> For the complete documentation index, see [llms.txt](https://docs.prismacloud.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.prismacloud.io/release-notes/prisma-cloud-release-information/features-introduced-in-2025/features-introduced-in-august-2025.md).

# Features Introduced in August 2025

Learn what’s new in the Prisma® Cloud August 2025 release.

* [Enhancements](#enhancements)
* [Changes in Existing Behavior](#changes-in-existing-behavior)
* [API Ingestions](#api-ingestions)
* [Policy Updates](#policy-updates)
* [REST API Changes and New APIs](#rest-api-updates)

## Enhancements

| **Feature**                                                                                                                                                                                                 | **Description**                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          |
| ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| <p><strong>Collect Kubernetes Pod labels</strong></p><p><mark style="background-color:orange;">Secure the Runtime</mark></p><p><mark style="background-color:orange;">34.02.133</mark></p>                  | <p>If you enable the Collect Deployment and Namespace Labels toggle while deploying a defender, an environment variable, COLLECT\_POD\_LABELS is set to true in the YAML file or helm chart. Orchestrator defenders that are deployed with this setting use the Kubernetes API while scanning to collect labels of the deployment and namespace resources that contain the pods hosting the containers.</p><p>This feature is enhanced to support a new environment variable, COLLECT\_POD\_RESOURCE\_LABELS. After enabling the Collect Deployment and Namespace Labels toggle, if you add this variable and set it to true, the Orchestrator defenders also collect labels of the pod containing the container.</p><p>Together these two environment variables support the use case of accessing the labels assigned using the command: kubectl label pod.</p><p>You can view these labels in the container details tab, or retrieve them from the externalLabels and labels fields in the response of the API.</p><p><a href="https://pan.dev/prisma-cloud/api/cwpp/get-containers/"><https://pan.dev/prisma-cloud/api/cwpp/get-containers/></a>.</p> |
| <p><strong>Enhanced security coverage for CAAS containers</strong></p><p><mark style="background-color:orange;">Secure the Runtime</mark></p><p><mark style="background-color:orange;">34.02.133</mark></p> | <p>App-embedded defenders now support multi-container CaaS deployments on:</p><ul><li>ACI container groups</li><li>Google Cloud Run platform</li><li>Amazon EKS on AWS Fargate</li></ul><p>Support is now available for these services, augmenting the existing support for Amazon ECS Fargate.</p><p>The enhanced support also includes:</p><ul><li>Account ID attribution for ACI container groups, Google Cloud Run, and AWS EKS on Fargate</li><li>Detection of Defended/Undefended status for ACI container groups, Google Cloud Run, and EKS on Fargate</li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  |
| <p><strong>Enhanced support for OCI tag-based filtering</strong></p><p><mark style="background-color:orange;">Secure the Runtime</mark></p><p><mark style="background-color:orange;">34.02.133</mark></p>   | The tag-based filtering mechanism for Oracle Cloud Infrastructure (OCI) now supports filters at the compartment level. You can now include or exclude hosts at the compartment level using this feature.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 |

## Changes in Existing Behavior

| **Feature**                                    | **Description**                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   |
| ---------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Update to New User Creation Process in CSP** | The process of [creating](https://docs.prismacloud.io/en/enterprise-edition/content-collections/administration/add-prisma-cloud-users) a new user in Prisma Cloud is updated for integrated CSP portal flows. This enhancement prevents unauthorized access or disruptive changes to sensitive CSP environments. All newly created users will appear in a pending state in the CSP portal and will require [explicit approval](https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClNaCAK) by a CSP Super User before they can get access. |

## API Ingestions

| **Service**                          | **API Details**                                                                                                                                                                                                                                                                                 |
| ------------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Alibaba Apsara File Storage NAS**  | <p><strong>alibaba-cloud-network-attach-storage</strong></p><p>Additional permissions required:</p><ul><li><code>nas:List</code></li><li><code>nas:Describe</code></li></ul>                                                                                                                    |
| **Amazon Connect Outbound Campaign** | <p><strong>aws-connect-outbound-campaign</strong></p><p>Additional permissions required:</p><ul><li><code>connect-campaigns:ListCampaigns</code></li><li><code>connect-campaigns:DescribeCampaign</code></li></ul><p>The Security Audit Policy role does not include the above permissions.</p> |

