Ctrlk
BlogSupport
For the complete documentation index, see llms.txt. This page is also available as Markdown.

Features Introduced in September 2024

Learn what’s new on Prisma® Cloud in September 2024.

Announcement

Feature

Description

Lifecycle Support Update

Secure the Runtime

33.00.169

Prisma Cloud officially guarantees backward compatibility with up to two previous major versions (N-2).

Although the support lifecycle remains unchanged, starting from version 33.xx, Prisma Cloud will not restrict the usage of Defender versions or REST API calls from up to three major releases before the current version (upto N-3 major releases).

For example, with the current version at 33.xx, API calls and Defenders from version 30.xx will be allowed. However, support and complete backward compatibility is guaranteed for the 32.xx and 31.xx releases.

New Features

Feature

Description

Package Operational Risks

Secure the Source

24.9.2

Package Operational Risk assesses the operational risk and potential impact of each open-source package in your codebase. This analysis results in package operational risk severity levels categorized into High, Medium, and Low. By prioritizing risks based on these categories, you can effectively focus remediation efforts on the most critical issues.

DSPM Integration with Attack Path and Asset Inventory

Secure the Data

24.9.2

If an Attack Path has access to a data store, you can now view the sensitivity, sensitivity label, data types, and record of data for the data store in that Attack Path. Prisma Cloud decorates the data store that contains sensitive data with a crown jewel icon. Note that the icon is displayed for individual assets and not for grouped nodes.

Prisma Cloud supports the following list of assets that are currently in the attack path and in the DSPM module:

  • AWS: S3, EC2 Instance, RDS, DynamoDB, Redshift

  • Azure: Azure Blob Storage, Cosmos DB, Azure Virtual Machine

  • GCP: Cloud SQL, Spanner, Cloud Storage, Bigtable

Additionally, when you select an asset on the Asset Inventory page a new Data tab in the asset sidecar displays data findings such as data types and labels.

Improved Shared Views

Secure the Infrastructure

24.9.1

Enhancements to Saved Views in Prisma Cloud allow you to share custom views with ease. If you are the creator of a custom view, you can now set the default visibility of view when you share it. Navigate to Home > Alerts > Manage Views and use the checkbox option to Make this dashboard visible for all viewers. Previously, publicly shared views were hidden by default even when shared, and visibility had to toggled on individually. Views can also be toggled off if desired. Learn more about Saved Views.

Jira Integration Support for Versions 9.0 and Above

Secure the Infrastructure

24.9.1

Prisma Cloud has enhanced its Prisma Cloud Technical Documentation Jira integration to work with all Jira Cloud and Jira On-Premise versions including 9.0 and above. This enhancement will enable you to receive Prisma Cloud alert notifications in your Jira accounts.

Transition from OVAL to VEX Format for Red Hat Security Data

Secure the Runtime

33.00.169

Prisma Cloud is transitioning from the OVAL format to the new VEX format that Red Hat has introduced and adopted for reporting security data and vulnerabilities in Red Hat artifacts.

Pre-33.00: Until you upgrade to a 33.xx release, Prisma Cloud will continue using OVAL for vulnerability scanning with no expected impact.

33.xx: After upgrading your Console and Defenders to version 33.00 or later, Prisma Cloud will switch to the VEX format for vulnerability reporting. This transition might result in a change in the number of reported CVEs due to the inherent differences between the VEX and OVAL content.

Comparison Between OVAL and VEX Formats: With the OVAL format, Prisma Cloud reports vulnerabilities for each binary found during the scan. However, with the new VEX format, Prisma Cloud will report one vulnerability for the source package and provide information on related binaries.

This means that the number of vulnerabilities with the same CVE ID will be reduced, as Prisma Cloud will report one vulnerability for the RPM package instead of multiple reports for each binary.

Continued Support: Prisma Cloud will continue to support OVAL format for two major versions—v33.xx and v34.xx—to maintain compatibility with Defenders in pre-33.xx releases, as long as Red Hat continues to produce OVAL files.

Expected Console Loading Time in the 33.xx release: For new Consoles paired with new Defenders, the Console loading time after a restart event will be approximately 1-2 minutes.

Console Memory Usage in the 33.XX release: For on-premise users upgrading to the latest Console, the Console memory requirement is 8 GB. This requirement is only for the self-hosted editions.

For a more detailed explanation of this transition, see the Transition from Oval to VEX Files document. For details on how CVEs are reported in the new VEX format as compared to the OVAL format, see CVEs Comparison between Oval and VEX.

