQL will be updated to exclude logic apps and web apps from reporting, focusing solely on Azure function apps within its scope. Severity— Low Policy Type— Config Current RQL— Updated RQL— Impact— Medium. Existing alerts generated for logicapp and webapps will be resolved as Policy_Updated. |
Azure Function App doesn’t use HTTP 2.0 24.6.2 | Changes— The policy RQL will be updated to exclude logic apps and web apps from reporting, focusing solely on Azure function apps within its scope. Severity— Informational Policy Type— Config Current RQL— Updated RQL— Impact— Medium. Existing alerts generated for logicapp and webapps will be resolved as Policy_Updated. |
Azure Function App doesn’t redirect HTTP to HTTPS 24.6.2 | Changes— The policy RQL will be updated to exclude logic apps and web apps from reporting, focusing solely on Azure function apps within its scope. Severity— Medium Policy Type— Config Current RQL— Updated RQL— Impact— Medium. Existing alerts generated for logicapp and webapps will be resolved as Policy_Updated. |
Azure Function App client certificate is disabled 24.6.2 | Changes— The policy RQL will be updated to exclude logic apps and web apps from reporting, focusing solely on Azure function apps within its scope. Severity— Informational Policy Type— Config Current RQL— Updated RQL— Impact— Medium. Existing alerts generated for logicapp and webapps will be resolved as Policy_Updated. |
| Policy Deletions | |
AWS role having iam:PassRole and lambda:InvokeFunction permissions attached to EC2 instance [Beta] 24.6.2 | Changes— This policy is deleted because it is replaced by the following policy: AWS role having iam:PassRole and lambda:InvokeFunction permissions attached to EC2 instance |
EC2 with IAM role attached has iam:PassRole and ec2:RunInstances permissions [Beta] 24.6.2 | Changes— This policy is deleted because it is replaced by the following policy: EC2 with IAM role attached has iam:PassRole and ec2:Run Instances permissions |
Policy Mapping Update for CIS AWS v2.0
24.6.2
|New Policy mappings are added to CIS v2.0.0 (AWS) - Level 1 compliance standard.
Impact— No impact on existing alerts. The compliance score may vary because a new mapping has been added.
| |Policy Mapping Update for CIS GCP v2.0
24.6.2
|New Policy mappings are added to CIS v2.0.0 (GCP) Level 1 and CIS v2.0.0 (GCP) Level 2 compliance standards.
Impact— No impact on existing alerts. The compliance score may vary because a new mapping has been added.
| |Policy Mapping Update for ISO/IEC 27001:2022
24.6.2
|New Policy mappings are added to ISO/IEC 27001:2022 compliance standard.
Impact— No impact on existing alerts. The compliance score may vary because a new mapping has been added.
| |Support for CIS GKE v1.5
24.6.1
|Prisma Cloud now supports CIS GKE version 1.5. The latest version has new controls and new Prisma cloud policies are mapped to the controls increasing the overall coverage.
You can view this built-in standard and the associated policies on Compliance > Standards. Generate reports for immediate viewing or download, or schedule recurring reports to track this compliance standard over time.
| |Support for CIS OCI v2.0
24.6.1
|Prisma Cloud now supports CIS OCI version 2.0. The latest version has new controls and new Prisma cloud policies are mapped to the controls increasing the overall coverage.
You can view this built-in standard and the associated policies on Compliance > Standards. Generate reports for immediate viewing or download, or schedule recurring reports to track this compliance standard over time.
| |Support for CIS Azure Foundation benchmark v2.1
24.6.1
|Prisma Cloud now supports CIS Azure Foundation benchmark version 2.1. The latest version has new controls and new Prisma cloud policies are mapped to the controls increasing the overall coverage.
You can view this built-in standard and the associated policies on Compliance > Standards. Generate reports for immediate viewing or download, or schedule recurring reports to track this compliance standard over time.
| |Support for CIS AWS Foundation benchmark 3.0
24.6.1
|Prisma Cloud now supports CIS AWS Foundation Benchmark version 3.0. This latest version has new controls and new Prisma cloud policies are mapped to the controls increasing the overall coverage.
You can now view this built-in standard and the associated policies on the Compliance > Standards page. Generate reports for immediate viewing or download, or schedule recurring reports to track this compliance standard over time.
