> For the complete documentation index, see [llms.txt](https://docs.prismacloud.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.prismacloud.io/release-notes/prisma-cloud-release-information/features-introduced-in-2025/features-introduced-in-july-2025.md).

# Features Introduced in July 2025

Learn what’s new on Prisma® Cloud in July 2025.

The July (25.7.1) release does not include any new policies.

* [Enhancements](#enhancements)
* [API Ingestions](#api-ingestions)
* [Policy Updates](#policy-updates)
* [New Compliance Benchmarks and Updates](#new-compliance-benchmarks-and-updates)

## Enhancements

| **Feature**                             | **Description**                                                                                                                                                                                                                                                                                                                                                                                                                                                            |
| --------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Support for Entra ID Authentication** | In addition to the currently supported authentications methods, Prisma Cloud now supports Microsoft Entra ID for flow log ingestion. Learn more about [authentication](https://docs.prismacloud.io/en/enterprise-edition/content-collections/connect/connect-cloud-accounts/onboard-your-azure-account/connect-azure-account#:~:text=On%20the%20Azure%20portal%2C%20you%20also%20have%20the%20option%20to%20authenticate%20using%20Microsoft%20Entra%20ID) using Entra ID. |

## API Ingestions

| **Service**                                                                   | **API Details**                                                                                                                                                                                                                                                                                                                                                                                            |
| ----------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| <mark style="background-color:orange;">Update</mark> **Amazon API Gateway**   | <p><strong>aws-apigatewayv2-stage</strong></p><p>The API is updated to ingest an additional <code>apidId</code> attribute.</p><p>No additional permissions are required.</p>                                                                                                                                                                                                                               |
| **Azure Container Apps**                                                      | <p><strong>azure-app-container-apps-managed-environment</strong></p><p>Additional permission required:</p><ul><li><code>Microsoft.app/managedenvironments/read</code></li></ul><p>The Reader role includes the permission.</p>                                                                                                                                                                             |
| **Azure Fluid Relay**                                                         | <p><strong>azure-fluid-relay-server</strong></p><p>Additional permission required:</p><ul><li><code>Microsoft.FluidRelay/fluidRelayServers/read</code></li></ul><p>The Reader role includes the permission.</p>                                                                                                                                                                                            |
| **Azure Network Watcher**                                                     | <p><strong>azure-network-watcher-flowlogs</strong></p><p>Additional permission required:</p><ul><li><code>Microsoft.Network/networkWatchers/flowLogs/read</code></li></ul><p>The Reader role includes the permission.</p>                                                                                                                                                                                  |
| **Azure Web PubSub Service**                                                  | <p><strong>azure-signalrservice-web-pub-sub-diagnostic-settings</strong></p><p>Additional permissions required:</p><ul><li><code>Microsoft.SignalRService/WebPubSub/read</code></li><li><code>Microsoft.Insights/DiagnosticSettings/Read</code></li></ul><p>The Reader role includes the permissions.</p>                                                                                                  |
| <mark style="background-color:orange;">Update</mark> **Azure Container Apps** | <p><strong>azure-app-container-apps</strong></p><p>Additional permissions required:</p><ul><li><code>microsoft.app/containerapps/read</code> (existing permission)</li><li><code>microsoft.app/containerapps/authconfigs/read</code> (new permission)</li></ul><p>The Reader role includes the permissions.</p><p><code>authConfigs</code> details of container apps are appended to the existing API.</p> |
| **OCI IAM**                                                                   | <p><strong>oci-iam-tag-default</strong></p><p>Additional permission required:</p><ul><li><code>TAG\_DEFAULT\_INSPECT</code></li></ul><p>The Reader role includes the permission.</p>                                                                                                                                                                                                                       |

