Ctrlk
BlogSupport
For the complete documentation index, see llms.txt. This page is also available as Markdown.

Features Introduced in May 2024

Learn what’s new on Prisma® Cloud in May 2024.

New Features

Feature

Description

Visualize and Resolve Identity Based Threats

24.5.2

Secure the Infrastructure

The out-of-the-box (OOTB) dashboards now include the Identity dashboard to empower your teams to proactively detect and mitigate identity-based threats. This Dashboard provides in-depth visualizations to help you answer the following questions:

  • How do I get critical insights into user activity, permissions, and potential risks, enabling teams to prioritize vulnerabilities and take timely action?

  • What are my Top Identity and Access Management Risks relative to my cloud assets?

  • What are the risk categories that require my immediate attention?

  • How can I see key Identity and Access Management benchmarks that I can track and report to the rest of my team?

RQL Available to Investigate Over-Privileged Access

24.5.2

Secure the Infrastructure

The Permissions queries are enhanced to include a new grantedby.cloud.policy.isExcessive attribute to identify excessive access in IAM policies across your AWS, Azure, and GCP cloud environments.

Prisma Cloud Surfaces Third Party Vendor Account Information

24.5.2

Secure the Infrastructure

Enhancements to Prisma Cloud’s Search and Investigate functionality allow you to identify third-party vendors that may have access to service accounts and roles in your cloud environment. Explore and investigate third party vendor accounts in AWS with ease, leveraging account number to vendor matching look up. Use the RQL query examples to fine tune your search to surface vendor account information.

  • To retrieve all known vendor accounts that have access to your environment:

config from iam where source.cloud.account.isvendor = true

  • To retrieve all vendor accounts with environment access that start with Red:

config from iam where source.cloud.account STARTS WITH 'Red' and source.cloud.account.isvendor = true

Risk Factors to Prioritize Your Code-to-Cloud Security

24.5.2

Secure the Source

Prisma Cloud now includes Risk Factors (Indicators) that help you prioritize security vulnerabilities by identifying critical elements within your development environment. Risk Factors focus specifically on deployed container images and the runtime-connected repositories they rely on. This prioritization is crucial because external exposure can increase the risk of unauthorized access, data breaches, and exploitation of vulnerabilities.

Custom Fix PR Titles and Branch Names

24.5.2

Secure the Source

You can now customize your pull request titles and branch names for suggested fixes. This enables organizations to enforce a consistent naming convention, ensuring clear and contextual information about the purpose of the fix and makes it easier for team members to understand the changes being made.

Integration with Amazon Security Lake

24.5.1

Secure the Infrastructure

Integrate Prisma Cloud with Amazon Security Lake to help your security analysts protect their cloud workloads, applications, and data with greater visibility and context into cloud security issues.

Login Experience Enhancements

24.5.1

Secure the Infrastructure

Enhanced Prisma Cloud login experience provides support for all available authentication options (excluding IdP-initiated SAML SSO) including:

  • SSO Login page update to clearly identify OIDC SSO login and add provide support Palo Alto Networks SSO login.

  • Fixed an issue with deep link resolution. Accessing Prisma Cloud deep links without a valid browser session now redirects to the Prisma Cloud login page.

Enhanced Cloud Network Analyzer

24.5.1

Secure the Infrastructure

The Cloud Network Analyzer (CNA) includes the following enhancements:

  • Improved handling of internet exposure caused by assets deployed in VPCs that use public CIDR blocks.

  • AWS EC2 instance with unrestricted outbound access to internet policy now generates alerts when a device is configured as a NAT.

  • Support for Azure Service tags IP ranges in path exposure calculation.

  • Azure OOTB policy that detects inbound exposure now supports DestinationAddressPrefix analysis in Azure NSG.

Enhanced Vulnerability Assessment

24.5.1

Secure the Runtime

To enhance the accuracy of vulnerability assessments, Prisma Cloud has incorporated support for the 'Running On/With' configuration as outlined by NVD. This configuration, which integrates nodes based on both vulnerable and non-vulnerable criteria, requires specific conditions to be met, such as relevant packages or operating systems, for a vulnerability to be applicable. This enhancement allows Prisma Cloud to consider 'Running On/With' configurations that were not previously assessed. However, it is important to note that the impact of this enhancement is contingent on whether the CVE is assessed through NVD, as vulnerability information from the vendor feed is prioritized.

Serverless Defender support for Java 17 and 21

24.5.1

Secure the Runtime

Added support for deploying Serverless Defender on Java 17 and Java 21 runtimes.