## Policy Updates

<table data-header-hidden><thead><tr><th></th><th></th></tr></thead><tbody><tr><td><strong>Policy Updates</strong></td><td><strong>Description</strong></td></tr><tr><td><strong>Policy Updates—RQL</strong></td><td></td></tr><tr><td><strong>Azure Application Gateway Web application firewall (WAF) policy rule for Remote Command Execution is disabled</strong></td><td><p><strong>Changes–</strong> The policy RQL will be updated to exclude Azure Application Gateway WAF policy not attached with applicationGateways.</p><p><strong>Current RQL–</strong></p><pre><code>config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-application-gateway-waf-policy' AND json.rule = properties.policySettings.state equals Enabled and properties.managedRules.managedRuleSets is not empty and properties.managedRules.managedRuleSets[*].ruleGroupOverrides[*].rules[?any(ruleId equals 944240 and state equals Disabled)] exists and properties.applicationGateways[*] is not empty
</code></pre><p><strong>Updated RQL–</strong></p><pre><code>config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-application-gateway-waf-policy' AND json.rule = properties.policySettings.state equals Enabled and properties.managedRules.managedRuleSets is not empty and properties.managedRules.managedRuleSets[*].ruleGroupOverrides[*].rules[?any(ruleId equals 944240 and state equals Disabled)] exists and (properties.applicationGateways[*] exists and properties.applicationGateways[*] is not empty)
</code></pre><p><strong>Policy Type–</strong> Config</p><p><strong>Policy Severity–</strong> Low</p><p><strong>Impact–</strong> Low. Open alerts where the Azure Application Gateway WAF policy rule for remote command execution with applicationGateways not presented will be resolved.</p></td></tr><tr><td><strong>Azure Cosmos DB IP range filter not configured</strong></td><td><p><strong>Changes–</strong> The policy RQL will be updated to account for the publicNetworkAccess setting.</p><p><strong>Current RQL–</strong></p><pre><code>config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-cosmos-db' AND json.rule = properties.ipRangeFilter is empty
</code></pre><p><strong>Updated RQL–</strong></p><pre><code>config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-cosmos-db' AND json.rule = properties.ipRangeFilter is empty and properties.publicNetworkAccess does not equal ignore case "Disabled"
</code></pre></td></tr><tr><td><strong>Azure Storage Account 'Trusted Microsoft Services' access not enabled</strong></td><td><p><strong>Changes–</strong> The policy RQL will be updated to optimize the RQL to reduce false positives.</p><p><strong>Current RQL–</strong></p><pre><code>config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-storage-account-list' AND json.rule = 'networkRuleSet.bypass does not contain AzureServices'
</code></pre><p><strong>Updated RQL–</strong></p><pre><code>config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-storage-account-list' AND json.rule = 'properties.publicNetworkAccess does not equal ignore case "Disabled" and networkRuleSet.defaultAction equal ignore case "Deny" and networkRuleSet.bypass does not contain AzureServices'
</code></pre><p><strong>Policy Type–</strong> Config</p><p><strong>Policy Severity–</strong> Low</p><p><strong>Impact–</strong> Low. Open Alerts where the 'Trusted Microsoft Services' exceptions cannot be configured will be resolved.</p></td></tr><tr><td><strong>Azure storage account has a blob container with public access</strong></td><td><p><strong>Changes–</strong> The policy RQL will be updated to minimize false positives by refining how it evaluates network parameters that determine public access.</p><p><strong>Current RQL–</strong></p><pre><code>config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-storage-account-list' AND json.rule = totalPublicContainers > 0 and (properties.allowBlobPublicAccess is true or properties.allowBlobPublicAccess does not exist) and properties.publicNetworkAccess equal ignore case Enabled and networkRuleSet.virtualNetworkRules is empty and (properties.privateEndpointConnections is empty or properties.privateEndpointConnections does not exist)
</code></pre><p><strong>Updated RQL–</strong></p><pre><code>config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-storage-account-list' AND json.rule = totalPublicContainers > 0 and (properties.allowBlobPublicAccess is true or properties.allowBlobPublicAccess does not exist) and(properties.publicNetworkAccess equal ignore case Enabled or properties.publicNetworkAccess does not exist) and ((networkRuleSet.defaultAction equal ignore case Allow) or (networkRuleSet.virtualNetworkRules is empty and networkRuleSet.ipRules is empty) or networkRuleSet.ipRules[?any(value equals "0.0.0.0/0")]exists)
</code></pre><p><strong>Policy Type–</strong> Config</p><p><strong>Policy Severity–</strong> High</p><p><strong>Impact–</strong> Medium. Alerts will be triggered for storage accounts where the blob container is publicly accessible and no firewall rules are added to restrict public access. Open alerts will be resolved in case the public access is disabled and iprules have been added to restrict public access.</p></td></tr><tr><td><strong>AWS Application Load Balancer (ALB) is not using the latest predefined security policy</strong></td><td><p><strong>Changes–</strong> The policy will be updated to look for load balancers not using the latest security policy as part of the policy RQL.</p><p><strong>Current Description–</strong></p><p>This policy identifies Application Load Balancers (ALBs) not using the latest predefined security policy. A security policy is a combination of protocols and ciphers. The protocol establishes a secure connection between a client and a server and ensures that all data passed between the client and your load balancer is private. A cipher is an encryption algorithm that uses encryption keys to create a coded message. So it is recommended to use the latest predefined security policy which uses only secured protocol and ciphers.