If you have any concerns or need additional information about this transition, contact support@paloaltonetworks.com.

Enhancement to WAAS Agentless Support

Secure the Runtime

33.00.169

WAAS agentless rules now support traffic inspection for AWS Application Load Balancers (ALBs) in addition to AWS EC2 instances. Ensure your AWS account is onboarded to the Prisma Cloud console and then configure the ALB rule.

To add the ALB rule access Defend > WAAS > Add Rule > Add Configuration. Ensure your CloudFormation template is applied with the necessary permissions to your onboarded AWS account in the region where the ALB resides. You can view the scan results in the Prisma Cloud console to monitor and manage your ALB traffic inspection.

This feature is enabled on request. Please contact your Account team for more details.

Updates to Terraform Template

Updates to Terraform Template

Description

Azure

24.9.2

The following Azure permissions have been removed from the Prisma Cloud Azure Terraform template since they were deprecated by Azure:

  • Microsoft.MachineLearning/commitmentPlans/read

  • Microsoft.MachineLearning/webServices/read

  • Microsoft.MachineLearning/workspaces/read

Changes in Existing Behavior

Feature

Description

Audit Logs Retention Period

24.9.2

The Audit logs from AWS, Azure, GCP Cloud providers, and Prisma Cloud are purged from the live system after 120 days or when the total number of logs exceeds 1.2 billion, whichever comes first. Once the logs are purged, they are no longer accessible via RQL queries on the Investigate page in Prisma Cloud. However, the data on the logs are retained in an archived, encrypted format for the duration of your contract.

Impact— Once the logs are purged, they will not be accessible via RQL queries on the Investigate page in Prisma Cloud. However, the data on the logs will be retained in an archived, encrypted format for the duration of your contract.

To retrieve any purged data, contact your Prisma Cloud Customer Success Representative.

Audit Logs Warning

24.9.1

If you have configured your AWS account or organization to ingest audit logs through EventBridge, you might see a warning message stating: Rule <prisma-cloud-your-tenant-id-audit-logs-rule> does not exist on EventBus default in <region>

This warning is due to performance enhancements in the EventBridge rule configuration, which do not affect system functionality. To resolve the warning, download the CloudFormation Template (CFT) from Misconfigurations > Near Real-Time Visibility > Edit, and update your CFT stack in AWS. For detailed instructions, see Configure Audit Logs.

Impact— Updating the CFT will result in an increase in the number of EventBridge rules enabling Prisma Cloud to ingest only the relevant audit logs.

API Ingestions

Service

API Details

Amazon Bedrock

24.9.2

aws-bedrock-model-invocation-logging-configuration

Additional permission required:

  • bedrock:GetModelInvocationLoggingConfiguration

The Security Audit role includes the above permission.

Amazon Bedrock

24.9.2

aws-bedrock-provisioned-model-throughput

Additional permissions required:

  • bedrock:ListProvisionedModelThroughputs

  • bedrock:GetProvisionedModelThroughput

  • bedrock:ListTagsForResource

The Security Audit role includes the bedrock:ListTagsForResource permission.

The Security Audit role does not include the bedrock:ListProvisionedModelThroughputs and bedrock:GetProvisionedModelThroughput permissions. You must manually add them to the CFT template to enable them.

Amazon Bedrock

24.9.2

aws-bedrock-model-customization-job

Additional permissions required:

  • bedrock:ListModelCustomizationJobs

  • bedrock:GetModelCustomizationJob

  • bedrock:ListTagsForResource

The Security Audit role includes the bedrock:ListTagsForResource permission.

The Security Audit role does not include the bedrock:ListModelCustomizationJobs and bedrock:GetModelCustomizationJob permissions. You must manually add them to the CFT template to enable them.

Amazon Bedrock

24.9.2

aws-bedrock-knowledgebase

Additional permissions required:

  • bedrock:ListKnowledgeBases

  • bedrock:GetKnowledgeBase

  • bedrock:ListTagsForResource

The Security Audit role includes the bedrock:ListTagsForResource permission.

The Security Audit role does not include the bedrock:ListKnowledgeBases and bedrock:GetKnowledgeBase permissions. You must manually add them to the CFT template to enable them.

Update Amazon Dynamo DB

24.9.2

aws-dynamodb-describe-table

The aws-dynamodb-describe-table is updated to include a new CSP API GetResourcePolicy which ingests resource based policy information.