Support for Blocking Kubernetes cri-o Containers

24.5.1

Secure the Runtime

For Kubernetes versions employing the latest versions of cri-o runtime, crun replaces runc for launching containers. To manage user-defined vulnerability and compliance blocking rules, however, Prisma Cloud uses, when such rules are present, a binary written in the Go language to proxy the crun runtime. This proxy blocks containers whenever vulnerabilities or compliance issues, as per user-defined rules, are detected. Prisma Cloud uses the original crun runtime for all other functionalities.

If you want to run containers with a minimal number of processes, you cannot set a low PIDs limit, because the Go binary generates multiple threads. The original crun runtime does not have this limitation, as it is written in C.

OS-specific Evaluation for Go Packages

24.5.1

Secure the Runtime

Prisma Cloud now evaluates operating system (OS) data for vulnerabilities detected in Go packages. This enhancement ensures that vulnerabilities are reported only if they meet the OS-specific criteria. For example, if vulnerabilities are detected in Go packages that are specific to Windows, they are reported only for Windows-based systems. They are not flagged for UNIX-based systems.

To view a detailed list of identified vulnerabilities, go to Monitor > Vulnerabilities > Vulnerability Explorer.

New Console Environment Variable for System Load Management

24.5.1

Secure the Runtime

A new Console environment variable, REFRESH_INTERVAL_SECONDS, has been added to prevent system overload issues when using the TAS applications with Defender.

Previously, Defender checked the state of TAS applications and containers every 10 seconds through an API call to the BBS server. However, frequent changes or restarts in applications within this duration could lead to system overload as Defender scanned all the apps that were impacted by the changes.

By setting a higher value for REFRESH_INTERVAL_SECONDS, users can now reduce system load by decreasing the scanning frequency. For example, if REFRESH_INTERVAL_SECONDS is set to 600 seconds, Defender checks for changes every 600 seconds, leading to a decrease in system load.

Restart Defender for the REFRESH_INTERVAL_SECONDS environment variable to take effect.

Support for Google Registry Scanning

24.5.1

Secure the Runtime

When onboarding GCP cloud accounts, Prisma Cloud now supports scanning of Google Container Registry (GCR) and Google Artifact Registry (GAR).

Cloud Account Management

24.5.1

Secure the Runtime

Introduced the Account Origin filter on the Cloud Accounts page in Runtime Security. This feature includes three statuses:

  • Compute: Cloud accounts created in Runtime Security only (and not in the Prisma Cloud console).

  • Prisma - Manually imported: Cloud accounts that were manually imported from Prisma Cloud console to Runtime Security prior to the Lagrange release (end of 2022).

  • Prisma - Auto imported: Cloud accounts that originated from Prisma Cloud console and seamlessly imported into Runtime Security.

API Ingestions

Service

API Details

AWS Network Firewall

24.5.2

aws-network-firewall-logging-configuration

Additional permissions required:

  • network-firewall:DescribeLoggingConfiguration

  • network-firewall:ListFirewalls

The Security Audit Policy role includes the permissions.

AWS Migration Hub

24.5.2

aws-migration-hub-home-region-control

Additional permission required:

  • mgh:DescribeHomeRegionControls

You must manually add the permission to the CFT template to enable it.

Azure App Service

24.5.2

azure-app-service-basic-publishing-credentials-policies

Additional permissions required:

  • Microsoft.Web/sites/Read

  • Microsoft.Web/sites/basicPublishingCredentialsPolicies/Read

The Reader role includes the permissions.

Azure Analysis Services

24.5.2

azure-analysisservices-servers-diagnostic-settings

Additional permissions required:

  • Microsoft.AnalysisServices/servers/read

  • Microsoft.Insights/DiagnosticSettings/Read

The Reader role includes the permissions.

Azure API Management Services

24.5.2

azure-api-management-service-diagnostic-settings

Additional permissions required:

  • Microsoft.ApiManagement/service/read

  • Microsoft.Insights/DiagnosticSettings/Read

The Reader role includes the permissions.

Azure App Service

24.5.2

azure-app-service-environment-diagnostic-settings

Additional permissions required:

  • Microsoft.Web/hostingEnvironments/Read

  • Microsoft.Insights/DiagnosticSettings/Read

The Reader role includes the permissions.

Azure Machine Learning

24.5.2

azure-machine-learning-compute

Additional permissions required:

  • Microsoft.MachineLearningServices/workspaces/read

  • Microsoft.MachineLearningServices/workspaces/computes/read

The Reader role includes the permissions.

Google Workspace

24.5.2

gcloud-domain-user-last-login-time

No additional permissions required for this API.

Google Dataproc Clusters

24.5.2

gcloud-dataproc-cluster-job

Additional permissions required:

  • dataproc.jobs.list

  • dataproc.jobs.getIamPolicy

The Viewer role includes the permissions.

