> For the complete documentation index, see [llms.txt](https://docs.prismacloud.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.prismacloud.io/release-notes/prisma-cloud-release-information/features-introduced-in-2025/features-introduced-in-january-2025.md).

# Features Introduced in January 2025

Learn what’s new on Prisma® Cloud in January 2025.

* [New Features](#new-features)
* [Changes in Existing Behavior](#changes-in-existing-behavior)
* [API Ingestions](#api-ingestions)
* [New Policies](#new-policies)
* [Policy Updates](#policy-updates)
* [IAM Policy Updates](#iam-policy-updates)
* [New Compliance Benchmarks and Updates](#new-compliance-benchmarks-and-updates)
* [REST API Updates](#rest-api-updates)

## New Features

| **Feature**                                                                                                                                                                                                                                               | **Description**                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    |
| --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| <p><strong>Enhanced Remediation</strong></p><p><mark style="background-color:orange;">Secure the Infrastructure</mark></p><p><mark style="background-color:orange;">25.1.1</mark></p>                                                                     | <p>Enhanced Remediation improves the quality and effectiveness of Prisma Cloud security alert remediation guidance. It leverages artificial intelligence (AI) to assist your teams in enhancing remediation content for existing alerts and policies, while ensuring all recommendations undergo review and validation. The recommendations now provide AI-assisted remediation steps for Critical and High Alerts. It provides you with a seamless and intuitive experience allowing you to quickly access and understand the remediation steps.</p><ul><li><p><strong>Alerts</strong> includes a new <strong>Enhanced Remediation</strong> Saved View. When you select <strong>Enhanced Remediation</strong> filter option as <strong>Yes</strong>, you can view the alerts that you can resolve using enhanced remediation.</p><div><figure><img src="/files/l7bCHmUYEdbm5dW7U7HL" alt="enhanced remediation 1"><figcaption></figcaption></figure></div></li><li><p>Click the <strong>Alert ID</strong> to view the new <strong>How to Fix</strong> tab (previously known as Recommendations) with the various remediation options.</p><div><figure><img src="/files/t0qCLiwatLv5wJ4Had1h" alt="enhanced remediation 4"><figcaption></figcaption></figure></div></li><li><p>Expand the accordion to fix the alert with either <strong>Manual Remediation in Console</strong> (previously known as Recommendation Steps), <strong>Remediate with Terraform Template</strong>, or <strong>Remediate with CLI Command</strong>.</p><div><figure><img src="/files/864omrpgfQ54OiaoTlTB" alt="enhanced remediation 6"><figcaption></figcaption></figure></div></li></ul><p>There are multiple clickable boxes for each finding that are part of the Attack Path. For individual alerts, such as standalone policies, there is only one box. For alerts or policies that do not have Terraform or CLI, only Manual remediation is available.</p>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      |
| <p><strong>Microsoft Entra ID Visibility</strong></p><p><mark style="background-color:orange;">Secure the Infrastructure</mark></p><p><mark style="background-color:orange;">25.1.1</mark></p>                                                            | Enhancements to the Cloud Infrastructure and Entitlement Management (CIEM) capabilities provide greater visibility and control over Microsoft Azure Entra ID permissions, helping you secure your identities with greater efficiency. You can now investigate not only Azure but also Entra ID specific permissions, such as identifying entities with the Global Administrator role. Use the `grantedby.level.type` attribute in combination with all existing RQL queries to investigate Entra ID permissions.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   |
| <p><strong>ARM Framework Support for Custom Build Policies</strong></p><p><mark style="background-color:orange;">Secure the Source</mark></p><p><mark style="background-color:orange;">25.1.1</mark></p>                                                  | You can now create [custom build policies](https://docs.prismacloud.io/en/enterprise-edition/content-collections/governance/custom-build-policies/custom-build-policies) that include ARM. These policies can be applied to both ARM and Bicep using shared arguments and syntax, or you can restrict the policy to either ARM or Bicep. Additionally, the ARM framework now supports both explicit and implicit dependencies.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     |
| <p><strong>Enhancements to Vulnerability Reporting for Red Hat Enterprise Linux (RHEL) Versions 8 and 9</strong></p><p><mark style="background-color:orange;">Secure the Runtime</mark></p><p><mark style="background-color:orange;">33.03.138</mark></p> | <p>To ensure accurate vulnerability reporting, Intelligence Stream includes RPM module and stream information for RHEL in the reports. This approach improves detection of vulnerabilities and ensures that all associated RPM packages installed by a module are examined during the scan.</p><p><strong>What are RPM Modules and Streams?</strong></p><p>In Red Hat Enterprise Linux (RHEL), an RPM module is a collection of related RPM packages that represent a software component, such as an application, its dependencies, and helper utilities. Starting with RHEL 6 and 7, modules replaced the Software Collections mechanism.</p><p>Modules are structured in the following way:</p><ul><li><strong>Module Streams</strong>: Virtual repositories within the AppStream repository. Each stream corresponds to a specific version of the module and receives independent updates.</li><li><strong>Stream Activation</strong>: At any time, only one stream of a module can be active, meaning only one version of a component can be installed on a system.</li></ul><p>For example, the notation <code>python39:3.9/python39</code> indicates the module <code>python39</code>, the stream <code>3.9</code>, and the source package <code>python39</code>.</p><p><strong>Enhancements to Vulnerability Reporting</strong></p><ul><li><strong>Module-Based Vulnerability Identification</strong>: Scans will report vulnerabilities based on the module and stream configuration. This ensures accurate detection and avoids false positives or false negatives caused by discrepancies in versioning or backported fixes.</li><li><strong>Inclusion of RPM Module Metadata in Scan Results</strong>: The enhanced implementation associates RPM packages with their respective modules and streams. The Prisma Cloud console will include this module information in vulnerability scan results.</li></ul><p><strong>Benefits of Module-Aware Vulnerability Reporting</strong></p><ul><li><strong>Improved Accuracy</strong>: Matches CVE fixes to the correct module stream.</li><li><strong>Reduced False Positives</strong>: Avoids misreporting of vulnerabilities fixed in older streams.</li><li><strong>Comprehensive Coverage</strong>: Links all RPM packages installed by a module to its vulnerabilities.</li></ul><p><strong>NOTE</strong>:</p><ul><li>This enhancement requires upgrading Defenders to the latest version.</li><li>The older versions of Defender will remain unaffected by this change, and their behavior remains unchanged.</li></ul> |
| <p><strong>Enhanced Vulnerability Reporting for NuGet Packages</strong></p><p><mark style="background-color:orange;">Secure the Runtime</mark></p><p><mark style="background-color:orange;">33.03.138</mark></p>                                          | <p>Previously, the scanning process included NuGet packages listed in the <code>.deps.json</code> files, which were essential for the runtime environment but not related to the application itself. These unrelated packages result in false positives in vulnerability reporting.</p><p>With this enhancement, the scanning process excludes runtime-specific dependencies that are not directly related to the application. This provides a more accurate view of vulnerabilities directly associated with the application, and reduces false positive alerts.</p><p><strong>NOTE</strong>:</p><ul><li>This enhancement requires upgrading Defenders to the latest version.</li><li>The updated Defender accurately identifies package dependencies, which leads to fewer false positives.</li><li>The older versions of Defender will remain unaffected by this change, and their behavior remains unchanged.</li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        |
| <p><strong>Enhancement to Prevent Action with <code>fsmon\_v2</code></strong></p><p><mark style="background-color:orange;">Secure the Runtime</mark></p><p><mark style="background-color:orange;">33.03.138</mark></p>                                    | <p>To enhance the handling of file system events for the Prevent Action in the Runtime Policy, a new version, fsmon\_v2, has been developed. This version improves stability by managing timeouts more promptly and in a robust manner, thereby reducing bottlenecks and enhancing overall stability.</p><p>While <code>fsmon\_v2</code> brings significant improvements, it is still under active development, and further enhancements are planned. Currently, <code>fsmon\_v2</code> is being rolled out gradually.</p><p>This feature is disabled by default. Customers who want to activate this feature should submit a ticket requesting engineering to enable it.</p>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      |
| <p>"last-connected" Field Added to Defender Stats Logs</p><p><mark style="background-color:orange;">Secure the Runtime</mark></p><p><mark style="background-color:orange;">33.03.138</mark></p>                                                           | A new field, last-connected, has been added to each Defender stats log. This field records the last confirmed connection time between the Defender and the Console, even when the Connected flag is set to false. The timestamp is represented in epoch seconds (UTC), providing customers with a reliable way to track connection history.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        |