Additional permission required:

  • dynamodb:GetResourcePolicy

The Security Audit role does not include the above permission. You must manually add the permission to the CFT template to enable it.

Update Amazon APIs

24.9.2

The resource JSON for the following APIs are updated to include a new field BucketName:

  • aws-glue-job

  • aws-emr-studio

  • aws-sagemaker-domain

Amazon Redshift

24.9.2

aws-redshift-serverless-workgroup

Additional permission required:

  • redshift-serverless:ListWorkgroups

The Security Audit role includes the above permission.

AWS Security Hub

24.9.2

aws-securityhub-enabled-products-for-import

Additional permission required:

  • securityhub:ListEnabledProductsForImport

The Security Audit role includes the above permission.

Update Google BigQuery Data Transfer

24.9.2

gcloud-bigquery-data-transfer-config

Additional permission required:

  • bigquery.transfers.get

The Viewer role includes the above permission.

NOTE: API has been updated to ingest resources from all supported regions except the region me-central2 due to platform dependencies.

OCI Web Application Firewall

24.9.2

oci-loadbalancer-waf

Additional permissions required:

  • WEB_APP_FIREWALL_INSPECT

  • WEB_APP_FIREWALL_READ

The Reader role includes the above permissions.

Azure Databricks

24.9.1

azure-databricks-access-connectors

Additional permission required:

  • Microsoft.Databricks/accessConnectors/read

The Reader role includes the above permission.

Azure Active Directory

24.9.1

azure-active-directory-admin-consent-request-policy

Additional permission required:

  • Policy.Read.All

The Global Reader role includes the above permission.

Azure Active Directory

24.9.1

azure-active-directory-cross-tenant-access-default-settings

Additional permission required:

  • Policy.Read.All

The Global Reader role includes the above permission.

Azure Active Directory

24.9.1

azure-active-directory-configured-external-identity-provider

Additional permission required:

  • IdentityProvider.Read.All

Google Cloud Batch Job

24.9.1

gcloud-cloud-batch-job

Additional permission required:

  • batch.jobs.list

The Viewer role includes the above permission.

Google Kubernetes Engine

24.9.1

gcloud-container-describe-clusters

Additional permission required:

  • container.clusters.getCredentials

You must manually add the permission to a Custom role.

WAAS Agentless - Support AWS LB

33.00.169

The Set Agentless App Firewall Policy API request is updated to support AWS Application Load Balancers (ALBs):

  • The “trafficMirroring > vpcConfig” property is modified to include three new fields for ALBs:

    • lbARN - ARN of the observed load balancer.

    • lbName - Load balancer name.

    • lbType - Load balance type.

  • The following existing fields are now applicable as follows:

    • instanceNames - used only in EC2 rules.

    • subnetID - used only in EC2 rules.

    • tags - used only in EC2 rules.

    • vpcID - must be empty (””) for ALB rules.

    • autoScalingEnabled - must be true for ALB rules.

New Policies

Policies

Description

AWS S3 bucket used for storing AWS Bedrock Custom model training artifacts

24.9.2

This policy identifies the AWS S3 bucket used for storing AWS Bedrock Custom model training job output.

S3 buckets hold the results and artifacts generated from training models in AWS Bedrock. Ensuring proper configuration and access control is crucial to maintaining the security and integrity of the training output. Improperly secured S3 buckets used for storing AWS Bedrock training output can lead to unauthorized access and potential exposure of model information.

It is recommended to implement strict access controls, enable encryption, and audit permissions to secure AWS S3 buckets for AWS Bedrock training job output and ensure compliance.

This policy is designed to identify the S3 buckets utilized for storing results and storing artifacts generated from training custom models in AWS Bedrock. It does not signify any detected misconfiguration or security risk.

Policy Severity— Informational

Policy Type— Config

AWS S3 bucket is utilized for AWS Bedrock Custom model training data

24.9.2

This policy identifies the AWS S3 bucket utilized for AWS Bedrock Custom model training job data.

S3 buckets store the datasets required for training Custom models in AWS Bedrock. Proper configuration and access control are essential to ensure the security and integrity of the training data. Improperly configured S3 buckets used for AWS Bedrock Custom model training data can lead to unauthorized access, data breaches, and potential loss of sensitive information.

It is recommended to implement strict access controls, enable encryption, and audit permissions to secure AWS S3 buckets for AWS Bedrock Custom model training data and ensure compliance.