Google Vertex AI AIPlatform

24.5.2

gcloud-vertex-ai-aiplatform-feature-online-store

Additional permission required:

  • aiplatform.featureOnlineStores.list

The Viewer role includes the permission.

Google Vertex AI AIPlatform

24.5.2

gcloud-vertex-ai-aiplatform-feature-group

Additional permission required:

  • aiplatform.featureGroups.list

The Viewer role includes the permission.

Google Cloud Support

24.5.2

gcloud-cloud-support-case

Additional permission required:

  • cloudsupport.techCases.list

The Viewer role includes the permission.

Amazon EC2

24.5.1

aws-ec2-vpc-ipam

Additional permission required:

  • ec2:DescribeIpams

The Security Audit role includes the permission.

Amazon FSx

24.5.1

aws-fsx-backup

Additional permission required:

  • fsx:DescribeBackups

The Security Audit role includes the permission.

AWS Network Manager

24.5.1

aws-network-manager-global-network

Additional permission required:

  • networkmanager:DescribeGlobalNetworks

The Security Audit role includes the permission.

AWS Network Manager

24.5.1

aws-network-manager-core-network

Additional permissions required:

  • networkmanager:GetCoreNetwork

  • networkmanager:ListCoreNetworks

You must manually add the above permissions to the CFT template to enable them.

Amazon SNS

24.5.1

aws-sns-data-protection-policy

Additional permissions required:

  • sns:ListTopics

  • sns:GetDataProtectionPolicy

The Security Audit role includes the sns:ListTopics permission. You must manually add the sns:GetDataProtectionPolicy permission to the CFT template to enable it.

Azure Cognitive Services

24.5.1

azure-cognitive-services-account-diagnostic-settings

Additional permissions required:

  • Microsoft.CognitiveServices/accounts/read

  • Microsoft.Insights/DiagnosticSettings/Read

The Reader role includes the permissions.

Azure Express Route

24.5.1

azure-express-route-circuit-diagnostic-settings

Additional permissions required:

  • Microsoft.Network/expressRouteCircuits/read

  • Microsoft.Insights/DiagnosticSettings/Read

The Reader role includes the permissions.

Azure Relay

24.5.1

azure-relay-namespaces

Additional permission required:

  • Microsoft.Relay/Namespaces/read

The Reader role includes the permission.

Azure Synapse Analytics

24.5.1

azure-synapse-workspace-diagnostic-settings

Additional permissions required:

  • Microsoft.Synapse/workspaces/read

  • Microsoft.Insights/DiagnosticSettings/Read

The Reader role includes the permissions.

Update Azure Cognitive Services

24.5.1

The Asset Type for azure-cognitive-search-service-diagnostic-settings API resources in the Inventory > Inventory Assets > Azure page is updated as follows:

  • Previous name— Azure Cognitive Services Account Diagnostic Settings

  • New name— Azure Cognitive Search Service Diagnostic Settings

Update Google AlloyDB for PostgreSQL Permissions

24.5.1

Prisma Cloud no longer needs access to alloydb.locations.list permission for the following APIs:

  • gcloud-alloydb-cluster

  • gcloud-alloydb-cluster-instance

  • gcloud-alloydb-cluster-user

  • gcloud-alloydb-backup

Update Google Dataplex Permissions

24.5.1

Prisma Cloud no longer needs access to dataplex.locations.list permission for the following APIs:

  • gcloud-dataplex-lake-zone-entity

  • gcloud-dataplex-lake-zone-asset-action

  • gcloud-dataplex-lake-zone-asset

  • gcloud-dataplex-lake-zone-action

  • gcloud-dataplex-lake-environment

  • gcloud-dataplex-lake-zone

  • gcloud-dataplex-lake-task

  • gcloud-dataplex-lake-contentitem

  • gcloud-dataplex-lake-action

  • gcloud-dataplex-lake

New Policies

Policies

Description

AWS OpenSearch domain does not have the latest service software version

24.5.2

This policy identifies Amazon OpenSearch Service domains that have service software updates available but not installed for the domain.

Amazon OpenSearch Service is a managed solution for deploying, managing, and scaling OpenSearch clusters. Service software updates deliver the most recent platform fixes, enhancements, and features for the environment, ensuring domain security and availability. To minimize service disruption, it’s advisable to schedule updates during periods of low domain traffic.

It is recommended to keep OpenSearch regularly updated to maintain system security, while also accessing the latest features and improvements.

Policy Severity— Informational

Policy Type— Config

AWS Neptune DB clusters have backup retention period less than 7 days

24.5.2

This policy identifies Amazon Neptune DB clusters lacking sufficient backup retention tenure.

AWS Neptune DB is a fully managed graph database service. The backup retention period denotes the duration for storing automated backups of the Neptune DB clusters. Inadequate retention periods heighten the risk of data loss, and compliance issues, and hinder effective recovery in security breaches or system failures.