| ## Changes in Existing Behavior | **Feature** | **Description** | | ------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | |API Rate Limits
24.6.1
| Prisma Cloud uses API [rate limits](https://pan.dev/prisma-cloud/api/cspm/rate-limits/) at the endpoint level to protect the performance and availability of its services. Rate limits will be applied to the additional APIs listed below. | | **Endpoint** | **Rate Limit (tps)** | **Burst Rate (tps)** | | --------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------- | -------------------- | | **Resource Lists** | | | | Get Resource Lists - [GET /v1/resource\_list](https://pan.dev/prisma-cloud/api/cspm/get-all-resource-list-for-customer/) | 80 | 80 | | Get Resource List by ID - [GET /v1/resource\_list/#id](https://pan.dev/prisma-cloud/api/cspm/get-resource-list-by-id/) | 4 | 4 | | Get Resource List Types - [GET /v1/resource\_list/types](https://pan.dev/prisma-cloud/api/cspm/get-resource-list-types/) | 4 | 4 | | Get Resource List Names - GET /v1/resource\_list/names | 80 | 80 | | **Account Groups** | | | | List Account Groups - [GET /cloud/group](https://pan.dev/prisma-cloud/api/cspm/get-account-groups/) | 32 | 32 | | Account Group Info - [GET /cloud/group/#id](https://pan.dev/prisma-cloud/api/cspm/get-account-group/) | 80 | 80 | | List Account Group Names - [GET /cloud/group/name](https://pan.dev/prisma-cloud/api/cspm/get-account-group-name/) | 32 | 32 | | List Account Group Names by Cloud Type - [GET cloud/group/name/#cloud\_type](https://pan.dev/prisma-cloud/api/cspm/get-account-group-name-by-cloud-type/) | 4 | 4 | | **Collections** | | | | Get All Collections - [GET /entitlement/api/v1/collection](https://pan.dev/prisma-cloud/api/cspm/get-all-collections/) | 4 | 4 | | Get Collection by ID - [GET /entitlement/api/v1/collection/#id](https://pan.dev/prisma-cloud/api/cspm/get-collection-by-id/) | 8 | 8 | ## REST API Updates | **Change** | **Description** | | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | |Vulnerabilities Dashboard APIs
Secure the Infrastructure
24.6.2
|The Vulnerabilities Dashboard endpoints now require specific access permissions to get the dashboard data and create remediation requests. For details on the required permissions, see the respective endpoint description.
Also, the Get Vulnerabilities by RQL endpoint will now contain the following new parameters in the response:
vulnerabilities - Total number of vulnerabilitiesassetCount - Total number of unique assetsCI/CD Risks API
Secure the Source
24.6.2
|The following new endpoints have been added to the API:
Technologies API
Secure the Source
24.6.2
|The following new endpoints have been added to the API:
| |Repositories API
Secure the Source
24.6.2
|The following new endpoint has been added to the API:
| |SBOM API
Secure the Source
24.6.2
|The following new endpoint has been added to the API:
Also, the existing Get BOM Report endpoint is listed under the new SBOM category now.
| |Update Alerts APIs
Secure the Infrastructure
24.6.1
| The [POST /alert/v1/policy](https://pan.dev/prisma-cloud/api/cspm/alert-policy-list/) and [POST /alert/v1/aggregate](https://pan.dev/prisma-cloud/api/cspm/alert-aggregation/) APIs have an additional `countDetails` parameter in the response that includes `totalAlerts` and `totalPolicies`. The `countDetails` parameter allows you to view the total number of alerts across the total number of policies on the **Alerts Overview** page. | |IAM APIs
Secure the Infrastructure
24.6.1
|Get least privilege access suggestions and resource metadata with the following new APIs:
Cloud Discovery and Exposure Management (CDEM) APIs
Secure the Infrastructure
24.6.1
|New Endpoints: The following endpoints are now available to fetch vulnerability details, distributions impacted by a vulnerability, and snooze patterns:
Updates to the existing Endpoints:
Introducing support to snooze or unsnooze a set of assets that match a regular expression by adding the regex parameter in the following endpoints:
You can now filter assets by the account mapping status, which indicates if the asset is associated with a parent account on Prisma Cloud. The accountMappingStatus parameter is now added to the request or response of the following endpoints:
Vulnerabilities Dashboard (UVE) APIs
Secure the Infrastructure
24.6.1
|New Endpoints: The following new versions of the existing endpoints are introduced to fetch additional details about the vulnerabilities:
Updates to the existing Endpoints:
The EPSS score and its details are added to the response to the following endpoints:
The atRisk and internetExposed parameters are added to the response of Get Vulnerable Assets by RQL.
Download the Software Bill of Materials (SBOM)
Secure the Runtime
32.06.132
|The following new API endpoints enable you to download the Software Bill of Materials (SBOM) details:
For more details on the SBOM feature, refer to the New Features section.
| |Remove hostname from registry progress response
Secure the Runtime
32.06.132
|The response of the View Registry Scan Progress API has the following changes:
The existing “discovery” and “imageScan” properties have been modified to:
Documentation update for Add Registry Settings
Secure the Runtime
32.06.132
|A new registry type - “Harbor” is added to the “version” field for the Add Registry Settings API.
This option enables you to configure a Harbor registry for scanning.
| |Component documentation for API address resolving method for cluster name
Secure the Runtime
32.06.132
|A new optional field clusterNameResolvingMethod is added to the following APIs:
The permissible values for this field are default, manual, and api-server.
| ## Deprecation Notices | **Change** | **Description** | | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | |End of support for Azure Data Lake Analytics and Azure Data Lake Storage Gen1 Services
24.6.1
|The following APIs are planned for deprecation because Azure has announced the retirement of Azure Data Lake Analytics and Azure Data Lake Storage Gen1 Services. Due to this, Prisma Cloud will no longer ingest metadata for the following APIs:
In RQL, the key will not be available in the api.name attribute auto-completion.
Impact— If you have a saved search or custom policies based on this API, you must delete those manually. The policy alerts will be resolved as Policy\_Deleted.
| --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.prismacloud.io/release-notes/prisma-cloud-release-information/features-introduced-in-2024/features-introduced-in-june-2024.md?ask=