## Changes in Existing Behavior

| **Feature**                                           | **Description**                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         |
| ----------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Additional Permissions Required to Onboard DSPM**   | AWS Key Rotation permissions are now required to onboard Prisma Cloud DSPM. AWS key rotation is used to enhance security by regularly replacing cryptographic keys. See [AWS Permissions](https://docs.prismacloud.io/en/enterprise-edition/content-collections/data-security-posture-management/prisma-cloud-dspm-deployment/deploy-prisma-cloud-dspm-on-aws/aws-permissions) for the full list of permissions required.                                                                                                                                                                                                                                                                                                                                                                                                               |
| **New Rate Limits for Search API**                    | <p>To improve user experience and enhance search performance, rate limits are implemented for the following APIs:</p><ul><li><p><strong>Config Search</strong></p><ul><li><a href="https://pan.dev/prisma-cloud/api/cspm/search-config/">search/config</a></li><li><a href="https://pan.dev/prisma-cloud/api/cspm/search-config-page/">search/config/page</a></li></ul></li><li><p><strong>Config Search v1</strong></p><ul><li><a href="https://pan.dev/prisma-cloud/api/cspm/search-config-by-query/">search/api/v1/config</a></li></ul></li></ul><p>Request Rate Limit = 150</p><p><strong>Impact—</strong> Requests exceeding the limits will result in an <strong>HTTP 429</strong> Too Many Requests response. See Prisma Cloud API guidance on <a href="https://pan.dev/prisma-cloud/api/cspm/rate-limits/">Rate Limits</a>.</p> |
| **Custom IAM Policies Alert Triggers**                | <p>Custom policies regarding unused permissions will trigger alerts when there is zero usage of the action with <code>""</code> regex across any of the destinations. If the action has been used on at least one resource that matches the <code>""</code> regex, the alert will be resolved.</p><p><strong>Impact—</strong> This change may impact existing alerts for unused permissions with <code>\*</code> and could potentially dismiss them.</p>                                                                                                                                                                                                                                                                                                                                                                                |
| **Downgraded Permissions Required to Onboard GitLab** | `Organization owner` permissions are no longer required for integrating [GitLab SaaS](https://docs.prismacloud.io/en/enterprise-edition/content-collections/application-security/get-started/connect-code-and-build-providers/code-repositories/add-gitlab#user-permissions) or [GitLab on-prem](https://docs.prismacloud.io/en/enterprise-edition/content-collections/application-security/get-started/connect-code-and-build-providers/code-repositories/add-gitlab-selfmanaged). `Maintainer` permissions are sufficient. This change enhances security by adhering to the principle of least privilege.                                                                                                                                                                                                                             |