This policy is designed to identify the S3 buckets utilized for training custom models in AWS Bedrock. It does not signify any detected misconfiguration or security risk.

Policy Severity— Informational

Policy Type— Config

AWS Bedrock Custom model encrypted with Customer Managed Key (CMK) is not enabled for regular rotation

24.9.2

This policy identifies AWS Bedrock Custom model encrypted with Customer Managed Key (CMK) is not enabled for regular rotation.

AWS KMS (Key Management Service) allows customers to create master keys to encrypt the Custom model. Not enabling regular rotation for AWS Bedrock custom model key rotation failure can result in potential compliance violations.

As a security best practice, it is important to rotate the keys periodically so that if the keys are compromised, the data in the underlying service is still secure with the new keys.

Policy Severity— Informational

Policy Type— Config

Azure DNS Zone having dangling DNS Record vulnerable to subdomain takeover associated with Azure Storage account blob

24.9.2

This policy identifies DNS records within an Azure DNS zone that point to Azure Storage Account blobs that no longer exist.

A dangling DNS attack happens when a DNS record points to a cloud resource that has been deleted or is inactive, making the subdomain vulnerable to takeover. An attacker can exploit this by creating a new resource with the same name and taking control of the subdomain to serve malicious content. This allows attackers to host harmful content under your subdomain, which could lead to phishing attacks, data breaches, and damage to your reputation. The risk arises because the DNS record still references a non-existent resource, which unauthorized individuals can re-associate with their own resources.

As a security best practice, it is recommended to routinely audit DNS zones and remove or update DNS records pointing to non-existing Azure Storage Account blobs.

Policy Severity— High

Policy Type— Config

Azure DNS Zone having dangling DNS Record vulnerable to subdomain takeover associated with Web App Service

24.9.2

This policy identifies DNS records within an Azure DNS zone that point to Azure Web App Services that no longer exist.

A dangling DNS attack happens when a DNS record points to a cloud resource that has been deleted or is inactive, making the subdomain vulnerable to takeover. An attacker can exploit this by creating a new resource with the same name and taking control of the subdomain to serve malicious content. This allows attackers to host harmful content under your subdomain, which could lead to phishing attacks, data breaches, and damage to your reputation. The risk arises because the DNS record still references a non-existent resource, which unauthorized individuals can re-associate with their own resources.

As a security best practice, it is recommended to routinely audit DNS zones and remove or update DNS records pointing to non-existing Web App Services.

Policy Severity— High

Policy Type— Config

GCP Storage bucket CMEK not rotated every 90 days

24.9.2

This policy identifies GCP Storage bucket with CMEK that are not rotated every 90 days

A CMEK (Customer-Managed Encryption Key), which is configured for a GCP bucket becomes vulnerable over time due to prolonged use. Without regular rotation, the key is at greater risk of being compromised, which could lead to unauthorized access to the encrypted data in the bucket. This can undermine the security of your data and increase the chances of a breach if the key is exposed or exploited.

It is recommended to configure rotation less than 90 days for CMEKs used for GCP buckets.

Policy Severity— Informational

Policy Type— Config

GCP Storage bucket using a disabled CMEK

24.9.2

This policy identifies GCP Storage buckets that are using a disabled CMEK.

CMEK (Customer-Managed Encryption Keys) for GCP buckets allows you to use your own encryption keys to secure data stored in Google Cloud Storage. If a CMEK defined for a GCP bucket is disabled, the data in that bucket becomes inaccessible, as the encryption keys are no longer available to decrypt the data. This can lead to data loss and operational disruption. If not properly managed, CMEK can also introduce risks such as accidental key deletion or mismanagement, which could compromise data availability and security.

It is recommended to review the state of CMEK and enable it to keep the data in the bucket accessible.

Policy Severity— Low

Policy Type— Config

GCP VM instance is assigned with public IP

24.9.2

This policy identifies GCP VM instances that are assigned a public IP.

Using a public IP with a GCP VM exposes it directly to the internet, increasing the risk of unauthorized access and attacks. This makes the VM vulnerable to threats such as brute force attempts, DDoS attacks, and other malicious activities. To mitigate these risks, it’s safer to use private IPs and secure access methods like VPNs or load balancers.

It is recommended to avoid assigning public IPs to VM instances.

Policy Severity— Low

Policy Type— Config

GCP VM instance with Shielded VM Secure Boot disabled

24.9.2

This policy identifies GCP VM instances that have Shielded VM Secure Boot disabled.

