> For the complete documentation index, see [llms.txt](https://docs.prismacloud.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.prismacloud.io/release-notes/prisma-cloud-release-information/features-introduced-in-2025/features-introduced-in-june-2025.md).

# Features Introduced in June 2025

Learn what’s new on Prisma® Cloud in June 2025.

The June (25.6.1) release does not include any API ingestions or new policies.

* [Policy Updates](#policy-updates)
* [New Compliance Benchmarks and Updates](#new-compliance-benchmarks-and-updates)
* [Deprecation Notices](#deprecation-notices)

## Policy Updates

<table data-header-hidden><thead><tr><th></th><th></th></tr></thead><tbody><tr><td><strong>Policy Updates</strong></td><td><strong>Description</strong></td></tr><tr><td><strong>Policy Updates—RQL</strong></td><td></td></tr><tr><td><strong>AWS ElastiCache Redis cluster with Redis AUTH feature disabled</strong></td><td><p><strong>Changes—</strong> The policy is updated to exclude resources with RBAC Auth configured.</p><p><strong>Current RQL–</strong></p><pre><code>config from cloud.resource where cloud.type = 'aws' AND api.name = 'aws-elasticache-describe-replication-groups' AND json.rule = 'authTokenEnabled is false or transitEncryptionEnabled is false or authTokenEnabled does not exist or transitEncryptionEnabled does not exist'
</code></pre><p><strong>Updated RQL–</strong></p><pre><code>config from cloud.resource where cloud.type = 'aws' AND api.name = 'aws-elasticache-describe-replication-groups' AND json.rule = 'engine equal ignore case Redis and (authTokenEnabled is false or transitEncryptionEnabled is false or authTokenEnabled does not exist or transitEncryptionEnabled does not exist) and userGroupIds is empty'
</code></pre><p><strong>Policy Type–</strong> Config</p><p><strong>Policy Severity–</strong> Low</p><p><strong>Impact–</strong> Low. Open alerts where RBAC Auth is configured on AWS Elasticache Redis will be resolved.</p></td></tr><tr><td><strong>AWS DynamoDB table Auto Scaling not enabled</strong></td><td><p><strong>Changes—</strong> The policy remediation step is updated according to AWS console change.</p><p><strong>Policy Type–</strong> Config</p><p><strong>Policy Severity–</strong> Informational</p><p><strong>Impact–</strong> No impact on alerts as only the metadata has been changed.</p></td></tr><tr><td><strong>Azure Storage Account Container with activity log has BYOK encryption disabled</strong></td><td><p><strong>Changes—</strong> The policy is updated to enhance the RQL query.</p><p><strong>Current RQL–</strong></p><pre><code>config from cloud.resource where api.name = 'azure-storage-account-list' as X; config from cloud.resource where api.name = 'azure-monitor-log-profiles-list' as Y; filter '($.X.properties.encryption.keySource does not equal "Microsoft.Keyvault" and $.X.properties.encryption.keyvaultproperties.keyname is not empty and $.X.properties.encryption.keyvaultproperties.keyversion is not empty and $.X.properties.encryption.keyvaultproperties.keyvaulturi is not empty and $.Y.properties.storageAccountId contains $.X.name)'; show X;
</code></pre><p><strong>Updated RQL–</strong></p><pre><code>config from cloud.resource where api.name = 'azure-storage-account-list' as X; config from cloud.resource where api.name = 'azure-monitor-log-profiles-list' as Y; filter '($.X.properties.encryption.keySource does not equal "Microsoft.Keyvault" and $.Y.properties.storageAccountId contains $.X.name)'; show X;
</code></pre><p><strong>Policy Type–</strong> Config</p><p><strong>Policy Severity–</strong> Informational</p><p><strong>Impact–</strong> No impact on alerts as the functionality of the RQL remains same. The RQL has been updated to remove the irrelevant keys.</p></td></tr><tr><td><strong>Azure Storage Account default network access is set to 'Allow'</strong></td><td><p><strong>Changes—</strong> The policy RQL needs to consider the existence of "publicNetworkAccess" since the attribute can be added via CLI.</p><p><strong>Current RQL–</strong></p><pre><code>config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-storage-account-list' AND json.rule = properties.publicNetworkAccess equal ignore case "Enabled" AND networkRuleSet.defaultAction equal ignore case "Allow"
</code></pre><p><strong>Updated RQL–</strong></p><pre><code>config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-storage-account-list' AND json.rule = (properties.publicNetworkAccess equal ignore case "Enabled" AND networkRuleSet.defaultAction equal ignore case "Allow") or (properties.publicNetworkAccess does not exist AND networkRuleSet.defaultAction equal ignore case "Allow")