## API Ingestions

| **Service**                                                                                            | **API Details**                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |
| ------------------------------------------------------------------------------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Amazon Athena**                                                                                      | <p><strong>aws-athena-table-metadata</strong></p><p>Additional permissions needed:</p><ul><li><code>athena:ListDataCatalogs</code></li><li><code>athena:ListDatabases</code></li><li><code>athena:ListTableMetadata</code></li><li><code>glue:GetTables</code></li></ul><p>The Security Audit role includes the permissions.</p>                                                                                                                                                                      |
| <p><strong>Amazon CodePipeline</strong></p><p><mark style="background-color:orange;">Update</mark></p> | <p><strong>aws-code-pipeline-pipeline</strong></p><p>The resource JSON for the API has been updated to include new fields:</p><ul><li><code>stages</code></li><li><code>Deploy</code></li><li><code>Source</code></li><li><code>Build</code></li></ul>                                                                                                                                                                                                                                                |
| **Amazon Cognito**                                                                                     | <p><strong>aws-cognito-user-pool-group</strong></p><p>Additional permissions needed:</p><ul><li><code>cognito-idp:ListUserPools</code></li><li><code>cognito-idp:ListGroups</code></li><li><code>cognito-idp:GetGroup</code></li></ul><p>The Security Audit role only includes the <code>cognito-idp:ListUserPools</code> and <code>cognito-idp:ListGroups</code> permissions.</p><p>You must manually update the <code>cognito-idp:GetGroup</code> permission in the CFT template and enable it.</p> |
| **Amazon Cognito**                                                                                     | <p><strong>aws-cognito-user</strong></p><p>Additional permissions needed:</p><ul><li><code>cognito-idp:ListUserPools</code></li><li><code>cognito-idp:ListUsers</code></li></ul><p>The Security Audit role includes the permissions.</p>                                                                                                                                                                                                                                                              |
| <p><strong>Amazon Cognito</strong></p><p><mark style="background-color:orange;">Update</mark></p>      | <p><strong>aws-cognito-user-pool</strong></p><p>The resource JSON for the API has been updated to include new fields:</p><ul><li><code>passwordPolicy</code></li><li><code>AdvancedSecurityMode</code></li><li><code>riskConfiguration</code></li></ul>                                                                                                                                                                                                                                               |
| **AWS Directory Service**                                                                              | <p><strong>aws-ds-directory-trust</strong></p><p>Additional permission needed:</p><ul><li><code>ds:DescribeTrusts</code></li></ul><p>The Security Audit role does not include the above permission. You must manually update the CFT template to enable it.</p>                                                                                                                                                                                                                                       |
| **Amazon EC2**                                                                                         | <p><strong>aws-ec2-spot-fleet-request</strong></p><p>Additional permission needed:</p><ul><li><code>ec2:DescribeSpotFleetRequests</code></li></ul><p>The Security Audit role includes the permission.</p>                                                                                                                                                                                                                                                                                             |
| **Amazon EC2**                                                                                         | <p><strong>aws-ec2-serial-console-access-status</strong></p><p>Additional permission needed:</p><ul><li><code>ec2:GetSerialConsoleAccessStatus</code></li></ul><p>The Security Audit role does not include the above permission. You must manually update the CFT template to enable it.</p>                                                                                                                                                                                                          |
| <p><strong>Amazon EC2</strong></p><p><mark style="background-color:orange;">Update</mark></p>          | <p><strong>aws-ec2-describe-images</strong></p><p>The resource JSON for this API includes the <code>deprecationTime</code> field.</p>                                                                                                                                                                                                                                                                                                                                                                 |
| **Amazon ElastiCache**                                                                                 | <p><strong>aws-elasticache-serverless-cache</strong></p><p>Additional permissions needed:</p><ul><li><code>elasticache:DescribeServerlessCaches</code></li><li><code>elasticache:ListTagsForResource</code></li></ul><p>The Security Audit role includes the permissions.</p>                                                                                                                                                                                                                         |
| **Amazon Elasticsearch Service**                                                                       | <p><strong>aws-es-batch-get-collection</strong></p><p>Additional permissions needed:</p><ul><li><code>aoss:ListCollections</code></li><li><code>aoss:BatchGetCollection</code></li><li><code>aoss:ListTagsForResource</code></li></ul><p>The Security Audit role includes the permissions.</p>                                                                                                                                                                                                        |
| **Amazon Elasticsearch Service**                                                                       | <p><strong>aws-es-security-config</strong></p><p>Additional permission needed:</p><ul><li><code>aoss:ListSecurityConfigs</code></li></ul><p>The Security Audit role includes the permission.</p>                                                                                                                                                                                                                                                                                                      |
| **Amazon Fraud Detector**                                                                              | <p><strong>aws-fraud-detector-entity-type</strong></p><p>Additional permissions needed:</p><ul><li><code>frauddetector:GetEntityTypes</code></li><li><code>frauddetector:ListTagsForResource</code></li></ul><p>The Security Audit role does not include the above permissions. You must manually update the CFT template to enable them.</p>                                                                                                                                                         |
| **Amazon Fraud Detector**                                                                              | <p><strong>aws-fraud-detector-label</strong></p><p>Additional permissions needed:</p><ul><li><code>frauddetector:GetLabels</code></li><li><code>frauddetector:ListTagsForResource</code></li></ul><p>The Security Audit role does not include the above permissions. You must manually update the CFT template to enable them.</p>                                                                                                                                                                    |
| **Amazon Fraud Detector**                                                                              | <p><strong>aws-fraud-detector-variable</strong></p><p>Additional permission needed:</p><ul><li><code>frauddetector:GetVariables</code></li></ul><p>The Security Audit role does not include the above permission. You must manually update the CFT template to enable it.</p>                                                                                                                                                                                                                         |
| **AWS Global Accelerator**                                                                             | <p><strong>aws-global-accelerator-endpoint-group</strong></p><p>Additional permissions needed:</p><ul><li><code>globalaccelerator:ListAccelerators</code></li><li><code>globalaccelerator:ListListeners</code></li><li><code>globalaccelerator:DescribeListener</code></li><li><code>globalaccelerator:ListEndpointGroups</code></li><li><code>globalaccelerator:DescribeEndpointGroup</code></li></ul><p>The Security Audit role includes the permissions.</p>                                       |
| **AWS Global Accelerator**                                                                             | <p><strong>aws-global-accelerator-listener</strong></p><p>Additional permissions needed:</p><ul><li><code>globalaccelerator:ListAccelerators</code></li><li><code>globalaccelerator:ListListeners</code></li><li><code>globalaccelerator:DescribeListener</code></li></ul><p>The Security Audit role includes the permissions.</p>                                                                                                                                                                    |
| **AWS Glue**                                                                                           | <p><strong>aws-glue-dev-endpoint</strong></p><p>Additional permission needed:</p><ul><li><code>glue:GetDevEndpoints</code></li></ul><p>The Security Audit role includes the permission.</p>                                                                                                                                                                                                                                                                                                           |
| **AWS IAM**                                                                                            | <p><strong>aws-iam-service-specific-credential</strong></p><p>Additional permissions needed:</p><ul><li><code>iam:ListUsers</code></li><li><code>iam:ListServiceSpecificCredentials</code></li></ul><p>The Security Audit role includes the permissions.</p>                                                                                                                                                                                                                                          |
| **AWS IAM Identity Center**                                                                            | <p><strong>aws-iam-identity-center-instance</strong></p><p>Additional permission needed:</p><ul><li><code>sso:ListInstances</code></li></ul><p>The Security Audit role includes the permission.</p>                                                                                                                                                                                                                                                                                                   |
| **Amazon Lightsail**                                                                                   | <p><strong>aws-lightsail-container-service</strong></p><p>Additional permission needed:</p><ul><li><code>lightsail:GetContainerServices</code></li></ul><p>The Security Audit role includes the permission.</p>                                                                                                                                                                                                                                                                                       |