It is recommended to ensure a backup retention period of at least 7 days or according to your business and compliance requirements.

Policy Severity— Informational

Policy Type— Config

AWS Neptune DB cluster does not publish audit logs to CloudWatch Logs

24.5.2

This policy identifies Amazon Neptune DB clusters where audit logging is disabled or audit logs are not published to Amazon CloudWatch Logs.

Neptune DB integrates with Amazon CloudWatch for performance metric gathering and analysis, supporting CloudWatch Alarms. While Neptune DB provides customizable audit logs for monitoring database operations, these logs are not automatically sent to CloudWatch Logs, limiting centralized monitoring and analysis of database activities.

It is recommended to configure the Neptune DB cluster to enable audit logs and publish audit logs to CloudWatch logs.

Policy Severity— Informational

Policy Type— Config

AWS DocumentDB cluster does not publish audit logs to CloudWatch Logs

24.5.2

This policy identifies Amazon DocumentDB cluster where audit logging is disabled or audit logs are not published to Amazon CloudWatch Logs.

DocumentDB integrates with Amazon CloudWatch for performance metric gathering and analysis, supporting CloudWatch Alarms. While DocumentDB provides customizable audit logs for monitoring database operations, these logs are not automatically sent to CloudWatch Logs, limiting centralized monitoring and analysis of database activities.

It is recommended to configure the DocumentDB cluster to enable audit logs and publish audit logs to CloudWatch logs.

Policy Severity— Informational

Policy Type— Config

AWS Network Firewall delete protection is disabled

24.5.2

This policy identifies the AWS Network Firewall for which delete protection is disabled. AWS Network Firewall manages inbound and outbound traffic for the AWS resources within Virtual Private Clouds (VPCs).

The deletion protection setting protects against accidental deletion of the firewall. Deletion of a firewall increases the risk of unauthorized access, data breaches, and compliance issues.

It is recommended to enable deletion protection for a network firewall to safeguard against accidental deletion.

Policy Severity— Informational

Policy Type— Config

AWS Application Load Balancer (ALB) is not configured to drop HTTP headers

24.5.2

This policy identifies AWS Application Load Balancers that are not configured to drop HTTP headers.

AWS Application Load Balancers distribute incoming HTTP/HTTPS traffic across multiple targets such as EC2 instances, containers, and Lambda functions, based on routing rules and health checks. By default, ALBs are not configured to drop invalid HTTP header values, which can leave the load balancer vulnerable to HTTP desync attacks. HTTP desync attacks manipulate request headers to exploit inconsistencies between servers, potentially leading to security vulnerabilities and unauthorized access.

It is recommended to enable this feature, to prevent the load balancer from forwarding requests with invalid HTTP headers to mitigate potential security vulnerabilities.

Policy Severity— Low

Policy Type— Config

Azure Storage account with cross tenant replication enabled

24.5.2

This policy identifies Azure Storage accounts that are enabled with cross tenant replication.

Azure Storage account cross tenant replication allows data to be replicated across multiple Azure tenants. Though this feature is beneficial for data availability it also poses a significant security risk if not properly managed. Possible risks include unauthorized access to data, data leaks, and compliance violations. Disabling Cross Tenant Replication reduces the risk of unauthorized data access and prevents the accidental sharing of sensitive information.

As best practice, it is recommended to disable cross tenant replication on your storage accounts.

Policy Severity— Informational

Policy Type— Config

Azure App service HTTP logging is disabled

24.5.2

This policy identifies Azure App services that have HTTP logging disabled.

By enabling HTTP logging for your app service, you can collect log information and use it to monitor and troubleshoot your app, as well as identify any potential security issues or threats. This can help to ensure that your app is running smoothly and is secure from potential attacks.

As best practice, it is recommended to enable HTTP logging on your app service.

Policy Severity— Low

Policy Type— Config

Azure App Service Environment configured with weak TLS cipher suites

24.5.2

This policy identifies Azure App Service Environments that are configured with weak TLS Cipher suites.

Azure App Service Environments host web applications and APIs in a dedicated and isolated environment. When these environments are configured with weak TLS Cipher suites, they can expose sensitive data to potential security risks. Weak cipher suites may allow attackers to intercept and decrypt communication between clients and the App Service Environment, leading to unauthorized access, data breaches, and potential compliance violations. The recommended cipher suites are TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 and TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256.

As best practice, it is recommended to avoid using weak TLS Cipher suites to enhance security and protect sensitive data.

Policy Severity— Low

Policy Type— Config

AWS DocumentDB clusters have backup retention period less than 7 days

24.5.1

This policy identifies Amazon DocumentDB (DocDB) clusters lacking sufficient backup retention periods.