Secure Boot is a security feature that ensures only trusted, digitally signed software runs during the boot process of a computer. Enabling it helps protect against malware and unauthorized software by verifying the integrity of the bootloader and operating system. Without Secure Boot, systems are vulnerable to rootkits, bootkits, and other malicious code that can compromise the system from the start, making it difficult to detect and remove such threats.

It is recommended to enable Shielded VM secure boot for GCP VM instances.

Policy Severity— Low

Policy Type— Config

GCP OS Image is publicly accessible

24.9.2

This policy identifies GCP OS Images that are publicly accessible.

Custom GCP OS images are user-created operating system images tailored to specific needs and configurations. Making these images public can expose sensitive data, proprietary software, and security vulnerabilities. This can lead to unauthorized access, data breaches, and system exploitation, compromising your infrastructure’s security and integrity.

It is recommended to keep OS images private unless required for organizational needs.

Policy Severity— Low

Policy Type— Config

OCI Compute Instance with Secure Boot disabled

24.9.2

This policy identifies OCI compute instances in which Secure Boot is disabled.

Secure Boot serves as a security standard ensuring that a machine exclusively boots using Original Equipment Manufacturer (OEM) trusted software. Without the activation of Secure Boot, a compute instance becomes susceptible to booting unauthorized or malicious software, posing a threat to the integrity and security of the instance. Consequently, this vulnerability can lead to unauthorized access, data breaches, or other malicious activities within the instance.

As a security best practice, enabling Secure Boot on all compute instances is strongly recommended to guarantee the exclusive execution of trusted software during the boot process.

Policy Severity— Low

Policy Type— Config

AWS IAM user is not a member of any IAM group

24.9.1

This policy identifies an AWS IAM user as not being a member of any IAM group.

It is generally a best practice to assign IAM users to at least one IAM group. If the IAM users are not in a group, it complicates permission management and auditing, increasing the risk of privilege mismanagement and security oversights. It also leads to higher operational overhead and potential non-compliance with security best practices.

It is recommended to ensure all IAM users are part of at least one IAM group according to your business requirement to simplify permission management, enforce consistent security policies, and reduce the risk of privilege mismanagement.

Policy Severity— Informational

Policy Type— Config

AWS KMS Customer Managed Key (CMK) is disabled

24.9.1

This policy identifies the AWS KMS Customer Managed Key (CMK) that is disabled.

Ensuring that your Amazon Key Management Service (AWS KMS) key is enabled is important because it determines whether the key can be used to perform cryptographic operations. If an AWS KMS Key is disabled, any operations dependent on that key, such as encryption or decryption of data, will fail. This can lead to application downtime, data access issues, and potential data loss if not addressed promptly.

It is recommended to enable the AWS KMS Customer Managed Key (CMK) if it is used in the application, to restore cryptographic operations and ensure your applications and services can access encrypted data.

Policy Severity— Informational

Policy Type— Config

Azure Cognitive Services account hosted with OpenAI is not configured with data loss prevention

24.9.1

This policy identifies Azure Cognitive Services accounts hosted with OpenAI that are not configured with data loss prevention.

Azure AI services offer data loss prevention capabilities that allow customers to configure the list of outbound URLs their Azure AI services resources can access.

As a best practice, it is recommended to enable the data loss prevention feature in OpenAI-hosted Azure Cognitive Services accounts to prevent data loss.

Policy Severity— High

Policy Type— Config

Azure Storage account diagnostic setting for blob is disabled

24.9.1

This policy identifies Azure Storage account blobs that have diagnostic logging disabled.

By enabling diagnostic settings, you can capture various types of activities and events occurring within these storage account blobs. These logs provide valuable insights into the operations, performance, and security of the storage account blobs.

Policy Severity— Low

Policy Type— Config

Azure Storage account diagnostic setting for file is disabled

24.9.1

This policy identifies Azure Storage account files that have diagnostic logging disabled.

By enabling diagnostic settings, you can capture various types of activities and events occurring within these storage account files. These logs provide valuable insights into the operations, performance, and security of the storage account files.

As a best practice, it is recommended to enable diagnostic logs on all storage account files.

Policy Severity— Low

Policy Type— Config

Azure Storage account diagnostic setting for queue is disabled

24.9.1

This policy identifies Azure Storage account queues that have diagnostic logging disabled.