| **Amazon Lightsail**                                                                                   | <p><strong>aws-lightsail-key-pair</strong></p><p>Additional permission needed:</p><ul><li><code>lightsail:GetKeyPairs</code></li></ul><p>The Security Audit role does not include the above permission. You must manually update the CFT template to enable it.</p>                                                                                                                                                                                                                                   |
| **Amazon MSK**                                                                                         | <p><strong>aws-msk-configuration</strong></p><p>Additional permissions needed:</p><ul><li><code>kafka:ListConfigurations</code></li><li><code>kafka:DescribeConfiguration</code></li></ul><p>The Security Audit role includes the permissions.</p>                                                                                                                                                                                                                                                    |
| **AWS Network Manager**                                                                                | <p><strong>aws-network-manager-global-network-device</strong></p><p>Additional permissions needed:</p><ul><li><code>networkmanager:DescribeGlobalNetworks</code></li><li><code>networkmanager:GetDevices</code></li></ul><p>The Security Audit role only includes the <code>networkmanager:DescribeGlobalNetworks</code> permission.</p><p>You must manually update the <code>networkmanager:GetDevices</code> permission in the CFT template and enable it.</p>                                      |
| **Amazon Personalize**                                                                                 | <p><strong>aws-personalize-dataset-import-job</strong></p><p>Additional permission needed:</p><ul><li><code>personalize:ListDatasetImportJobs</code></li></ul><p>The Security Audit role does not include the above permission. You must manually update the CFT template to enable it.</p>                                                                                                                                                                                                           |
| **Amazon Recycle Bin**                                                                                 | <p><strong>aws-recycle-bin-ami-rule</strong></p><p>Additional permissions needed:</p><ul><li><code>rbin:ListRules</code></li><li><code>rbin:GetRule</code></li><li><code>rbin:ListTagsForResource</code></li></ul><p>The Security Audit role does not include the above permissions. You must manually update the CFT template to enable them.</p>                                                                                                                                                    |
| **Amazon SageMaker**                                                                                   | <p><strong>aws-sagemaker-studio-lifecycle-config</strong></p><p>Additional permissions needed:</p><ul><li><code>sagemaker:ListStudioLifecycleConfigs</code></li><li><code>sagemaker:DescribeStudioLifecycleConfig</code></li></ul><p>The Security Audit role includes the permissions.</p>                                                                                                                                                                                                            |
| **Amazon SES**                                                                                         | <p><strong>aws-ses-template</strong></p><p>Additional permissions needed:</p><ul><li><code>ses:ListTemplates</code></li><li><code>ses:GetTemplate</code></li></ul><p>The Security Audit role does not include the above permissions. You must manually update the CFT template to enable them.</p>                                                                                                                                                                                                    |
| <p><strong>AWS Step Functions</strong></p><p><mark style="background-color:orange;">Update</mark></p>  | <p><strong>aws-step-functions-statemachine</strong></p><p>The resource JSON for this API includes the <code>definition</code> field.</p>                                                                                                                                                                                                                                                                                                                                                              |
| **Amazon Translate**                                                                                   | <p><strong>aws-translate-text-translation-job</strong></p><p>Additional permissions needed:</p><ul><li><code>translate:ListTextTranslationJobs</code></li><li><code>translate:DescribeTextTranslationJob</code></li></ul><p>The Security Audit role only includes <code>translate:ListTextTranslationJobs</code> permission.</p><p>You must manually include <code>translate:DescribeTextTranslationJob</code> permission in the CFT template to enable it.</p>                                       |
| **Amazon VPC Lattice**                                                                                 | <p><strong>aws-vpc-lattice-service-network</strong></p><p>Additional permissions needed:</p><ul><li><code>vpc-lattice:ListServiceNetworks</code></li><li><code>vpc-lattice:GetServiceNetwork</code></li><li><code>vpc-lattice:ListTagsForResource</code></li></ul><p>The Security Audit role does not include the above permissions. You must manually update the CFT template to enable them.</p>                                                                                                    |
| **AWS Glue DataBrew**                                                                                  | <p><strong>aws-glue-data-brew-project</strong></p><p>Additional permissions needed:</p><ul><li><code>databrew:ListProjects</code></li><li><code>databrew:DescribeProject</code></li></ul><p>The Security Audit role includes the permissions.</p>                                                                                                                                                                                                                                                     |
| **Azure Active Directory**                                                                             | <p><strong>azure-active-directory-group-lifecycle-policies</strong></p><p>Additional permission needed:</p><ul><li><code>Directory.Read.All</code></li></ul><p>The Reader role includes the permission.</p>                                                                                                                                                                                                                                                                                           |
| **Azure API Management Service**                                                                       | <p><strong>azure-api-management-service-apis</strong></p><p>Additional permission needed:</p><ul><li><code>Microsoft.ApiManagement/service/apis/read</code></li></ul><p>The Reader role includes the permission.</p>                                                                                                                                                                                                                                                                                  |
| **Azure App Service**                                                                                  | <p><strong>azure-app-service-web-apps-app-settings</strong></p><p>Additional permissions needed:</p><ul><li><code>Microsoft.Web/sites/Read</code></li><li><code>Microsoft.Web/sites/config/list/Action</code></li></ul><p>The Reader role includes the permissions.</p>                                                                                                                                                                                                                               |
| **Azure Batch Account**                                                                                | <p><strong>azure-batch-account-application</strong></p><p>Additional permissions needed:</p><ul><li><code>Microsoft.Batch/batchAccounts/read</code></li><li><code>Microsoft.Batch/batchAccounts/applications/read</code></li></ul><p>The Reader role includes the permissions.</p>                                                                                                                                                                                                                    |
| **Azure Database for PostgreSQL**                                                                      | <p><strong>azure-postgresql-flexible-server-configurations</strong></p><p>Additional permissions needed:</p><ul><li><code>Microsoft.DBforPostgreSQL/flexibleServers/read</code></li><li><code>Microsoft.DBforPostgreSQL/flexibleServers/configurations/read</code></li></ul><p>The Reader role includes the permissions.</p>                                                                                                                                                                          |
| **Azure Load Testing**                                                                                 | <p><strong>azure-loadtest-service-outbound-network-endpoint</strong></p><p>Additional permissions needed:</p><ul><li><code>Microsoft.LoadTestService/loadTests/read</code></li><li><code>Microsoft.LoadTestService/loadTests/outboundNetworkDependenciesEndpoints/read</code></li></ul><p>The Reader role includes the permissions.</p>                                                                                                                                                               |
| **Google Identity Aware Proxy**                                                                        | <p><strong>gcloud-identity-aware-proxy-all-web-services-settings</strong></p><p>Additional permission needed:</p><ul><li><code>iap.web.getSettings</code></li></ul><p>The Viewer role includes the above permission.</p>                                                                                                                                                                                                                                                                              |
| **Google Identity Aware Proxy**                                                                        | <p><strong>gcloud-identity-aware-proxy-compute-settings</strong></p><p>Additional permission needed:</p><ul><li><code>iap.webTypes.getSettings</code></li></ul><p>The Viewer role includes the above permission.</p>                                                                                                                                                                                                                                                                                  |
| **Google Identity Aware Proxy Forwarding**                                                             | <p><strong>gcloud-identity-aware-proxy-forwarding-rule-settings</strong></p><p>Additional permission needed:</p><ul><li><code>iap.webTypes.getSettings</code></li></ul><p>The Viewer role includes the above permission.</p>                                                                                                                                                                                                                                                                          |
| **Google Identity Aware Proxy**                                                                        | <p><strong>gcloud-identity-aware-proxy-project-settings</strong></p><p>Additional permission needed:</p><ul><li><code>iap.webTypes.getSettings</code></li></ul><p>The Viewer role includes the above permission.</p>                                                                                                                                                                                                                                                                                  |
| **OCI Vaults**                                                                                         | <p><strong>oci-vault-key</strong></p><p>Additional permissions needed:</p><ul><li><code>KEY\_INSPECT</code></li><li><code>KEY\_READ</code></li></ul><p>You must update the Terraform template to enable the permissions.</p>                                                                                                                                                                                                                                                                          |