The backup retention period denotes the duration for storing automated backups of the DocumentDB cluster. Inadequate retention periods heighten the risk of data loss, compliance issues, and hinder effective recovery in security breaches or system failures.

The best practice is to ensure that there is a substantial backup retention period for DocDB clusters retaining at least 7 days of backups or according to your business and compliance requirements.

Policy Severity— Low

Policy Type— Config

AWS DMS replication instance auto minor version upgrade is not enabled

24.5.1

This policy identifies the AWS DMS(Database Migration Service) replication instance does not enable auto minor version upgrade.

A replication instance in DMS is a compute resource used to replicate data between a source and target database during the migration or ongoing replication process. Failure to enable automatic minor upgrades in AWS DMS can leave your database instances vulnerable to security risks stemming from outdated software.

It is recommended to enable automatic minor version upgrades on DMS replication instances for instances that receive timely patches and updates, reducing the risk of security vulnerabilities and improving overall performance and stability.

Policy Severity— Low

Policy Type— Config

AWS DynamoDB table deletion protection is disabled

24.5.1

This policy identifies AWS DynamoDB tables with deletion protection disabled.

DynamoDB is a fully managed NoSQL database that provides a highly reliable, scalable, low-latency database solution for applications that require consistent, single-digit millisecond latency at any scale. Deletion protection feature allows authorised administrators to prevent accidental deletion of DynamoDB tables. Enabling deletion protection helps reduce the risk of data loss, maintain data integrity, ensure compliance, and protect DynamoDB tables across different environments.

It is recommended to enable deletion protection on DynamoDB tables to prevent unintended data loss.

Policy Severity— Informational

Policy Type— Config

AWS DynamoDB table Auto Scaling not enabled

24.5.1

This policy identifies AWS DynamoDB tables with auto-scaling disabled.

DynamoDB is a fully managed NoSQL database that provides a highly reliable, scalable, low-latency database solution for applications that require consistent, single-digit millisecond latency at any scale. Auto-scaling functionality allows you to dynamically alter the allocated throughput capacity for your DynamoDB tables based on current traffic patterns. This feature employs the Application Auto Scaling service to automatically boost provisioned read and write capacity to manage unexpected traffic increases and reduce throughput when the workload falls in order to avoid paying for wasted supplied capacity.

It is recommended to enable auto-scaling for the DynamoDB table to ensure efficient resource utilisation, cost optimisation, improved performance, simplified management, and scalability.

Policy Severity— Informational

Policy Type— Config

AWS Network ACL is not in use

24.5.1

This policy identifies AWS Network ACLs that are not in use.

AWS Network Access Control Lists (NACLs) serve as a firewall mechanism to regulate traffic flow within and outside VPC subnets. A recommended practice is to assign NACLs to specific subnets to effectively manage network traffic. Unassigned NACLs with inadequate rules might inadvertently get linked to subnets, posing a security risk by potentially allowing unauthorized access.

It is recommended to regularly review and remove unused and inadequate NACLs to improve security, network performance, and resource management.

Policy Severity— Informational

Policy Type— Config

AWS AppSync has field-level logging disabled

24.5.1

This policy identifies an AWS AppSync GraphQL API not configured with field-level logging.

AWS AppSync is a managed GraphQL service that simplifies the development of scalable APIs. "field-level" security offers a fine-grained approach to defining permissions and access control for individual fields within a GraphQL schema. It allows precisely regulate which users or clients can read or modify specific fields in an API. This level of control ensures that sensitive data is protected and that access is restricted only to those with appropriate authorization.

Without field-level security, control over specific fields within the schema is lost, causing the risk of sensitive data exposure. Additionally, the absence of this feature limits the implementation of fine-grained access control policies based on user roles or contextual information, thereby undermining the overall security of the application.

It is recommended to enable field-level security to mitigate the risks by enforcing access control at a granular level, ensuring that only authorized users can access or modify specific fields based on your defined policies and requirements.

Policy Severity— Informational

Policy Type— Config

AWS Elastic Beanstalk environment logging not configured

24.5.1

This policy identifies the Elastic Beanstalk environments not configured to send logs to CloudWatch Logs.

An Elastic Beanstalk environment is a configuration of AWS resources where you can deploy your application. The environment logs refer to the logs generated by various components of your application, which can provide valuable insights into any errors or issues that may arise during operation. Failing to enable logging in an Elastic Beanstalk environment reduces visibility, hinders incident detection and response, and increases vulnerability to security breaches.

It is recommended to configure AWS Elastic Beanstalk environments to send logs to CloudWatch to ensure security and meet compliance requirements.

Policy Severity— Informational

Policy Type— Config

AWS Certificate Manager (ACM) RSA certificate key length less than 2048

24.5.1

This policy identifies the RSA certificates managed by AWS Certificate Manager with a key length of less than 2048 bits.

