Features Introduced in August 2025

Learn what’s new in the Prisma® Cloud August 2025 release.

• Enhancements
• Changes in Existing Behavior
• API Ingestions
• Policy Updates
• REST API Changes and New APIs

Enhancements

Feature	Description
Collect Kubernetes Pod labels Secure the Runtime 34.02.133	If you enable the Collect Deployment and Namespace Labels toggle while deploying a defender, an environment variable, COLLECT_POD_LABELS is set to true in the YAML file or helm chart. Orchestrator defenders that are deployed with this setting use the Kubernetes API while scanning to collect labels of the deployment and namespace resources that contain the pods hosting the containers. This feature is enhanced to support a new environment variable, COLLECT_POD_RESOURCE_LABELS. After enabling the Collect Deployment and Namespace Labels toggle, if you add this variable and set it to true, the Orchestrator defenders also collect labels of the pod containing the container. Together these two environment variables support the use case of accessing the labels assigned using the command: kubectl label pod. You can view these labels in the container details tab, or retrieve them from the externalLabels and labels fields in the response of the API. https://pan.dev/prisma-cloud/api/cwpp/get-containers/.
Enhanced security coverage for CAAS containers Secure the Runtime 34.02.133	App-embedded defenders now support multi-container CaaS deployments on: ACI container groups Google Cloud Run platform Amazon EKS on AWS Fargate Support is now available for these services, augmenting the existing support for Amazon ECS Fargate. The enhanced support also includes: Account ID attribution for ACI container groups, Google Cloud Run, and AWS EKS on Fargate Detection of Defended/Undefended status for ACI container groups, Google Cloud Run, and EKS on Fargate
Enhanced support for OCI tag-based filtering Secure the Runtime 34.02.133	The tag-based filtering mechanism for Oracle Cloud Infrastructure (OCI) now supports filters at the compartment level. You can now include or exclude hosts at the compartment level using this feature.

Changes in Existing Behavior

Feature	Description
Update to New User Creation Process in CSP	The process of creating a new user in Prisma Cloud is updated for integrated CSP portal flows. This enhancement prevents unauthorized access or disruptive changes to sensitive CSP environments. All newly created users will appear in a pending state in the CSP portal and will require explicit approval by a CSP Super User before they can get access.

API Ingestions

Service	API Details
Alibaba Apsara File Storage NAS	alibaba-cloud-network-attach-storage Additional permissions required: nas:List nas:Describe
Amazon Connect Outbound Campaign	aws-connect-outbound-campaign Additional permissions required: connect-campaigns:ListCampaigns connect-campaigns:DescribeCampaign The Security Audit Policy role does not include the above permissions.