## New Policies

<table data-header-hidden><thead><tr><th></th><th></th></tr></thead><tbody><tr><td><strong>Policies</strong></td><td><strong>Description</strong></td></tr><tr><td><strong>AWS Connect instance not configured with contact flow logs</strong></td><td><p>This policy identifies the Amazon Connect instance configured with CONTACTFLOW_LOGS set to false in Amazon Connect. Enabling CONTACTFLOW_LOGS in Amazon Connect is crucial as it allows real-time logging of contact flow executions to CloudWatch. This helps in debugging, monitoring, and optimizing customer interactions by tracking steps, conditions, and errors.</p><p>It is recommended to enable CONTACTFLOW_LOGS to enhance monitoring and ensure adherence to security policies and regulations.</p><p><strong>Policy Severity—</strong> Informational</p><p><strong>Policy Type—</strong> Config</p><p><strong>RQL—</strong></p><pre><code>config from cloud.resource where api.name = 'aws-connect-instance' AND json.rule = InstanceStatus equals "ACTIVE" and attributes[?any( AttributeType equals "CONTACTFLOW_LOGS" and Value equals "false" )] exists
</code></pre></td></tr><tr><td><strong>AWS Connect instance using publicly accessible S3 bucket</strong></td><td><p>This policy identifies the S3 bucket used by AWS Connect instances for storing CHAT_TRANSCRIPTS, CALL_RECORDINGS, and SCREEN_RECORDINGS, which are publicly accessible.The S3 bucket containing CHAT_TRANSCRIPTS, CALL_RECORDINGS, or SCREEN_RECORDINGS being publicly accessible is significant, as it exposes sensitive customer data and internal data to the public.</p><p>It is recommended to secure the identified S3 buckets by enforcing stricter access controls and eliminating public read permissions for the reported S3 bucket used for AWS Connect instances.</p><p><strong>Policy Severity—</strong> High</p><p><strong>Policy Type—</strong> Config</p><p><strong>RQL—</strong></p><pre><code>config from cloud.resource where api.name = 'aws-connect-instance' AND json.rule = InstanceStatus equals "ACTIVE" and storageConfig[?any( resourceType is member of ('CHAT_TRANSCRIPTS','CALL_RECORDINGS','SCREEN_RECORDINGS') and storageConfigs[*] exists )] exists as X; config from cloud.resource where api.name='aws-s3api-get-bucket-acl' AND json.rule = "((((acl.grants[?(@.grantee=='AllUsers')] size > 0) or policyStatus.isPublic is true) and publicAccessBlockConfiguration does not exist and accountLevelPublicAccessBlockConfiguration does not exist) or ((acl.grants[?(@.grantee=='AllUsers')] size > 0) and ((publicAccessBlockConfiguration.ignorePublicAcls is false and accountLevelPublicAccessBlockConfiguration does not exist) or (publicAccessBlockConfiguration does not exist and accountLevelPublicAccessBlockConfiguration.ignorePublicAcls is false) or (publicAccessBlockConfiguration.ignorePublicAcls is false and accountLevelPublicAccessBlockConfiguration.ignorePublicAcls is false))) or (policyStatus.isPublic is true and ((publicAccessBlockConfiguration.restrictPublicBuckets is false and accountLevelPublicAccessBlockConfiguration does not exist) or (publicAccessBlockConfiguration does not exist and accountLevelPublicAccessBlockConfiguration.restrictPublicBuckets is false) or (publicAccessBlockConfiguration.restrictPublicBuckets is false and accountLevelPublicAccessBlockConfiguration.restrictPublicBuckets is false))))" as Y; filter ' $.X.storageConfig[*].storageConfigs[*].S3Config.BucketName intersects $.Y.bucketName' ; show Y;
</code></pre></td></tr><tr><td><strong>AWS Connect instance not configured with contact flow logs</strong></td><td><p>This policy identifies the Amazon Connect instance configured with CONTACTFLOW_LOGS set to false in Amazon Connect. Enabling CONTACTFLOW_LOGS in Amazon Connect is crucial as it allows real-time logging of contact flow executions to CloudWatch. This helps in debugging, monitoring, and optimizing customer interactions by tracking steps, conditions, and errors.</p><p>It is recommended to enable CONTACTFLOW_LOGS to enhance monitoring and ensure adherence to security policies and regulations.</p><p><strong>Policy Severity—</strong> Informational</p><p><strong>Policy Type—</strong> Config</p><p><strong>RQL—</strong></p><pre><code>config from cloud.resource where api.name = 'aws-connect-instance' AND json.rule = InstanceStatus equals "ACTIVE" and attributes[?any( AttributeType equals "CONTACTFLOW_LOGS" and Value equals "false" )] exists
</code></pre></td></tr><tr><td><strong>Azure Blob Storage utilized for Azure Machine Learning training job data</strong></td><td><p>This policy identifies Azure Blob Storage accounts used for storing data utilized in Azure Machine Learning training jobs. This policy provides visibility into storage utilization for Machine Learning workloads but does not indicate a security or compliance risk.</p><p>Azure Blob Storage serves as a robust storage solution for large-scale Machine Learning training data. This policy emphasizes the importance of securing stored data by employing encryption and additional security parameters like firewalls, private endpoints, and access policies to safeguard sensitive information.</p><p>As a security best practice, it is recommended to properly configure Azure Blob Storage utilized in Azure Machine Learning training jobs.</p><p><strong>Policy Severity—</strong> Informational</p><p><strong>Policy Type—</strong> Config</p><p><strong>RQL—</strong></p><pre><code>config from cloud.resource where api.name = 'azure-machine-learning-datastores' AND json.rule = properties.datastoreType equal ignore case AzureBlob as X; config from cloud.resource where api.name = 'azure-storage-account-list' as Y; filter ' $.X.properties.accountName equal ignore case $.Y.name ' ; show Y;
</code></pre></td></tr><tr><td><strong>Azure Function App with public access linked to Blob Storage</strong></td><td><p>This policy identifies Azure Function Apps configured with public access and linked to Azure Blob Storage.</p><p>Azure Function Apps often access Blob Storage to retrieve or store data. When public access is enabled for the Function App, it exposes the application and, potentially, the associated Blob Storage to unauthorized access, leading to potential security risks.</p><p>As a security best practice, it is recommended to evaluate public access for Azure Function Apps and secure Azure Blob Storage.</p><p><strong>Policy Severity—</strong> Informational</p><p><strong>Policy Type—</strong> Config</p><p><strong>RQL—</strong></p><pre><code>config from cloud.resource where api.name = 'azure-storage-account-list' as X; config from cloud.resource where api.name = 'azure-app-service-web-apps-configurations' as Y; config from cloud.resource where api.name = 'azure-app-service' AND json.rule = 'kind contains functionapp and kind does not contain workflowapp and kind does not equal app and properties.state equal ignore case running and ((properties.publicNetworkAccess exists and properties.publicNetworkAccess equal ignore case Enabled) or (properties.publicNetworkAccess does not exist)) and config.ipSecurityRestrictions[?any((action equals Allow and ipAddress equals Any) or (action equals Allow and ipAddress equals 0.0.0.0/0))] exists' as Z; filter ' $.Y.properties.azureStorageAccounts contains $.X.name and $.Z.name equal ignore case $.Y.name' ; show Z;
</code></pre></td></tr><tr><td><strong>Azure Container Registry with anonymous authentication enabled</strong></td><td><p>This policy identifies Azure Container Registries with anonymous authentication enabled, allowing unauthenticated access to the registry.</p><p>Allowing anonymous pull or access to container registries poses a significant security risk, exposing them to unauthorized users who may retrieve or manipulate container images. To enhance security, disable anonymous access and require authentication through Azure Active Directory (Azure AD). Additionally, turn off local authentication methods such as admin user, repository-scoped access tokens, and anonymous pull to ensure authentication relies solely on Azure AD, providing improved control and accountability.</p><p>As a security best practice, it is recommended to disable anonymous authentication for Azure Container Registries.</p><p><strong>Policy Severity—</strong> High</p><p><strong>Policy Type—</strong> Config</p><p><strong>RQL—</strong></p><pre><code>config from cloud.resource where api.name = 'azure-container-registry' AND json.rule = (skuName contains Standard or skuName contains Premium) and properties.provisioningState equal ignore case Succeeded and properties.anonymousPullEnabled is false
</code></pre></td></tr><tr><td><strong>Azure Container Registry with ARM audience token authentication enabled</strong></td><td><p>This policy identifies Azure Container Registries that permit ARM audience tokens for authentication.</p><p>When ARM audience tokens are enabled, they allow authentication intended for broader Azure services, which could introduce potential security risks. Disabling ARM audience tokens ensures that only ACR-specific tokens are valid, enhancing security by limiting authentication exclusively to Azure Container Registry audience tokens.</p><p>As a security best practice, it is recommended to disable ARM audience tokens for Azure Container Registries.</p><p><strong>Policy Severity—</strong> Medium</p><p><strong>Policy Type—</strong> Config</p><p><strong>RQL—</strong></p><pre><code>config from cloud.resource where api.name = 'azure-container-registry' AND json.rule = properties.provisioningState equal ignore case Succeeded and properties.policies.azureADAuthenticationAsArmPolicy.status contains enabled