## Policy Updates

<table data-header-hidden><thead><tr><th></th><th></th></tr></thead><tbody><tr><td><strong>Policy Updates</strong></td><td><strong>Description</strong></td></tr><tr><td><strong>Policy Updates—RQL</strong></td><td></td></tr><tr><td><strong>AWS EKS cluster does not have secrets encryption enabled</strong></td><td><p><strong>Changes–</strong> The policy is updated to identify EKS clusters with versions lesser than 1.28 as per the latest CSP updates.</p><p><strong>Current Description–</strong></p><p>This policy identifies AWS EKS clusters that do not have secrets encryption enabled.</p><p>AWS EKS cluster secrets are, by default, stored unencrypted in the API server’s underlying data store (etcd). Anyone with direct access to etcd or with API access can retrieve or modify the secrets. Using secrets encryption for your Amazon EKS cluster allows you to protect sensitive information such as passwords and API keys using Kubernetes-native APIs.</p><p>It is recommended to enable secrets encryption to ensure its security and reduce the risk of unauthorized access or data breaches.</p><p><strong>Updated Description–</strong></p><p>This policy identifies AWS EKS clusters that do not have secrets encryption enabled.</p><p>AWS EKS cluster secrets are, by default, stored unencrypted in the API server’s underlying data store (etcd). Anyone with direct access to etcd or with API access can retrieve or modify the secrets. Using secrets encryption for your Amazon EKS cluster allows you to protect sensitive information such as passwords and API keys using Kubernetes-native APIs.</p><p>It is recommended to enable secrets encryption to ensure its security and reduce the risk of unauthorized access or data breaches.</p><p>The policy identifies secret encryptions for EKS clusters with versions lesser than 1.28.</p><p><strong>Current RQL–</strong></p><pre><code>config from cloud.resource where cloud.type = 'aws' AND api.name = 'aws-eks-describe-cluster' AND json.rule = encryptionConfig does not exist or (encryptionConfig exists and encryptionConfig[*].provider.keyArn does not exist and encryptionConfig[*].resources[*] does not contain secrets)
</code></pre><p><strong>Updated RQL–</strong></p><pre><code>config from cloud.resource where cloud.type = 'aws' AND api.name = 'aws-eks-describe-cluster' AND json.rule = version is member of ( "1.25", "1.26", "1.27") and (encryptionConfig does not exist or (encryptionConfig exists and encryptionConfig[*].provider.keyArn does not exist and encryptionConfig[*].resources[*] does not contain secrets))
</code></pre><p><strong>Policy Type–</strong> Config</p><p><strong>Policy Severity–</strong> Medium</p><p><strong>Impact–</strong> Low. Open alerts for EKS clusters with versions higher than 1.27 will be resolved.</p></td></tr><tr><td><strong>AWS Auto Scaling group launch configuration not configured with Instance Metadata Service v2 (IMDSv2)</strong></td><td><p><strong>Changes–</strong> The policy is updated to exclude instance configurations created by the Elastic Beanstalk service where the IMDSv1 is deactivated.</p><p><strong>Current RQL–</strong></p><pre><code>config from cloud.resource where api.name = 'aws-ec2-autoscaling-launch-configuration' AND json.rule = (metadataOptions.httpEndpoint does not exist) or (metadataOptions.httpEndpoint equals "enabled" and metadataOptions.httpTokens equals "optional") as X; config from cloud.resource where api.name = 'aws-describe-auto-scaling-groups' as Y; filter ' $.X.launchConfigurationName equal ignore case $.Y.launchConfigurationName'; show X;
</code></pre><p><strong>Updated RQL–</strong></p><pre><code>config from cloud.resource where api.name = 'aws-ec2-autoscaling-launch-configuration' AND json.rule = (launchConfigurationName does not start with "awseb" and launchConfigurationName does not contain "AWSEBAutoScalingLaunchConfiguration") and ((metadataOptions.httpEndpoint does not exist) or (metadataOptions.httpEndpoint equals "enabled" and metadataOptions.httpTokens equals "optional")) as X; config from cloud.resource where api.name = 'aws-describe-auto-scaling-groups' as Y; filter ' $.X.launchConfigurationName equal ignore case $.Y.launchConfigurationName'; show X;