AWS Certificate Manager (ACM) is a service for managing SSL/TLS certificates. RSA certificates are cryptographic keys used for securing communications over networks. Shorter key lengths may be susceptible to attacks such as brute force or factorization, where an attacker could potentially decrypt the encrypted data by finding the prime factors of the key.

It is recommended that the RSA certificates imported on ACM utilise a minimum key length of 2048 bits or greater to ensure a sufficient level of security.

Policy Severity— Low

Policy Type— Config

AWS Macie is not enabled

24.5.1

This policy identifies the AWS Macie that is not enabled in specific regions.

AWS Macie is a data security service that automatically discovers, classifies, and protects sensitive data in AWS, enhancing security and compliance posture. Failure to activate AWS Macie increases the risk of potentially missing out on automated detection and protection of sensitive data, leaving your organization more vulnerable to data breaches and compliance violations.

It is recommended to enable Macie in all regions for comprehensive adherence to security and compliance requirements.

Policy Severity— Informational

Policy Type— Config

GCP Cloud Asset Inventory is disabled

24.5.1

This policy identifies GCP accounts where GCP Cloud Asset Inventory is disabled.

GCP Cloud Asset Inventory is a metadata inventory service that allows you to view, monitor, and analyze Google Cloud and Anthos assets across projects and services. This data can prove to be crucial in security analysis, resource change tracking, and compliance auditing.

It is recommended to enable GCP Cloud Asset Inventory for centralized visibility and control over your cloud assets.

Policy Severity— Informational

Policy Type— Config

GCP External Load Balancer logging is disabled

24.5.1

This policy identifies GCP External Load Balancers using any of the protocols like HTTP, HTTPS, and HTTP/2 having logging disabled.

GCP external load balancers distribute incoming traffic across multiple instances or services hosted on Google Cloud Platform. Feature "logging" for external load balancers captures and records detailed information about the traffic flowing through the load balancers. This includes data such as incoming requests, responses, errors, latency metrics, and other relevant information. By enabling logging for external load balancers, you gain visibility into the performance, health, and security of the applications. Logged data comes handy for troubleshooting an incident, monitoring, analysis, and compliance purposes.

It is recommended to enable logging for all external load balancers.

Policy Severity— Informational

Policy Type— Config

GCP VM instance Confidential VM service disabled

24.5.1

This policy identifies GCP VM instances that have confidential VM services disabled.

GCP VM encrypts data at rest and in transit, but the data must be decrypted before processing. Confidential VM service (Confidential Computing) allows GCP VM to keep in-memory data secure by utilizing hardware-based memory encryption. This protects any sensitive data leakage in case the VM is compromised.

It is recommended to enable confidential VM services on GCP VMs to enhance the confidentiality and integrity of in-memory data on the VMs.

Policy Severity— Medium

Policy Type— Config

New Configuration Build Policies

24.5.1

Secure the Source

The following default policies are added within the Build subtype of Configuration policies under Governance for enhanced continuous integration and deployment pipeline security.

Ansible Compute Policies

  • Usage of packages with unauthenticated or missing signatures allowed

  • Usage of the force parameter disabling signature validation allowed

Ansible General Policies

  • DNF usage of packages with untrusted or missing GPG signatures allowed

Ansible Monitoring Policies

  • Missing 'Rescue' section in Ansible block tasks

Ansible Networking Policies

  • Disabled Ansible URI certificate validation

  • HTTPS url not used with Ansible uri

  • HTTPS url not used with Ansible get_url module

  • SSL validation disabled within Ansible DNF module

  • Certificate validation disabled within Ansible DNF module

  • Certificate validation disabled with Ansible get_url module

  • SSL certificate validation disabled in Ansible Yum Tasks

  • SSL certificate validation disabled with Ansible Yum

PANOS Policies

  • End-of-session logging disabled on Palo Alto Networks security policies

  • IPsec profile uses insecure authentication algorithms on Palo Alto Networks devices

  • IPsec profile uses insecure authentication protocols on Palo Alto Networks devices

  • Security zone on Palo Alto Networks devices does not have an associated Zone Protection Profile

  • Include ACL (Access Control List) not defined for a security zone in Palo Alto Networks devices with User-ID enabled

  • Logging at session start enabled on Palo Alto Networks devices

  • Security rules apply to all zones on Palo Alto Networks devices

  • Plain-text management HTTP enabled for Interface Management Profile in Palo Alto Networks devices

  • Plain-text management Telnet enabled for Interface Management Profile in Palo Alto Networks devices

  • Disable Server Response Inspection (DSRI) enabled in security policies for Palo Alto Networks devices

  • Security rule allows any application on Palo Alto Networks devices

  • Security rule permits any service on Palo Alto Networks devices

  • Security Rule in Palo Alto Networks devices with overly broad Source and Destination IPs

  • Security policies missing descriptions in Palo Alto Networks devices

  • Log Forwarding Profile not selected for a Palo Alto Networks device security policy rule

  • Security rules have source_zone and destination_zone containing values of any

Impact— You will view policy violations for these policies on Prisma Cloud switcher Application Security > Projects. Enforcement levels for IaC Misconfigurations will now be applied to pipelines with these findings. You are required to enable the additional modules on Application Security > Settings to view violations and alerts for these policies.