</code></pre></td></tr><tr><td><strong>Azure Container Registry with local admin account enabled</strong></td><td><p>This policy identifies Azure Container Registries having local admin account enabled.</p><p>Enabling the admin account allows access to the registry through username and password, bypassing Microsoft Entra ID authentication. Disabling the local admin account improves security by enforcing exclusive use of Microsoft Entra ID identities, which provide centralized management, enhanced auditing, and better control over permissions. By relying solely on Microsoft Entra ID for authentication, the risk of unauthorized access through local credentials is mitigated, ensuring stronger protection for your container registry.</p><p>As a security best practice, it is recommended to disable local admin account for Azure Container Registries.</p><p><strong>Policy Severity—</strong> Low</p><p><strong>Policy Type—</strong> Config</p><p><strong>RQL—</strong></p><pre><code>config from cloud.resource where cloud.type = 'azure' and api.name = 'azure-container-registry' AND json.rule = properties.provisioningState equal ignore case Succeeded and properties.adminUserEnabled is true
</code></pre></td></tr><tr><td><strong>Azure Container Registry with repository scoped access token enabled</strong></td><td><p>This policy identifies Azure Container Registries having repository scoped access tokens enabled.</p><p>Disable repository-scoped access tokens for your registry to prevent access via tokens. Enhancing security involves disabling local authentication methods, including admin user, repository-scoped access tokens, and anonymous pull. This ensures that container registries rely solely on Microsoft Entra ID identities for authentication.</p><p>As a security best practice, it is recommended to disable repository scoped access token for Azure Container Registries.</p><p><strong>Policy Severity—</strong> Low</p><p><strong>Policy Type—</strong> Config</p><p><strong>RQL—</strong></p><pre><code>config from cloud.resource where cloud.type = 'azure' and api.name = 'azure-container-registry' AND json.rule = properties.provisioningState equal ignore case Succeeded and tokens[?any( properties.status contains enabled )] exists
</code></pre></td></tr><tr><td><strong>Azure Container Registry not encrypted with Customer Managed Key (CMK)</strong></td><td><p>This policy identifies Azure Container Registries that are not encrypted with Customer-Managed Keys (CMK).</p><p>By default, Azure Container Registry encrypts data at rest with Microsoft-managed keys. However, for enhanced control, regulatory compliance, and improved security, customer-managed keys enable organizations to encrypt Azure Container Registry data using Azure Key Vault keys that they create, own, and manage. Using CMK ensures that the encryption process aligns with organizational policies, allowing complete control over key lifecycle management, including rotation, access management, and retirement.</p><p>As a security best practice, it is recommended to encrypt Azure Container Registries with Customer-Managed Keys (CMK).</p><p><strong>Policy Severity—</strong> Low</p><p><strong>Policy Type—</strong> Config</p><p><strong>RQL—</strong></p><pre><code>config from cloud.resource where cloud.type = 'azure' and api.name = 'azure-container-registry' AND json.rule = properties.provisioningState equal ignore case Succeeded and properties.encryption.status equal ignore case disabled
</code></pre></td></tr><tr><td><strong>Azure Container Registry with exports enabled</strong></td><td><p>This policy identifies Azure Container Registries with exports enabled.</p><p>Azure Container Registries with exports enabled allows data in the registry to be moved out using commands like acr import or acr transfer. Export functionality can expose registry data, increasing the risk of unauthorized data movement. Disabling exports ensures that data in a registry is accessed only via the dataplane (e.g., docker pull) and cannot be moved out using other methods.</p><p>As a security best practice, it is recommended to disable export configuration for Azure Container Registries.</p><p><strong>Policy Severity—</strong> Medium</p><p><strong>Policy Type—</strong> Config</p><p><strong>RQL—</strong></p><pre><code>config from cloud.resource where cloud.type = 'azure' and api.name = 'azure-container-registry' AND json.rule = properties.provisioningState equal ignore case Succeeded and (properties.policies.exportPolicy.status contains enabled or properties.publicNetworkAccess contains enabled)
</code></pre></td></tr><tr><td><strong>GCP Memorystore for Redis instance not encrypted with CMEK</strong></td><td><p>This policy identifies Memorystore for Redis instances not encrypted with CMEK.</p><p>GCP Memorystore for Redis is a fully managed in-memory data store that simplifies Redis deployment and scaling while ensuring high availability and low-latency access. By using CMEK with Redis instance, you retain complete control over the encryption keys protecting your sensitive data, ensuring that only authorized users with access to these keys can decrypt and access the information. Without CMEK, data is encrypted with Google-managed keys, which may not provide the level of control required for handling sensitive data in certain industries.</p><p>It is recommended to encrypt Redis instance data using a Customer-Managed Encryption Key (CMEK).</p><p><strong>Policy Severity—</strong> Informational</p><p><strong>Policy Type—</strong> Config</p><p><strong>RQL—</strong></p><pre><code>config from cloud.resource where cloud.type = 'gcp' AND api.name = 'gcloud-redis-instances-list' AND json.rule = not(customerManagedKey contains cryptoKeys)
</code></pre></td></tr><tr><td><strong>GCP Memorystore for Redis instance does not use in transit encryption</strong></td><td><p>This policy identifies GCP Memorystore for Redis instances with no in transit encryption.</p><p>GCP Memorystore for Redis is a fully managed in-memory data store that simplifies Redis deployment and scaling while ensuring high availability and low-latency access. When in-transit encryption is disabled, all data transmitted between your clients and Redis flows as plaintext over the network, making it vulnerable to man-in-the-middle attacks and packet sniffing, potentially exposing sensitive information like session tokens, personal data, or business secrets.</p><p>It is recommended to enable In transit encryption for GCP Memorystore for Redis to prevent malicious actors from intercepting sensitive data.</p><p><strong>Policy Severity—</strong> Low</p><p><strong>Policy Type—</strong> Config</p><p><strong>RQL—</strong></p><pre><code>config from cloud.resource where cloud.type = 'gcp' AND api.name = 'gcloud-redis-instances-list' AND json.rule = transitEncryptionMode does not equal ignore case SERVER_AUTHENTICATION
</code></pre></td></tr><tr><td><strong>GCP Memorystore for Redis instance has AUTH disabled</strong></td><td><p>This policy identifies GCP Memorystore for Redis instances having AUTH disabled.</p><p>GCP Memorystore for Redis is a fully managed in-memory data store that simplifies Redis deployment and scaling while ensuring high availability and low-latency access. When AUTH is disabled, any client that can reach the Redis instance over the network can freely connect and perform operations without providing any credentials, creating a significant security risk to your data.</p><p>It is recommended to enable authentication (AUTH) on the GCP Memorystore for Redis to ensure only authorized clients can connect.</p><p><strong>Policy Severity—</strong> Low</p><p><strong>Policy Type—</strong> Config</p><p><strong>RQL—</strong></p><pre><code>config from cloud.resource where cloud.type = 'gcp' AND api.name = 'gcloud-redis-instances-list' AND json.rule = authEnabled is false
</code></pre></td></tr><tr><td><strong>GCP Storage bucket with object versioning disabled</strong></td><td><p>This policy identifies GCP Storage buckets that have object versioning disabled.</p><p>Object versioning is a method of keeping multiple variants of an object in the same storage bucket. Enabling object versioning on storage log buckets will protect your cloud storage data from being overwritten or accidentally deleted.</p><p>It is recommended to enable the object versioning feature on all storage buckets.</p><p><strong>Policy Severity—</strong> Medium</p><p><strong>Policy Type—</strong> Config</p><p><strong>RQL—</strong></p><pre><code>config from cloud.resource where cloud.type = 'gcp' AND api.name = 'gcloud-storage-buckets-list' AND json.rule = versioning.enabled is false or versioning does not exist
</code></pre></td></tr></tbody></table>