</p><p>We recommend using either non-FIPS security policy ELBSecurityPolicy-TLS13-1-2-2021-06 or FIPS security policy ELBSecurityPolicy-TLS13-1-2-FIPS-2023-04 to meet compliance and security standards that require disabling certain TLS protocol versions or to support legacy clients that require deprecated ciphers.</p><p>For more details: <a href="https://docs.aws.amazon.com/elasticloadbalancing/latest/application/create-https-listener.html#describe-ssl-policies">https://docs.aws.amazon.com/elasticloadbalancing/latest/application/create-https-listener.html#describe-ssl-policies</a></p><p><strong>Updated Description–</strong></p><p>This policy identifies Application Load Balancers (ALBs) are not using the latest predefined security policy. A security policy is a combination of protocols and ciphers. The protocol establishes a secure connection between a client and a server and ensures that all data passed between the client and your load balancer is private. A cipher is an encryption algorithm that uses encryption keys to create a coded message. So it is recommended to use the latest predefined security policy which uses only secured protocol and ciphers.</p><p>We recommend using the latest recomended non-FIPS security policy or FIPS security policy to meet compliance and security standards that require disabling certain TLS protocol versions or to support legacy clients that require deprecated ciphers.</p><p>For more details: <a href="https://docs.aws.amazon.com/elasticloadbalancing/latest/application/describe-ssl-policies.html">https://docs.aws.amazon.com/elasticloadbalancing/latest/application/describe-ssl-policies.html</a></p><p><strong>Current RQL–</strong></p><pre><code>config from cloud.resource where cloud.type = 'aws' AND api.name = 'aws-elbv2-describe-load-balancers' AND json.rule = type equals application and listeners[?any(protocol equals HTTPS and sslPolicy exists and sslPolicy is not member of ('ELBSecurityPolicy-TLS13-1-2-2021-06','ELBSecurityPolicy-TLS13-1-2-FIPS-2023-04'))] exists
</code></pre><p><strong>Updated RQL–</strong></p><pre><code>config from cloud.resource where cloud.type = 'aws' AND api.name = 'aws-elbv2-describe-load-balancers' AND json.rule = type equals application and listeners[?any(protocol equals HTTPS and sslPolicy exists and sslPolicy is not member of ('ELBSecurityPolicy-TLS13-1-2-Res-2021-06','ELBSecurityPolicy-TLS13-1-2-FIPS-2023-04'))] exists
</code></pre><p><strong>Policy Type–</strong> Config</p><p><strong>Policy Severity–</strong> Low</p><p><strong>Impact–</strong> Medium. Open alerts using the latest security policy will be resolved. New alerts will be created if not configured with the latest security policy.</p></td></tr><tr><td><strong>GCP BigQuery Table not encrypted with CMEK</strong></td><td><p><strong>Changes–</strong> The policy RQL will be updated to handle GCP API updates where views are part of gcloud-bigquery-table Prisma Cloud API.</p><p><strong>Current RQL–</strong></p><pre><code>config from cloud.resource where api.name = 'gcloud-bigquery-table' AND json.rule = encryptionConfiguration.kmsKeyName does not exist
</code></pre><p><strong>Updated RQL–</strong></p><pre><code>config from cloud.resource where api.name = 'gcloud-bigquery-table' AND json.rule = type equals "TABLE" AND encryptionConfiguration.kmsKeyName does not exist
</code></pre></td></tr><tr><td><strong>OCI Kubernetes Engine Cluster Pod Security Policy Not Enforced</strong></td><td><p><strong>Changes–</strong> This policy has been updated due to the deprecation of Pod Security Policy (PSP) in newer versions of the OCI Kubernetes Engine (OKE) service. Oracle has shifted its recommended approach for enforcing pod security, rendering the previous policy definition less effective or potentially generating inaccurate findings. The update aligns our policy with the current best practices and capabilities of OKE[<a href="https://docs.oracle.com/en-us/iaas/Content/ContEng/Concepts/contengaboutk8sversions.htm">https://docs.oracle.com/en-us/iaas/Content/ContEng/Concepts/contengaboutk8sversions.htm</a>].</p><p><strong>Current RQL–</strong></p><pre><code>config from cloud.resource where cloud.type = 'oci' AND api.name = 'oci-containers-artifacts-kubernetes-cluster' AND json.rule = lifecycleState equal ignore case ACTIVE and options.admissionControllerOptions.isPodSecurityPolicyEnabled is false
</code></pre><p><strong>Updated RQL–</strong></p><pre><code>config from cloud.resource where cloud.type = 'oci' AND api.name = 'oci-containers-artifacts-kubernetes-cluster' AND json.rule = lifecycleState equal ignore case ACTIVE and options.admissionControllerOptions.isPodSecurityPolicyEnabled is false and (kubernetesVersion contains "v1.24" or kubernetesVersion contains "v1.23" or kubernetesVersion contains "v1.22" or kubernetesVersion contains "v1.21" or kubernetesVersion contains "v1.20" or kubernetesVersion contains "v1.19" or kubernetesVersion contains "v1.18" or kubernetesVersion contains "v1.17" or kubernetesVersion contains "v1.16" or kubernetesVersion contains "v1.15" or kubernetesVersion contains "v1.14" or kubernetesVersion contains "v1.13" or kubernetesVersion contains "v1.12" or kubernetesVersion contains "v1.11" or kubernetesVersion contains "v1.10" or kubernetesVersion contains "v1.9" or kubernetesVersion contains "v1.8")
</code></pre><p><strong>Policy Type–</strong> Config</p><p><strong>Policy Severity–</strong> Low</p><p><strong>Impact–</strong> Existing false positive alerts generated by the previous version of this policy will now be resolved with the status "Policy Updated." This ensures that our security alerts accurately reflect the current state of your OCI Kubernetes environments and helps reduce noise from outdated checks.</p></td></tr><tr><td><strong>Policy Deletion</strong></td><td></td></tr><tr><td><strong>OCI Data Catalog configured with overly permissive network access</strong> policy is removed</td><td><p>This policy is deleted because Oracle updated the OCI Data Catalog service. These updates made the policy redundant.</p><p><strong>Impact</strong>—All alerts will be resolved as Policy Deleted.</p></td></tr></tbody></table>