</code></pre><p><strong>Policy Type–</strong> Config</p><p><strong>Policy Severity–</strong> Medium</p><p><strong>Impact–</strong> Low. Open alerts where the launch configurations are created by Elastic Beanstalk automatically, where the IMDSv1 is deactivated will be resolved.</p></td></tr><tr><td><strong>AWS S3 bucket encrypted using Customer Managed Key (CMK) with overly permissive policy</strong></td><td><p><strong>Changes–</strong> The policy RQL and remediation steps are updated to check for Actions and Effect in the KMS policy to reduce false positives.</p><p><strong>Current RQL–</strong></p><pre><code>config from cloud.resource where cloud.type = 'aws' AND api.name= 'aws-s3api-get-bucket-acl' AND json.rule = (sseAlgorithm contains "aws:kms" or sseAlgorithm contains "aws:kms:dsse") and kmsMasterKeyID exists as X; config from cloud.resource where api.name = 'aws-kms-get-key-rotation-status' AND json.rule = keyMetadata.keyState equals Enabled and keyMetadata.keyManager equals CUSTOMER and policies.default.Statement[?any((Principal.AWS equals * or Principal equals *)and Condition does not exist)] exists as Y; filter '$.X.kmsMasterKeyID contains $.Y.key.keyArn' ; show X;
</code></pre><p><strong>Updated RQL–</strong></p><pre><code>config from cloud.resource where cloud.type = 'aws' AND api.name= 'aws-s3api-get-bucket-acl' AND json.rule = (sseAlgorithm contains "aws:kms" or sseAlgorithm contains "aws:kms:dsse") and kmsMasterKeyID exists as X; config from cloud.resource where api.name = 'aws-kms-get-key-rotation-status' AND json.rule = keyMetadata.keyState equals Enabled and keyMetadata.keyManager equals CUSTOMER and policies.default.Statement[?any(Effect equals Allow and (Principal.AWS equals * or Principal equals *) and Condition does not exist and (Action equals "*" or Action equal ignore case "kms:*"))] exists as Y; filter '$.X.kmsMasterKeyID contains $.Y.key.keyArn' ; show X;
</code></pre><p><strong>Policy Type–</strong> Config</p><p><strong>Policy Severity–</strong> Medium</p><p><strong>Impact–</strong> Low. Open alerts where Effect is not 'Allow' and Action is specific will be resolved.</p></td></tr><tr><td><strong>AWS Kinesis streams encryption using default KMS keys instead of Customer’s Managed Master Keys</strong></td><td><p><strong>Changes–</strong> The policy RQL is updated to include the resource using AWS managed key via alias.</p><p><strong>Updated RQL–</strong></p><pre><code>config from cloud.resource where cloud.type = 'aws' AND api.name = 'aws-kinesis-list-streams' as X; config from cloud.resource where api.name = 'aws-kms-get-key-rotation-status' as Y; filter '(($.Y.keyMetadata.keyManager equals AWS and $.Y.key.keyArn equals $.X.keyId) or $.X.keyId contains "alias/aws/") and $.X.encryptionType equals KMS'; show X;
</code></pre><p><strong>Policy Type–</strong> Config</p><p><strong>Policy Severity–</strong> Informational</p><p><strong>Impact–</strong> Low. New alerts will be created for the resource which is using AWS managed key via alias.</p></td></tr><tr><td><strong>AWS RDS instance without Automatic Backup setting</strong></td><td><p><strong>Changes–</strong> The policy RQL is updated to exclude SQL Server (Enterprise edition) read replica as automatic backup cannot be enabled for such instances.</p><p><strong>Current RQL–</strong></p><pre><code>config from cloud.resource where cloud.type = 'aws' AND api.name = 'aws-rds-describe-db-instances' AND json.rule = 'backupRetentionPeriod equals 0 or backupRetentionPeriod does not exist'
</code></pre><p><strong>Updated RQL–</strong></p><pre><code>config from cloud.resource where cloud.type = 'aws' and api.name = 'aws-rds-describe-db-instances' AND json.rule = '(backupRetentionPeriod equals 0 or backupRetentionPeriod does not exist) and not(engine equal ignore case sqlserver-ee and statusInfos[*].statusType contains "read replication")'
</code></pre><p><strong>Policy Type–</strong> Config</p><p><strong>Policy Severity–</strong> Low</p><p><strong>Impact–</strong> Low. Open alerts for SQL Server (Enterprise edition) read replica will be resolved.</p></td></tr><tr><td><strong>Azure SQL server using insecure TLS version</strong></td><td><p><strong>Changes–</strong> The policy RQL is updated to eliminate the check for "NONE" since it now defaults to using version 1.2 or 1.3 in accordance with the latest CSP updates.</p><p><strong>Current RQL–</strong></p><pre><code>config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-sql-server-list' AND json.rule = ['sqlServer'].['properties.state'] equal ignore case "Ready" and (['sqlServer'].['properties.minimalTlsVersion'] equal ignore case "None" or ['sqlServer'].['properties.minimalTlsVersion'] equals "1.0" or ['sqlServer'].['properties.minimalTlsVersion'] equals "1.1")