## Policy Updates

<table data-header-hidden><thead><tr><th></th><th></th></tr></thead><tbody><tr><td><strong>Policy Updates</strong></td><td><strong>Description</strong></td></tr><tr><td><strong>Policy Updates—Metadata</strong></td><td></td></tr><tr><td><strong>Azure VM disk configured with public network access</strong></td><td><p>The policy name and description are updated.</p><p><strong>Current Policy Name–</strong> Azure VM disk configured with public network access</p><p><strong>Updated Policy Name–</strong> Azure VM disk configured with overly permissive network access</p><p><strong>Current Policy Description–</strong> This policy identifies Azure Virtual Machine disks that are configured with public network access.</p><p>Allowing public access to Azure Virtual Machine disk resources increases the risk of unauthorized access and potential security breaches. Public network access exposes sensitive data to external threats, which attackers could exploit to compromise VM disks. Disabling public access and using Azure Private Link reduces exposure, ensuring only trusted networks have access and enhancing the security of your Azure environment by minimizing the risk of data leaks and breaches.</p><p>As a security best practice, it is recommended to disable public network access for Azure Virtual Machine disks.</p><p><strong>Updated Policy Description–</strong> This policy identifies Azure Virtual Machine disks that are configured with overly permissive network access.</p><p>Enabling public network access provides overly permissive network access on Azure Virtual Machine disks, increasing the risk of unauthorized access and potential security breaches. Public network access exposes sensitive data to external threats, which attackers could exploit to compromise VM disks. Disabling public access and using Azure Private Link reduces exposure, ensuring only trusted networks have access and enhancing the security of your Azure environment by minimizing the risk of data leaks and breaches.</p><p>As a security best practice, it is recommended to disable public network access for Azure Virtual Machine disks.</p><p><strong>Policy Type–</strong> Config</p><p><strong>Policy Severity–</strong> High</p><p><strong>Impact–</strong> No impact on alerts.</p></td></tr><tr><td><strong>AWS Security Group allows all traffic on CIFS port (445)</strong></td><td><p>The policy search manager name is changed from AWS Security Group allows all traffic on CIFS port (445) to AWS Security Group allows all ingress traffic on CIFS port (445).</p><p><strong>Impact</strong>: No impact on alerts.</p></td></tr><tr><td><strong>Policy Updates—RQL</strong></td><td></td></tr><tr><td><strong>Azure Storage account diagnostic setting for blob is disabled</strong></td><td><p>The policy RQL is updated to reduce false positives when the diagnostic setting is enabled.</p><p><strong>Current RQL–</strong></p><pre><code>config from cloud.resource where api.name = 'azure-storage-account-list' AND json.rule = properties.provisioningState equal ignore case Succeeded as X; config from cloud.resource where api.name = 'azure-storage-account-blob-diagnostic-settings' AND json.rule = properties.logs[*].enabled all true as Y; filter 'not($.X.name equal ignore case $.Y.StorageAccountName)'; show X;
</code></pre><p><strong>Updated RQL–</strong></p><pre><code>config from cloud.resource where api.name = 'azure-storage-account-list' AND json.rule = properties.provisioningState equal ignore case Succeeded as X; config from cloud.resource where api.name = 'azure-storage-account-blob-diagnostic-settings' AND json.rule = (properties.logs[?(@.categoryGroup)] exists and properties.logs[*].enabled any true) or (properties.logs[?(@.category)] exists and properties.logs[*].enabled all true) as Y; filter 'not($.X.name equal ignore case $.Y.StorageAccountName)'; show X;
</code></pre><p><strong>Policy Type–</strong> Config</p><p><strong>Policy Severity–</strong> Low</p><p><strong>Impact–</strong> Low. Open alerts would be resolved when the diagnostic settings are enabled</p></td></tr><tr><td><strong>Azure Cosmos DB Virtual network is not configured</strong></td><td><p>The policy RQL is updated to reduce false positives by considering the public network access property.</p><p><strong>Current RQL–</strong></p><pre><code>config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-cosmos-db' AND json.rule = properties.provisioningState equals Succeeded and properties.virtualNetworkRules[*] does not exist
</code></pre><p><strong>Updated RQL–</strong></p><pre><code>config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-cosmos-db' AND json.rule = properties.provisioningState equals Succeeded AND properties.publicNetworkAccess equal ignore case Enabled AND properties.virtualNetworkRules[*] is empty
</code></pre><p><strong>Policy Type–</strong> Config</p><p><strong>Policy Severity–</strong> Low</p><p><strong>Impact–</strong> Medium. New alerts will be generated when the public network access is set to <code>all</code> networks. Existing alerts where the public network access is not set to <code>all</code> networks will be resolved.</p></td></tr><tr><td><strong>Azure storage account has a blob container with public access</strong></td><td><p>The policy RQL will be updated to include Public network access and Private Endpoint check to increase the accuracy of RQL results.</p><p><strong>Current RQL–</strong></p><pre><code>config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-storage-account-list' AND json.rule = totalPublicContainers > 0 and (properties.allowBlobPublicAccess is true or properties.allowBlobPublicAccess does not exist)
</code></pre><p><strong>Updated RQL–</strong></p><pre><code>config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-storage-account-list' AND json.rule = totalPublicContainers > 0 and (properties.allowBlobPublicAccess is true or properties.allowBlobPublicAccess does not exist) and properties.publicNetworkAccess equal ignore case Enabled and networkRuleSet.virtualNetworkRules is empty and (properties.privateEndpointConnections is empty or properties.privateEndpointConnections does not exist)
</code></pre><p><strong>Policy Type–</strong> Config</p><p><strong>Policy Severity–</strong> High</p><p><strong>Impact–</strong> Medium. Existing alerts will be resolved as <code>Policy_Updated</code>.</p></td></tr><tr><td><strong>Azure Storage account container storing activity logs is publicly accessible</strong></td><td><p>The policy RQL is updated to include Public network access and Private Endpoint check to increase the accuracy of RQL results.</p><p><strong>Current RQL–</strong></p><pre><code>config from cloud.resource where api.name = 'azure-storage-account-list' AND json.rule= publicContainersList[*] contains insights-operational-logs and (properties.allowBlobPublicAccess is true or properties.allowBlobPublicAccess does not exist) as X; config from cloud.resource where api.name = 'azure-monitor-log-profiles-list' as Y; filter'$.X.id contains $.Y.properties.storageAccountId'; show X;
</code></pre><p><strong>Updated RQL–</strong></p><pre><code>config from cloud.resource where api.name = 'azure-storage-account-list' AND json.rule= 'publicContainersList[*] contains insights-operational-logs and (totalPublicContainers > 0 and (properties.allowBlobPublicAccess is true or properties.allowBlobPublicAccess does not exist) and properties.publicNetworkAccess equal ignore case Enabled and networkRuleSet.virtualNetworkRules is empty and (properties.privateEndpointConnections is empty or properties.privateEndpointConnections does not exist))' as X; config from cloud.resource where api.name = 'azure-monitor-log-profiles-list' as Y; filter '$.X.id contains $.Y.properties.storageAccountId'; show X;
</code></pre><p><strong>Policy Type–</strong> Config</p><p><strong>Policy Severity–</strong> Low</p><p><strong>Impact–</strong> Medium. Existing alerts will be resolved as <code>Policy_Updated</code>.</p></td></tr><tr><td><strong>Azure Storage Account storing Machine Learning workspace high business impact data is publicly accessible</strong></td><td><p>The policy RQL is updated to include Public network access and Private Endpoint check to increase the accuracy of RQL results.</p><p><strong>Current RQL–</strong></p><pre><code>config from cloud.resource where api.name = 'azure-machine-learning-workspace' AND json.rule = 'properties.provisioningState equal ignore case Succeeded and properties.hbiWorkspace is true and properties.storageAccount exists' as X; config from cloud.resource where api.name = 'azure-storage-account-list' AND json.rule = 'totalPublicContainers > 0 and (properties.allowBlobPublicAccess is true or properties.allowBlobPublicAccess does not exist)' as Y; filter '$.X.properties.storageAccount contains $.Y.id'; show Y;
</code></pre><p><strong>Updated RQL–</strong></p><pre><code>config from cloud.resource where api.name = 'azure-machine-learning-workspace' AND json.rule = 'properties.provisioningState equal ignore case Succeeded and properties.hbiWorkspace is true and properties.storageAccount exists' as X; config from cloud.resource where api.name = 'azure-storage-account-list' AND json.rule = 'totalPublicContainers > 0 and (properties.allowBlobPublicAccess is true or properties.allowBlobPublicAccess does not exist) and properties.publicNetworkAccess equal ignore case Enabled and networkRuleSet.virtualNetworkRules is empty and (properties.privateEndpointConnections is empty or properties.privateEndpointConnections does not exist)' as Y; filter '$.X.properties.storageAccount contains $.Y.id'; show Y;
</code></pre><p><strong>Policy Type–</strong> Config</p><p><strong>Policy Severity–</strong> High</p><p><strong>Impact–</strong> Medium. Existing alerts will be resolved as <code>Policy_Updated</code>.</p></td></tr><tr><td><strong>Azure Storage Account storing Cognitive service diagnostic logs is publicly accessible</strong></td><td><p>The policy RQL is updated to include Public network access and Private Endpoint check to increase the accuracy of RQL results.</p><p><strong>Current RQL–</strong></p><pre><code>config from cloud.resource where api.name = 'azure-cognitive-services-account-diagnostic-settings' AND json.rule = (properties.logs[?any(enabled equal ignore case "true")] exists or properties.metrics[?any( enabled equal ignore case "true" )] exists) and properties.storageAccountId exists as X; config from cloud.resource where api.name = 'azure-storage-account-list' AND json.rule = 'totalPublicContainers > 0 and (properties.allowBlobPublicAccess is true or properties.allowBlobPublicAccess does not exist)' as Y; filter '$.X.properties.storageAccountId contains $.Y.id'; show Y;
</code></pre><p><strong>Updated RQL–</strong></p><pre><code>config from cloud.resource where api.name = 'azure-cognitive-services-account-diagnostic-settings' AND json.rule = (properties.logs[?any(enabled equal ignore case "true")] exists or properties.metrics[?any( enabled equal ignore case "true" )] exists) and properties.storageAccountId exists as X; config from cloud.resource where api.name = 'azure-storage-account-list' AND json.rule = 'totalPublicContainers > 0 and (properties.allowBlobPublicAccess is true or properties.allowBlobPublicAccess does not exist) and properties.publicNetworkAccess equal ignore case Enabled and networkRuleSet.virtualNetworkRules is empty and (properties.privateEndpointConnections is empty or properties.privateEndpointConnections does not exist)' as Y; filter '$.X.properties.storageAccountId contains $.Y.id'; show Y;
</code></pre><p><strong>Policy Type–</strong> Config</p><p><strong>Policy Severity–</strong> Medium</p><p><strong>Impact–</strong> Medium. Existing alerts will be resolved as <code>Policy_Updated</code>.</p></td></tr><tr><td><strong>GCP VPC Flow logs for the subnet is set to Off</strong></td><td><p>The policy RQL and recommendation steps will be updated to reduce false positives by excluding unsupported subnet purposes.</p><p><strong>Current RQL–</strong></p><pre><code>config from cloud.resource where cloud.type = 'gcp' AND api.name = 'gcloud-compute-networks-subnets-list' AND json.rule = purpose does not contain INTERNAL_HTTPS_LOAD_BALANCER and purpose does not contain REGIONAL_MANAGED_PROXY and (enableFlowLogs is false or enableFlowLogs does not exist)
</code></pre><p><strong>Updated RQL–</strong></p><pre><code>config from cloud.resource where cloud.type = 'gcp' AND api.name = 'gcloud-compute-networks-subnets-list' AND json.rule = purpose does not contain INTERNAL_HTTPS_LOAD_BALANCER and purpose does not contain REGIONAL_MANAGED_PROXY and purpose does not contain GLOBAL_MANAGED_PROXY and purpose does not contain PRIVATE_SERVICE_CONNECT and (enableFlowLogs is false or enableFlowLogs does not exist)
</code></pre><p><strong>Policy Type–</strong> Config</p><p><strong>Policy Severity–</strong> Informational</p><p><strong>Impact–</strong> Low. Existing alerts where subnets with purpose <code>GLOBAL_MANAGED_PROXY</code> and <code>PRIVATE_SERVICE_CONNECT</code> will be resolved.</p></td></tr><tr><td><strong>GCP VPC Network subnets have Private Google access disabled</strong></td><td><p>The policy RQL and recommendation steps are updated to reduce false positives by excluding unsupported subnet purposes.</p><p><strong>Current RQL–</strong></p><pre><code>config from cloud.resource where cloud.type = 'gcp' AND api.name = 'gcloud-compute-networks-subnets-list' AND json.rule = purpose is not member of (REGIONAL_MANAGED_PROXY, PRIVATE_SERVICE_CONNECT) and (privateIpGoogleAccess does not exist or privateIpGoogleAccess is false)
</code></pre><p><strong>Updated RQL–</strong></p><pre><code>config from cloud.resource where cloud.type = 'gcp' AND api.name = 'gcloud-compute-networks-subnets-list' AND json.rule = purpose is not member of (REGIONAL_MANAGED_PROXY, PRIVATE_SERVICE_CONNECT, GLOBAL_MANAGED_PROXY, PRIVATE_NAT) and (privateIpGoogleAccess does not exist or privateIpGoogleAccess is false)
</code></pre><p><strong>Policy Type–</strong> Config</p><p><strong>Policy Severity–</strong> Low</p><p><strong>Impact–</strong> Low. Existing alerts related to <code>GLOBAL_MANAGED_PROXY</code> and <code>PRIVATE_NAT</code> purposes will be resolved.</p></td></tr><tr><td><strong>GCP VM instance Confidential VM service disabled</strong></td><td><p>Policy RQL is updated to reduce the false positives by considering the CSP limitations{}.</p><p><strong>Current RQL–</strong></p><pre><code>config from cloud.resource where cloud.type = 'gcp' AND api.name = 'gcloud-compute-instances-list' AND json.rule = status equal ignore case "RUNNING" and (machineType contains "machineTypes/n2d-" or machineType contains "machineTypes/c2d-") and (confidentialInstanceConfig.enableConfidentialCompute does not exist or confidentialInstanceConfig.enableConfidentialCompute is false)
</code></pre><p><strong>Updated RQL–</strong></p><pre><code>config from cloud.resource where cloud.type = 'gcp' AND api.name = 'gcloud-compute-instances-list' AND json.rule = status equal ignore case "RUNNING" and (machineType contains "machineTypes/n2d-" or machineType contains "machineTypes/c2d-" or machineType contains "machineTypes/c3d-" or machineType contains "machineTypes/c3-standard-")and (disks[*].guestOsFeatures[*].type contains "SEV_CAPABLE" or disks[*].guestOsFeatures[*].type contains "SEV_LIVE_MIGRATABLE_V2" or disks[*].guestOsFeatures[*].type contains "SEV_SNP_CAPABLE" or disks[*].guestOsFeatures[*].type contains "TDX_CAPABLE") and (confidentialInstanceConfig.enableConfidentialCompute does not exist or confidentialInstanceConfig.enableConfidentialCompute is false)
</code></pre><p><strong>Policy Type–</strong> Config</p><p><strong>Policy Severity–</strong> Medium</p><p><strong>Impact–</strong> Medium. New Alerts would be triggered when the machine type is * c3-standard- and C3D. Open alerts with OS_FEATURE not containing SEV_CAPABLE, SEV_LIVE_MIGRATABLE_V2, SEV_SNP_CAPABLE, and TDX_CAPABLE will be resolved.</p></td></tr></tbody></table>