New IAM OOTB Policies

24.5.2

Secure the Infrastructure

The following new OOTB IAM policies are added in Prisma Cloud. You can also find these policies in JSON format on this GitHub Repo. To see a comprehensive list of all the policies added, check the changelog.md file. The name of each policy in the changelog matches the filename for each policy. Within each policy file, the JSON field names clearly describe the characteristics they represent.

  • AWS Administrators with IAM permissions are unused for 90 days

  • AWS Groups and IAM Roles with Administrative Permissions

  • AWS IAM Groups and Roles with Excessive Policies

  • AWS IAM Groups and Roles with IAM Data Read permissions are unused for 90 days

  • AWS IAM Groups and Roles with IAM Data Write permissions are unused for 90 days

  • AWS IAM Groups and Roles with IAM Metadata Read permissions are unused for 90 days

  • AWS IAM Groups and Roles with IAM Metadata Write permissions are unused for 90 days

  • AWS Users and Machine Identities with Administrative Permissions

  • AWS Users and Machine Identities with Excessive Policies

  • AWS Users and Machine Identities with IAM Data Read permissions are unused for 90 days

  • AWS Users and Machine Identities with IAM Data Write permissions are unused for 90 days

  • AWS Users and Machine Identities with IAM Metadata Read permissions are unused for 90 days

  • AWS Users and Machine Identities with IAM Metadata Write permissions are unused for 90 days

  • Azure AD Groups, Service Principals and Managed Identities with Administrative Permissions

  • Azure AD Groups, Service Principals and Managed Identities with Excessive Policies

  • Azure AD Groups, Service Principals and Managed Identities with IAM Data Read permissions are unused for 90 days

  • Azure AD Groups, Service Principals and Managed Identities with IAM Data Write permissions are unused for 90 days

  • Azure AD Groups, Service Principals and Managed Identities with IAM Metadata Read permissions are unused for 90 days

  • Azure AD Groups, Service Principals and Managed Identities with IAM Metadata Write permissions are unused for 90 days

  • Azure Administrators with IAM permissions are unused for 90 days

  • Azure Users and Machine Identities with Administrative Permissions

  • Azure Users and Machine Identities with Excessive Policies

  • Azure Users and Machine Identities with IAM Data Read permissions are unused for 90 days

  • Azure Users and Machine Identities with IAM Data Write permissions are unused for 90 days

  • Azure Users and Machine Identities with IAM Metadata Read permissions are unused for 90 days

  • Azure Users and Machine Identities with IAM Metadata Write permissions are unused for 90 days

  • GCP Administrators with IAM permissions are unused for 90 days

  • GCP Groups and Service Accounts with Administrative Permissions

  • GCP Groups and Service Accounts with Excessive Policies

  • GCP Groups and Service Accounts with IAM Data Read permissions are unused for 90 days

  • GCP Groups and Service Accounts with IAM Data Write permissions are unused for 90 days

  • GCP Groups and Service Accounts with IAM Metadata Read permissions are unused for 90 days

  • GCP Groups and Service Accounts with IAM Metadata Write permissions are unused for 90 days

  • GCP Users and Machine Identities with Administrative Permissions

  • GCP Users and Machine Identities with Excessive Policies

  • GCP Users and Machine Identities with IAM Data Read permissions are unused for 90 days

  • GCP Users and Machine Identities with IAM Data Write permissions are unused for 90 days

  • GCP Users and Machine Identities with IAM Metadata Read permissions are unused for 90 days

  • GCP Users and Machine Identities with IAM Metadata Write permissions are unused for 90 days

  • Third-party service account can assume a service account with high privileges

  • Third-party service account with a Lateral Movement Through Lambda Edit

  • Third-party service account with a Lateral Movement to Data Services Through Redshift Cluster Creation

  • Third-party Service Account With Lateral Movement Through CloudFormation Stack Creation

Policy Updates

Policy Updates

Description

Policy Updates—RQL

Azure Storage account encryption key configured by access policy with privileged operations

24.5.2

Changes— The policy RQL will be updated to check if the key vault will use Role-Based Access Control (RBAC) for authorization of data actions or not.