## REST API Changes and New APIs

| **REST API**                                                                                                                                                                          | **Description**                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        |
| ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| <mark style="background-color:orange;">Update</mark> Azure Database for MySQL and PostgreSQL                                                                                          | <p>Prisma Cloud will no longer ingest metadata for <code>azure-mysql-server</code> and <code>azure-postgresql-server</code> APIs. Due to this change, you will no longer be able to view the list of assets on the Investigate page and perform an RQL search query for this API.</p><p><strong>Impact</strong>—All the resources that were ingested as a part of the <code>azure-mysql-server</code> and <code>azure-postgresql-server</code> APIs will be removed, and all existing alerts associated with the APIs will be resolved as <strong>Resource\_Deleted</strong>.</p>      |
| <p><strong>API field length updates</strong></p><p><mark style="background-color:orange;">Secure the Runtime</mark></p><p><mark style="background-color:orange;">34.02.133</mark></p> | <p>Issues related to the limits on the length of the name and description request body fields in the following APIs have been fixed now:</p><ul><li><a href="https://pan.dev/prisma-cloud/api/cwpp/post-collections/"><https://pan.dev/prisma-cloud/api/cwpp/post-collections/></a></li><li><a href="https://pan.dev/prisma-cloud/api/cwpp/put-collections-id/"><https://pan.dev/prisma-cloud/api/cwpp/put-collections-id/></a></li></ul><p>The character limit for the name field has been extended to 300, and the description field can now accommodate up to 5,000 characters.</p> |


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.prismacloud.io/release-notes/prisma-cloud-release-information/features-introduced-in-2025/features-introduced-in-august-2025.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.