## IAM Policy Updates

The 25.1.1 release includes two new IAM policies and two IAM policy updates.

**New IAM Policies**

| **Policy Name**                                                                                                                                                  | **Description**                                                                                                                                                                                                                                                                                                                           | **RQL**                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 | **Cloud** | **Severity** |
| ---------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------- | ------------ |
| Entra ID user owns an Entra ID service account with permission to add members to a group with admin privileges at the subscription/management group level        | This policy identifies Entra ID users that are owners of an App Registration which is granted Graph API or Entra ID permissions allowing it to add members to a group with administrative permissions at the Subscription or Management Group level                                                                                       | config from iam where source.cloud.type = 'AZURE' AND source.cloud.azure.user.isAppRegistrationOwner = true AND grantedby.cloud.entity.type = 'Service Principal' AND dest.cloud.azure.group.isadministrative.grantedby.level.type in (('Directory.ReadWrite.All','Group.ReadWrite.All','GroupMember.ReadWrite.All','RoleManagement.ReadWrite.Directory','microsoft.directory/groups.security/owners/update','microsoft.directory/groups.security.assignedMembership/members/update','microsoft.directory/groups.security/members/update','microsoft.directory/groups.security/allProperties/update','microsoft.directory/groups.security/dynamicMembershipRule/update','microsoft.directory/groupsAssignableToRoles/allProperties/update','microsoft.directory/groups/members/update','microsoft.directory/groups/owners/update'), ('Azure Management Group', 'Azure Subscription' ) ) | Azure     | High         |
| Entra ID user can impersonate an Entra ID application with permission to add members to a group with admin privileges at the subscription/management group level | This policy identifies Entra ID users that can impersonate an App Registration using the 'Create Credentials' or 'Change Ownership' features, where the App Registration is granted Graph API or Entra ID permissions allowing it to add members to a group with administrative permissions at the Subscription or Management Group level | config from iam where source.cloud.type = 'AZURE' AND source.cloud.azure.user.canImpersonateAppReg = true AND grantedby.cloud.entity.type = 'Service Principal' AND dest.cloud.azure.group.isadministrative.grantedby.level.type in (('Directory.ReadWrite.All','Group.ReadWrite.All','GroupMember.ReadWrite.All','RoleManagement.ReadWrite.Directory','microsoft.directory/groups.security/owners/update','microsoft.directory/groups.security.assignedMembership/members/update','microsoft.directory/groups.security/members/update','microsoft.directory/groups.security/allProperties/update','microsoft.directory/groups.security/dynamicMembershipRule/update','microsoft.directory/groupsAssignableToRoles/allProperties/update','microsoft.directory/groups/members/update','microsoft.directory/groups/owners/update'), ('Azure Management Group', 'Azure Subscription' ) )   | Azure     | High         |

**IAM Policy Updates**

| **Policy Name**                                                          | **Description**                                                                                                                                                                                                                                                                                                                                        | **RQL**                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   | **Cloud** | **Severity** |
| ------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------- | ------------ |
| System/User-assigned managed identity with critical Entra ID permissions | This policy detects Azure system-assigned and user-assigned managed identities that are granted critical Graph API permissions or assigned roles containing high-privilege Entra ID permissions. These permissions, such as the ability to create or modify critical resources, may lead to potential privilege escalation or data exfiltration risks. | config from iam where source.cloud.type = 'AZURE' AND source.cloud.resource.type IN ('System Assigned','User Assigned','virtualMachines') and grantedby.cloud.entity.type in ('System Assigned','User Assigned') and action.name in ('Application.ReadWrite.All','Directory.ReadWrite.All','microsoft.directory/applications/owners/update','microsoft.directory/applications/credentials/update','RoleManagement.ReadWrite.Directory','microsoft.directory/groups.security/owners/update','microsoft.directory/groups.security.assignedMembership/members/update','microsoft.directory/groups.security/members/update','microsoft.directory/groups.unified/owners/update','microsoft.directory/groups.unified.assignedMembership/members/update','microsoft.directory/groups.unified/members/update','microsoft.directory/groupsAssignableToRoles/allProperties/update','User.ReadWrite.All','microsoft.directory/users/password/update','AppRoleAssignment.ReadWrite.All','microsoft.directory/servicePrincipals/appRoleAssignedTo/update','microsoft.directory/groups/members/update','microsoft.directory/groups/owners/update','Mail.ReadWrite','Files.ReadWrite.All','Sites.ReadWrite.All','Sites.FullControl.All') | Azure     | High         |
| AWS resources that are publicly accessible through IAM policies          | This policy identifies the AWS resources which are publicly accessible through IAM policies. The policy considers AWS conditions that limit public access. Ensure that the AWS resources provisioned in your AWS account are not publicly accessible from the Internet to avoid sensitive data exposure and minimize security risks.                   | config from iam where dest.cloud.type = ''AWS'' and source.public = true AND grantedby.cloud.policy.condition DOES NOT EXIST                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              | AWS       | Low          |

## New Compliance Benchmarks and Updates

| **Compliance Benchmark**                                                                                                                       | **Description**                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     |
| ---------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Center for Internet Security (CIS) v3.0.0 (Azure) Level 1 and Level 2**                                                                      | <p>Prisma Cloud now supports the latest version of the CIS Microsoft Azure Foundations Benchmark v3.0.0 compliance framework, including Level 1 and Level 2 assessments. The Level 1 benchmark focuses on essential security controls that are critical for protecting Azure resources, while Level 2 provides more stringent requirements for organizations seeking to implement advanced security measures. Noteworthy changes include updated syntax for procedures and a clear distinction between foundational and service category benchmarks.</p><p>You can now access this built-in compliance standard and related policies on the "Compliance > Standards" page. Additionally, users can generate reports for immediate viewing or downloading, as well as set up scheduled reports to continuously monitor compliance with the CIS Microsoft Azure Foundations Benchmark v3.0.0 framework over time, ensuring robust governance and security across Azure deployments.</p>                                                                               |
| **Center for Internet Security (CIS) v4.0.0 (AWS) Level 1 and Level 2**                                                                        | <p>Prisma Cloud now supports the latest version of the CIS Amazon Web Services Foundations Benchmark v4.0.0 compliance framework, including Level 1 and Level 2 assessments. The Level 1 benchmark focuses on essential security controls that are critical for protecting AWS resources, while Level 2 provides more stringent requirements for organizations seeking to implement advanced security measures. Noteworthy changes include updated syntax for procedures and a clear distinction between foundational and service category benchmarks.</p><p>You can now access this built-in compliance standard and related policies on the <strong>Compliance > Standards</strong> page. Additionally, users can generate reports for immediate viewing or downloading, as well as set up scheduled reports to continuously monitor compliance with the CIS AWS Foundations Benchmark v4.0.0 framework over time, ensuring robust governance and security across AWS deployments.</p>                                                                            |
| <p><strong>Health Insurance Portability and Accountability Act (HIPAA)</strong></p><p><mark style="background-color:orange;">Update</mark></p> | <p>New Policy mappings are added to HIPAA compliance standard.</p><p><strong>Impact</strong>: As new mappings are introduced, compliance scoring might vary.</p>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    |
| **National Cyber Security Center (NCSC) - Cyber Essentials**                                                                                   | <p>Prisma Cloud now supports the NCSC - Cyber Essentials compliance framework. The UK’s National Cyber Security Centre provided Cyber Essentials as a government backed certification scheme that helps keep your organisation’s and your customers’ data safe from cyber attacks. The NCSC recommends Cyber Essentials as the minimum standard of cyber security for all organisations.</p><p>You can now access this built-in compliance standard and related policies on the <strong>Compliance > Standards</strong> page.</p>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   |
| **National Cyber Security Center (NCSC) - Cloud Security Principles**                                                                          | <p>Prisma Cloud now supports the NCSC - Cyber Essentials compliance framework. The UK’s National Cyber Security Centre provided Cyber Essentials as a government backed certification scheme that helps organisations enhance theircloud security posture.</p><p>You can now access this built-in compliance standard and related policies on the <strong>Compliance > Standards</strong> page.</p>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 |
| **Trusted Information Security Assessment Exchange (TISAX)**                                                                                   | <p>Prisma Cloud now supports the latest version of the TISAX compliance framework. This updated standard emphasizes a structured approach to information security management, particularly for organizations in the automotive industry. Notably, TISAX requires companies to demonstrate their capability to manage information security risks through a defined maturity model, which includes various levels of assessment ranging from basic self-assessment to comprehensive audits by accredited providers.</p><p>You can now access this built-in compliance standard and related policies on the <strong>Compliance > Standards</strong> page. Additionally, you can generate reports for immediate viewing or downloading, as well as set up scheduled reports to continuously monitor compliance with the TISAX framework over time. TISAX compliance helps you effectively manage and demonstrate your organization’s adherence to stringent information security requirements to help safeguard sensitive automotive data against evolving threats.</p> |

## REST API Updates

| <p><strong>Alerts API</strong></p><p><mark style="background-color:orange;">25.1.1</mark></p> | <p>The following new endpoint is added to the <a href="https://pan-dev-f1b58—​pr814-h0b1x0qy.web.app/prisma-cloud/api/cspm/alerts/">Alerts API</a>:</p><ul><li><a href="https://pan.dev/prisma-cloud/api/cspm/get-remediation-for-policy/">Get Policy Remediation</a></li></ul> |
| --------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.prismacloud.io/release-notes/prisma-cloud-release-information/features-introduced-in-2025/features-introduced-in-january-2025.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.