Policy Updates

Policy Updates	Description
Policy Updates—RQL
Azure Application Gateway Web application firewall (WAF) policy rule for Remote Command Execution is disabled	Changes– The policy RQL will be updated to exclude Azure Application Gateway WAF policy not attached with applicationGateways. Current RQL– config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-application-gateway-waf-policy' AND json.rule = properties.policySettings.state equals Enabled and properties.managedRules.managedRuleSets is not empty and properties.managedRules.managedRuleSets[*].ruleGroupOverrides[*].rules[?any(ruleId equals 944240 and state equals Disabled)] exists and properties.applicationGateways[*] is not empty Updated RQL– config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-application-gateway-waf-policy' AND json.rule = properties.policySettings.state equals Enabled and properties.managedRules.managedRuleSets is not empty and properties.managedRules.managedRuleSets[*].ruleGroupOverrides[*].rules[?any(ruleId equals 944240 and state equals Disabled)] exists and (properties.applicationGateways[*] exists and properties.applicationGateways[*] is not empty) Policy Type– Config Policy Severity– Low Impact– Low. Open alerts where the Azure Application Gateway WAF policy rule for remote command execution with applicationGateways not presented will be resolved.
Azure Cosmos DB IP range filter not configured	Changes– The policy RQL will be updated to account for the publicNetworkAccess setting. Current RQL– config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-cosmos-db' AND json.rule = properties.ipRangeFilter is empty Updated RQL– config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-cosmos-db' AND json.rule = properties.ipRangeFilter is empty and properties.publicNetworkAccess does not equal ignore case "Disabled"
Azure Storage Account 'Trusted Microsoft Services' access not enabled	Changes– The policy RQL will be updated to optimize the RQL to reduce false positives. Current RQL– config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-storage-account-list' AND json.rule = 'networkRuleSet.bypass does not contain AzureServices' Updated RQL– config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-storage-account-list' AND json.rule = 'properties.publicNetworkAccess does not equal ignore case "Disabled" and networkRuleSet.defaultAction equal ignore case "Deny" and networkRuleSet.bypass does not contain AzureServices' Policy Type– Config Policy Severity– Low Impact– Low. Open Alerts where the 'Trusted Microsoft Services' exceptions cannot be configured will be resolved.
Azure storage account has a blob container with public access	Changes– The policy RQL will be updated to minimize false positives by refining how it evaluates network parameters that determine public access. Current RQL– config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-storage-account-list' AND json.rule = totalPublicContainers > 0 and (properties.allowBlobPublicAccess is true or properties.allowBlobPublicAccess does not exist) and properties.publicNetworkAccess equal ignore case Enabled and networkRuleSet.virtualNetworkRules is empty and (properties.privateEndpointConnections is empty or properties.privateEndpointConnections does not exist) Updated RQL– config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-storage-account-list' AND json.rule = totalPublicContainers > 0 and (properties.allowBlobPublicAccess is true or properties.allowBlobPublicAccess does not exist) and(properties.publicNetworkAccess equal ignore case Enabled or properties.publicNetworkAccess does not exist) and ((networkRuleSet.defaultAction equal ignore case Allow) or (networkRuleSet.virtualNetworkRules is empty and networkRuleSet.ipRules is empty) or networkRuleSet.ipRules[?any(value equals "0.0.0.0/0")]exists) Policy Type– Config Policy Severity– High Impact– Medium. Alerts will be triggered for storage accounts where the blob container is publicly accessible and no firewall rules are added to restrict public access. Open alerts will be resolved in case the public access is disabled and iprules have been added to restrict public access.
AWS Application Load Balancer (ALB) is not using the latest predefined security policy	Changes– The policy will be updated to look for load balancers not using the latest security policy as part of the policy RQL. Current Description– This policy identifies Application Load Balancers (ALBs) not using the latest predefined security policy. A security policy is a combination of protocols and ciphers. The protocol establishes a secure connection between a client and a server and ensures that all data passed between the client and your load balancer is private. A cipher is an encryption algorithm that uses encryption keys to create a coded message. So it is recommended to use the latest predefined security policy which uses only secured protocol and ciphers. We recommend using either non-FIPS security policy ELBSecurityPolicy-TLS13-1-2-2021-06 or FIPS security policy ELBSecurityPolicy-TLS13-1-2-FIPS-2023-04 to meet compliance and security standards that require disabling certain TLS protocol versions or to support legacy clients that require deprecated ciphers. For more details: https://docs.aws.amazon.com/elasticloadbalancing/latest/application/create-https-listener.html#describe-ssl-policies Updated Description– This policy identifies Application Load Balancers (ALBs) are not using the latest predefined security