By enabling diagnostic settings, you can capture various types of activities and events occurring within these storage account queues. These logs provide valuable insights into the operations, performance, and security of the storage account queues.

As a best practice, it is recommended to enable diagnostic logs on all storage account queues.

Policy Severity— Low

Policy Type— Config

Azure Storage account diagnostic setting for table is disabled

24.9.1

This policy identifies Azure Storage account tables that have diagnostic logging disabled.

By enabling diagnostic settings, you can capture various types of activities and events occurring within these storage account tables. These logs provide valuable insights into the operations, performance, and security of the storage account tables.

As a best practice, it is recommended to enable diagnostic logs on all storage account tables.

Policy Severity— Low

Policy Type— Config

Azure Application Gateway listener not secured with SSL profile

24.9.1

This policy identifies Azure Application Gateway listeners that are not secured with an SSL profile.

An SSL profile provides a secure channel by encrypting the data transferred between the client and the application gateway. Without SSL profiles, the data transferred is vulnerable to interception, posing security risks. This could lead to potential data breaches and compromise sensitive information.

As a security best practice, it is recommended to secure all Application Gateway listeners with SSL profiles. This ensures data confidentiality and integrity by encrypting traffic.

Policy Severity— Low

Policy Type— Config

Azure Virtual Desktop workspace diagnostic log is disabled

24.9.1

This policy identifies Azure Virtual Desktop workspaces where diagnostic logs are not enabled.

Diagnostic logs are vital for monitoring and troubleshooting Azure Virtual Desktop, which offers virtual desktops and remote app services. They help detect and resolve issues, optimize performance, and meet security and compliance standards. Without these logs, it’s difficult to track activities and detect anomalies, potentially jeopardizing security and efficiency.

As a best practice, it is recommended to enable diagnostic logs for Azure Virtual Desktop workspaces.

Policy Severity— Low

Policy Type— Config

Azure Virtual Desktop disk encryption not configured with Customer Managed Key (CMK)

24.9.1

This policy identifies Azure Virtual Desktop environments where disk encryption is not configured using a Customer Managed Key (CMK).

Disk encryption is crucial for protecting data in Azure Virtual Desktop environments. By default, disks may be encrypted with Microsoft-managed keys, which might not meet specific security requirements. Using Customer Managed Keys (CMKs) offers better control over encryption, allowing organizations to manage key rotation, access, and revocation, thereby enhancing data security and compliance.

As a best practice, it is recommended to configure disk encryption for Azure Virtual Desktop with a Customer Managed Key (CMK).

Policy Severity— Low

Policy Type— Config

Azure Virtual Machine not protected with Azure Backup

24.9.1

This policy identifies Azure Virtual Machines that are not protected by Azure Backup.

Without Azure Backup, VMs are at risk of data loss due to accidental deletion, corruption, or ransomware attacks. Unprotected VMs may also not comply with organizational data retention policies and regulatory requirements.

As a best practice, it is recommended to configure Azure Backup for all VMs to ensure data protection and enable recovery options in case of unexpected failures or incidents.

Policy Severity— Low

Policy Type— Config

Policy Updates

Policy Updates

Description

Policy Updates—RQL

GCP GKE unsupported Master node version

24.9.2

Changes— The policy RQL and recommendation steps are updated to support GKE version 1.31.

Current RQL—

Updated RQL—

Policy Severity— Medium

Policy Type— Config

Impact— Low. Existing alerts where the GKE version is 1.31 will be resolved.

GCP GKE unsupported node version

24.9.2

Changes— The policy RQL and recommendation steps are updated to support GKE version 1.31.

Current RQL—

Updated RQL—

Policy Severity— Medium

Policy Type— Config

Impact— Low. Existing alerts where the GKE version is 1.31 will be resolved.

GCP User managed service account keys are not rotated for 90 days

24.9.2

Changes— The policy RQL is updated to exclude disabled service accounts

Current RQL—

Updated RQL—

Policy Severity— Informational

Policy Type— Config

Impact— Low. Existing alerts are resolved for the disabled service accounts.

Azure Key Vault Firewall is not enabled

24.9.1

Changes— The policy RQL is updated to reduce false positives and only generate alerts if public access is enabled.

Current RQL—

Updated RQL—

Policy Type— Config

Impact— Low. Open alerts where the public access is enabled and network ACLs default action is denied will be resolved.

Azure App Service Web app doesn’t use latest TLS version

24.9.1

Changes— The updated Policy RQL will not alert for minTlsVersion of 1.3.