</code></pre><p><strong>Updated RQL–</strong></p><pre><code>config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-sql-server-list' AND json.rule = ['sqlServer'].['properties.state'] equal ignore case "Ready" and (['sqlServer'].['properties.minimalTlsVersion'] equals "1.0" or ['sqlServer'].['properties.minimalTlsVersion'] equals "1.1")
</code></pre><p><strong>Policy Type–</strong> Config</p><p><strong>Policy Severity–</strong> Low</p><p><strong>Impact–</strong> Low. Open alerts where minimalTlsVersion is set to 'NONE' will be resolved.</p></td></tr><tr><td><strong>Policy Updates—Metadata</strong></td><td></td></tr><tr><td><strong>Azure SQL server public network access setting is enabled</strong></td><td><p><strong>Changes–</strong> The policy description and remediation steps are updated to reflect the latest changes in Azure to ensure accurate remediation of flagged resources.</p><p><strong>Current Description–</strong></p><p>This policy identifies Azure SQL servers which have public network access setting enabled. Publicly accessible SQL servers are vulnerable to external threats with risk of unauthorized access or may remotely exploit any vulnerabilities. It is recommended to configure the SQL servers with IP-based strict server-level firewall rules or virtual-network rules or private endpoints so that servers are accessible only to restricted entities.</p><p><strong>Updated Description–</strong></p><p>This policy identifies Azure SQL servers which have public network access setting enabled. Publicly accessible SQL servers are vulnerable to external threats with risk of unauthorized access or may remotely exploit any vulnerabilities. It is recommended to disable public network access to the Azure SQL servers and use private endpoints or virtual network service endpoints to secure connectivity.</p></td></tr><tr><td><strong>Azure Front Door Web application firewall (WAF) policy rule for Remote Command Execution is disabled</strong></td><td><p><strong>Changes–</strong> The policy name and description are updated as per the CSP updates.</p><p><strong>Current Name–</strong></p><p>Azure Front Door Web application firewall (WAF) policy rule for Remote Command Execution is disabled</p><p><strong>Updated Name–</strong></p><p>Azure Front Door (Classic) Web application firewall (WAF) policy rule for Remote Command Execution is disabled</p><p><strong>Current Description–</strong></p><p>This policy identifies Azure Front Door Web application firewall (WAF) policies that have the Remote Command Execution rule disabled. It is recommended to define the criteria in the WAF policy with the rule ‘Remote Command Execution (944240)’ under managed rules to help in detecting and mitigating Log4j vulnerability. For details see: <a href="https://www.microsoft.com/security/blog/2021/12/11/guidance-for-preventing-detecting-and-hunting-for-cve-2021-44228-log4j-2-exploitation/">https://www.microsoft.com/security/blog/2021/12/11/guidance-for-preventing-detecting-and-hunting-for-cve-2021-44228-log4j-2-exploitation/</a></p><p><strong>Updated Description–</strong></p><p>This policy identifies Azure Front Door (Classic) Web application firewall (WAF) policies that have the Remote Command Execution rule disabled. It is recommended to define the criteria in the WAF policy with the rule ‘Remote Command Execution (944240)’ under managed rules to help in detecting and mitigating Log4j vulnerability. For details see: <a href="https://www.microsoft.com/security/blog/2021/12/11/guidance-for-preventing-detecting-and-hunting-for-cve-2021-44228-log4j-2-exploitation/">https://www.microsoft.com/security/blog/2021/12/11/guidance-for-preventing-detecting-and-hunting-for-cve-2021-44228-log4j-2-exploitation/</a></p><p><strong>Impact–</strong> None. This change does not affect the functionality of the policy.</p><p><strong>Impact on Alerts–</strong> None.</p></td></tr><tr><td><strong>Policy Deletion</strong></td><td></td></tr><tr><td><strong>Azure Microsoft Defender for Cloud automatic provisioning of log Analytics agent for Azure VMs is set to Off</strong></td><td><p><strong>Changes–</strong> The policy is deleted since Azure has deprecated the <a href="https://learn.microsoft.com/en-us/azure/defender-for-cloud/prepare-deprecation-log-analytics-mma-agent">Log Analytics</a> agent.</p><p><strong>Impact–</strong> All alerts will be resolved as Policy Deleted.</p></td></tr></tbody></table>