policy. A security policy is a combination of protocols and ciphers. The protocol establishes a secure connection between a client and a server and ensures that all data passed between the client and your load balancer is private. A cipher is an encryption algorithm that uses encryption keys to create a coded message. So it is recommended to use the latest predefined security policy which uses only secured protocol and ciphers. We recommend using the latest recomended non-FIPS security policy or FIPS security policy to meet compliance and security standards that require disabling certain TLS protocol versions or to support legacy clients that require deprecated ciphers. For more details: https://docs.aws.amazon.com/elasticloadbalancing/latest/application/describe-ssl-policies.html Current RQL– config from cloud.resource where cloud.type = 'aws' AND api.name = 'aws-elbv2-describe-load-balancers' AND json.rule = type equals application and listeners[?any(protocol equals HTTPS and sslPolicy exists and sslPolicy is not member of ('ELBSecurityPolicy-TLS13-1-2-2021-06','ELBSecurityPolicy-TLS13-1-2-FIPS-2023-04'))] exists Updated RQL– config from cloud.resource where cloud.type = 'aws' AND api.name = 'aws-elbv2-describe-load-balancers' AND json.rule = type equals application and listeners[?any(protocol equals HTTPS and sslPolicy exists and sslPolicy is not member of ('ELBSecurityPolicy-TLS13-1-2-Res-2021-06','ELBSecurityPolicy-TLS13-1-2-FIPS-2023-04'))] exists Policy Type– Config Policy Severity– Low Impact– Medium. Open alerts using the latest security policy will be resolved. New alerts will be created if not configured with the latest security policy.
GCP BigQuery Table not encrypted with CMEK	Changes– The policy RQL will be updated to handle GCP API updates where views are part of gcloud-bigquery-table Prisma Cloud API. Current RQL– config from cloud.resource where api.name = 'gcloud-bigquery-table' AND json.rule = encryptionConfiguration.kmsKeyName does not exist Updated RQL– config from cloud.resource where api.name = 'gcloud-bigquery-table' AND json.rule = type equals "TABLE" AND encryptionConfiguration.kmsKeyName does not exist
OCI Kubernetes Engine Cluster Pod Security Policy Not Enforced	Changes– This policy has been updated due to the deprecation of Pod Security Policy (PSP) in newer versions of the OCI Kubernetes Engine (OKE) service. Oracle has shifted its recommended approach for enforcing pod security, rendering the previous policy definition less effective or potentially generating inaccurate findings. The update aligns our policy with the current best practices and capabilities of OKE[https://docs.oracle.com/en-us/iaas/Content/ContEng/Concepts/contengaboutk8sversions.htm]. Current RQL– config from cloud.resource where cloud.type = 'oci' AND api.name = 'oci-containers-artifacts-kubernetes-cluster' AND json.rule = lifecycleState equal ignore case ACTIVE and options.admissionControllerOptions.isPodSecurityPolicyEnabled is false Updated RQL– config from cloud.resource where cloud.type = 'oci' AND api.name = 'oci-containers-artifacts-kubernetes-cluster' AND json.rule = lifecycleState equal ignore case ACTIVE and options.admissionControllerOptions.isPodSecurityPolicyEnabled is false and (kubernetesVersion contains "v1.24" or kubernetesVersion contains "v1.23" or kubernetesVersion contains "v1.22" or kubernetesVersion contains "v1.21" or kubernetesVersion contains "v1.20" or kubernetesVersion contains "v1.19" or kubernetesVersion contains "v1.18" or kubernetesVersion contains "v1.17" or kubernetesVersion contains "v1.16" or kubernetesVersion contains "v1.15" or kubernetesVersion contains "v1.14" or kubernetesVersion contains "v1.13" or kubernetesVersion contains "v1.12" or kubernetesVersion contains "v1.11" or kubernetesVersion contains "v1.10" or kubernetesVersion contains "v1.9" or kubernetesVersion contains "v1.8") Policy Type– Config Policy Severity– Low Impact– Existing false positive alerts generated by the previous version of this policy will now be resolved with the status "Policy Updated." This ensures that our security alerts accurately reflect the current state of your OCI Kubernetes environments and helps reduce noise from outdated checks.
Policy Deletion
OCI Data Catalog configured with overly permissive network access policy is removed	This policy is deleted because Oracle updated the OCI Data Catalog service. These updates made the policy redundant. Impact—All alerts will be resolved as Policy Deleted.

REST API Changes and New APIs

REST API	Description
Update Azure Database for MySQL and PostgreSQL	Prisma Cloud will no longer ingest metadata for azure-mysql-server and azure-postgresql-server APIs. Due to this change, you will no longer be able to view the list of assets on the Investigate page and perform an RQL search query for this API. Impact—All the resources that were ingested as a part of the azure-mysql-server and azure-postgresql-server APIs will be removed, and all existing alerts associated with the APIs will be resolved as Resource_Deleted.
API field length updates Secure the Runtime 34.02.133	Issues related to the limits on the length of the name and description request body fields in the following APIs have been fixed now: https://pan.dev/prisma-cloud/api/cwpp/post-collections/ https://pan.dev/prisma-cloud/api/cwpp/put-collections-id/ The character limit for the name field has been extended to 300, and the description field can now accommodate up to 5,000 characters.