Current Description— This policy identifies Azure web apps which are not set with latest version of TLS encryption. App service currently allows the web app to set TLS versions 1.0, 1.1 and 1.2. It is highly recommended to use the latest TLS 1.2 version for web app secure connections.

Updated Description— This policy identifies Azure web apps that are not configured with the latest version of TLS encryption. Azure Web Apps provide a platform to host and manage web applications securely.

Using the latest TLS version is crucial for maintaining secure connections. Older versions of TLS, such as 1.0 and 1.1, have known vulnerabilities that can be exploited by attackers. Upgrading to newer versions like TLS 1.2 or 1.3 ensures that the web app is better protected against modern security threats.

It is highly recommended to use the latest TLS version (greater than 1.1) for secure web app connections.

Current RQL—

Updated RQL—

Policy Type— Config

Policy Severity— Low

Impact— Low. Alert for Azure App Service Web app with minTlsVersion equals 1.3 will be resolved.

Policy Updates—Metadata

AWS SageMaker endpoint data encryption at rest not configured with CMK

24.9.1

Changes— The policy severity level is updated.

Current Policy Severity— High

Updated Policy Severity— Informational

Policy Type— Config

Impact— Low

New Compliance Benchmarks and Updates

Compliance Benchmark

Description

TX-RAMP Level 1 and Level 2

24.9.2

Prisma Cloud now supports the latest version of Texas Risk and Authorization Management Program (TX-RAMP ) Level 1 and Level 2. TX-RAMP is designed to enhance the security and resilience of cloud services used by Texas state agencies by establishing rigorous cybersecurity standards for cloud service providers.

You can view this built-in standard and the associated policies on the Compliance > Standards page. You can also generate reports for immediate viewing or download, or schedule recurring reports to track this compliance standard over time.

NYDFS 23 CRR-NY 500.0

24.9.2

New Policy mappings are added for CIS Controls v7.1 & CIS Controls v8.0

Impact— No impact on existing alerts. The compliance score may vary as new mappings are added.

CIS Controls v7.1 & CIS Controls v8.0

24.9.2

New Policy mappings are introduced to the 'NYDFS 23 CRR-NY 500.0' compliance standard across all clouds.

Impact— No impact on existing alerts. The compliance score may vary as new mappings are added.

Framework for Adoption of Cloud Services by SEBI Regulated Entities

24.9.1

Prisma Cloud now supports Consolidated Cybersecurity and Cyber Resilience Framework (CSCRF) released by the Securities and Exchange Board of India (SEBI) for all major cloud providers. CSCRF aims to establish a unified framework that encompasses various strategies to safeguard REs (Regulated Entities) and Market Infrastructure Institutions (MIIs) against cyber risks and incidents. Framework of adoption is part of the SEBI’s overall CSRF standard.

You can view this built-in standard and the associated policies on the Compliance > Standards page. You can also generate reports for immediate viewing or download, or schedule recurring reports to track this compliance standard over time.

Impact— As new mappings are introduced, compliance scoring might vary.

REST API Updates

Change

Description

Asset Explorer APIs

24.9.2

Added dataSecurity response objects to support DSPM API integration.

AWS Logging Account APIs

24.9.2

New AWS logging account APIs are introduced to configure and manage AWS logging accounts that are necessary for AWS flow log ingestion.

Vulnerabilities Dashboard APIs

24.9.2

The following new UVE POST endpoints have been introduced, offering enhanced filtering capabilities. These serve as alternatives to the deprecated UVE GET endpoints.

A new C2C Trace Asset Graph endpoint is introduced to get details about the source of the vulnerability that is displayed in the C2C tracing graph in the UI.

Deprecation Notice

Change

Description

End of support for Azure Active Directory v1 API

This change was first announced in 24.6.2 Look ahead notice

24.9.2

azure-active-directory-credential-user-registration-details API is has been deprecated. Due to this change, Prisma Cloud will no longer ingest metadata for azure-active-directory-credential-user-registration-details API.

In RQL, the key will not be available in the api.name attribute auto-completion. As a replacement, it is recommended to use the azure-active-directory-user-registration-details API.

Impact—If you have a saved search or custom policies based on this API, you must delete those manually. The policy alerts will be resolved as Policy_Deleted.

PreviousFeatures Introduced in October 2024NextFeatures Introduced in August 2024

Last updated

Was this helpful?