## New Compliance Benchmarks and Updates

| **Compliance Benchmark**                                                           | **Description**                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          |
| ---------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Australian Energy Sector Cyber Security Framework (AESCSF) V2 - Lite Framework** | <p>The AESCSF Version 2 Lite Framework is a simplified cyber security compliance tool tailored for lower-criticality organizations in the Australian energy sector. It enables these entities to self-assess their cyber security maturity across 11 key categories—such as risk management, asset management, identity and access, incident response, and privacy—using 28 plain-language questions. By providing an accessible, structured approach to identifying strengths and gaps, the Lite Framework helps organizations benchmark their security posture, prioritize improvements, and align with foundational industry and national standards, even with limited resources or expertise.</p><p>You can access this built-in compliance standard and related policies on the <strong>Compliance > Standards</strong> page. Additionally, you can generate reports to instantly view or download them, or set up scheduled reports to continuously monitor compliance.</p>                                                                        |
| **CIS Microsoft Azure Foundations Benchmark v4.0.0 - Level 1 and Level 2**         | <p>Prisma Cloud now supports the latest version of CIS Microsoft Azure Foundations Benchmark v4.0.0. This compliance standard supports two levels - Level 1 and Level 2. The CIS Azure Foundations Benchmark provides prescriptive guidance for establishing a secure baseline configuration for the Azure environment.</p><p>You can access this built-in compliance standard and related policies on the <strong>Compliance > Standards</strong> page. Additionally, you can generate reports to instantly view or download them, or set up scheduled reports to continuously monitor compliance.</p>                                                                                                                                                                                                                                                                                                                                                                                                                                                  |
| **CIS Amazon Web Services Foundations Benchmark v5.0.0 - Level 1 and Level 2**     | <p>Prisma Cloud now supports the latest version of CIS Amazon Web Services (AWS) Foundations Benchmark v5.0.0. This compliance standard supports two levels - Level 1 and Level 2. The CIS AWS Foundations Benchmark provides prescriptive guidance for establishing a secure baseline configuration for the AWS Cloud Infrastructure environment.</p><p>You can access this built-in compliance standard and related policies on the <strong>Compliance > Standards</strong> page. Additionally, you can generate reports to instantly view or download them, or set up scheduled reports to continuously monitor compliance.</p>                                                                                                                                                                                                                                                                                                                                                                                                                       |
| **CIS Google Cloud Platform Benchmark v4.0.0 - Level 1 and Level 2**               | <p>Prisma Cloud now supports the latest version of CIS Google Cloud Platform (GCP) Benchmark v4.0.0. This compliance standard supports two levels - Level 1 and Level 2. The CIS GCP Benchmark v4.0.0 provides a comprehensive set of security best practices and configuration guidelines designed to help organizations secure their Google Cloud environments. Developed through a community consensus process, this benchmark outlines controls for key areas such as identity and access management, logging and monitoring, networking, virtual machines, storage, and database services. By following these recommendations, organizations can strengthen their cloud security posture, meet regulatory requirements, and protect against evolving cyber threats.</p><p>You can access this built-in compliance standard and related policies on the <strong>Compliance > Standards</strong> page. Additionally, you can generate reports to instantly view or download them, or set up scheduled reports to continuously monitor compliance.</p> |


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.prismacloud.io/release-notes/prisma-cloud-release-information/features-introduced-in-2025/features-introduced-in-july-2025.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.