Severity— Medium

Policy Type— Config

Current RQL—

Updated RQL—

Impact— Low.

Azure Virtual Network subnet is not configured with a Network Security Group

24.5.2

Changes— The policy description and RQL are updated.

Severity— Low

Policy Type— Config

Current Description— This policy identifies Azure Virtual Network (VNet) subnets that are not associated with a Network Security Group (NSG). While binding an NSG to a network interface of a Virtual Machine (VM) enables fine-grained control to the VM, associating a NSG to a subnet enables better control over network traffic to all resources within a subnet. As a best practice, associate an NSG with a subnet so that you can protect your VMs on a subnet-level.

For more information, see Azure Network Security Groups (NSG) - Best Practices and Lessons Learned and What is a private endpoint? - Azure Private Link.

This policy will not report for subnets used by Azure Firewall, Gateway, NetApp File Share, RouteServerSubnet, Private endpoints and Private links as Azure recommends not to configure Network Security Group (NSG) for these services.

Updated Description— This policy identifies Azure Virtual Network (VNet) subnets that are not associated with a Network Security Group (NSG).

While binding an NSG to a network interface of a Virtual Machine (VM) enables fine-grained control of the VM, associating an NSG to a subnet enables better control over network traffic to all resources within a subnet.

It is recommended to associate an NSG with a subnet so that you can protect your VMs on a subnet-level.

For more information, see Azure Network Security Groups (NSG) - Best Practices and Lessons Learned and What is a private endpoint? - Azure Private Link.

This policy will not report for subnets used by Azure Firewall Subnet, Azure Firewall Management Subnet, Gateway Subnet, NetApp File Share, Route Server Subnet, Private endpoints and Private links as Azure recommends not to configure Network Security Group (NSG) for these services.

Current RQL—

Updated RQL—

Impact— Low. Alert for Azure Virtual Network (VNet) subnets used by AzureFirewallManagementSubnet will be resolved.

Azure Microsoft Defender for Cloud set to Off for DNS

24.5.1

Changes— The policy RQL is updated to check if the legacy DNS plan is deprecated.

Severity— Low

Policy Type— Config

Current RQL—

Updated RQL—

Impact— Low. Alerts generated by the deprecated DNS plan will be resolved.

AWS Application Load Balancer (ALB) is not using the latest predefined security policy

24.5.1

Changes— The policy description, RQL, and remediation steps are updated.

Severity— Low

Policy Type— Config

Current RQL—

Updated RQL—

Impact— Low. Alerts generated for Application Load Balancers(ALB) using predefined FIPS security policy ELBSecurityPolicy-TLS13-1-2-FIPS-2023-04 will be resolved.

Policy Updates—Configuration Build

Configuration Build Policies

24.5.1

The following policies now support Ansible framework:

  • EC2 EBS is not optimized

  • AWS EC2 instances with public IP and associated with security groups have Internet access

Impact— You will view policy violations for these policies on Prisma Cloud switcher Application Security > Projects. Enforcement levels for IaC Misconfigurations will now be applied to pipelines with these findings. You are required to enable the additional modules on Application Security > Settings to view violations and alerts for these policies.

New Compliance Benchmarks and Updates

Compliance Benchmark

Description

Policy Mapping Update for HIPAA

24.5.2

New Policy mappings are added to the HIPAA compliance standard.

Impact— As new mappings are introduced, compliance scoring might vary.

Support for NIST CSF v2.0

24.5.2

Prisma Cloud has integrated support for the NIST CSF v2.0 compliance standard. This version has new controls and the new Prisma Cloud policies are mapped to the controls increasing the overall coverage.

You can now view this built-in standard and the associated policies on Compliance > Standards. You can also generate reports for immediate viewing or download, or schedule recurring reports to track this compliance standard over time.

CIS GCP Foundation benchmark 3.0

24.5.1

Prisma Cloud now supports CIS Google Cloud Platform Foundation Benchmark version 3.0. This latest version has new controls and new Prisma Cloud policies are mapped to the controls increasing the overall compliance coverage.

You can now view this built-in standard and associated policies on the Compliance > Standards page. You can also generate reports for immediate viewing or download, or schedule recurring reports to track the compliance standard over time.

REST API Updates

Change

Description

Integration APIs

24.5.1

Integration APIs now support integration with Amazon Security Lake to ingest Prisma Cloud Open Cybersecurity Schema Framework (OCSF) compliant vulnerability security data into Amazon Security Lake.

Changes in Existing Behavior

Feature

Description

Alert Info API

The Alert Info GET alert/:id response now includes a new connectionDetails field.

PreviousFeatures Introduced in June 2024NextFeatures Introduced in April 2024

Last updated

Was this helpful?