</code></pre><p><strong>Policy Type–</strong> Config</p><p><strong>Policy Severity–</strong> Informational</p><p><strong>Impact–</strong> Medium. New alerts will be triggered if the <code>publicNetworkAccess</code> attribute does not exist and <code>networkRuleSet</code> is set to allow.</p></td></tr><tr><td><strong>GCP PostgreSQL instance database flag log_min_messages is not set</strong></td><td><p><strong>Changes—</strong> The policy has been revised to align specifically with the Compliance requirement: ensure that the log_min_messages flag for Cloud SQL PostgreSQL instances is configured to a minimum level of WARNING, in accordance with the CIS Google Cloud Platform Benchmark.</p><p><strong>Current Policy Name—</strong></p><p>GCP PostgreSQL instance database flag log_min_messages is not set</p><p><strong>Updated Policy Name—</strong></p><p>GCP PostgreSQL instance database flag log_min_messages is not set to Warning or higher</p><p><strong>Current Description—</strong></p><p>This policy identifies PostgreSQL database instances in which database flag log_min_messages is not set to warning. The log_min_messages flag controls which message levels are written to the server log, valid values are DEBUG5, DEBUG4, DEBUG3, DEBUG2, DEBUG1, INFO, NOTICE, WARNING, ERROR, LOG, FATAL, and PANIC. Each level includes all the levels that follow it. log_min_messages flag value changes should only be made in accordance with the organization’s logging policy. Auditing helps in troubleshooting operational problems and also permits forensic analysis.</p><p><strong>Updated Description—</strong></p><p>This policy detects PostgreSQL database instances where the log_min_messages configuration flag is not set to the WARNING level or higher.</p><p>The log_min_messages parameter governs the minimum level of message severity that is logged by the PostgreSQL server. Acceptable values, in increasing order of severity, include: DEBUG5, DEBUG4, DEBUG3, DEBUG2, DEBUG1, INFO, NOTICE, WARNING, ERROR, LOG, FATAL, and PANIC. Each severity level includes the subsequent levels mentioned. Setting this flag to a lower severity level, such as the DEBUG levels or INFO, increases log verbosity, while higher levels reduce log detail.</p><p>As a security best practice, setting log_min_messages to WARNING or higher helps mitigate risks associated with insufficient or excessive logging.</p><p><strong>Current RQL–</strong></p><pre><code>config from cloud.resource where cloud.type = 'gcp' AND api.name = 'gcloud-sql-instances-list' AND json.rule = "databaseVersion contains POSTGRES and settings.databaseFlags[?(@.name=='log_min_messages')] does not exist"
</code></pre><p><strong>Updated RQL–</strong></p><pre><code>config from cloud.resource where cloud.type = 'gcp' AND api.name = 'gcloud-sql-instances-list' AND json.rule = state equal ignore case "RUNNABLE" and databaseVersion contains POSTGRES and settings.databaseFlags[?(@.name=='log_min_messages')].value is not member of ( "warning", "error", "log", "fatal", "panic")
</code></pre><p><strong>Policy Type–</strong> Config</p><p><strong>Policy Severity–</strong> Informational</p><p><strong>Impact–</strong> Low. New alerts will be triggered in case the log_min_messages flag is not set to either "warning", "error", "log", "fatal", or "panic".</p></td></tr><tr><td><strong>GCP PostgreSQL instance database flag log_min_error_statement is not set</strong></td><td><p><strong>Current Policy Name–</strong> GCP PostgreSQL instance database flag log_min_error_statement is not set</p><p><strong>Updated Policy Name–</strong> GCP PostgreSQL instance database flag log_min_error_statement is not set to Error or higher</p><p><strong>Current Description–</strong></p><p>This policy identifies PostgreSQL database instances in which database flag log_min_error_statement is not set. The log_min_error_statement flag defines the minimum message severity level that are considered as an error statement. Messages for error statements are logged with the SQL statement. Valid values include DEBUG5, DEBUG4, DEBUG3, DEBUG2, DEBUG1, INFO, NOTICE, WARNING, ERROR, LOG, FATAL, and PANIC. Each severity level includes the subsequent levels. log_min_error_statement flag value changes should only be made in accordance with the organization’s logging policy. Proper auditing can help in troubleshooting operational problems and also permits forensic analysis.</p><p><strong>Updated Description–</strong></p><p>This policy detects PostgreSQL database instances where the log_min_error_statement flag is not configured at the error level or higher.</p><p>This log_min_error_statement parameter sets the minimum severity level for logging SQL statements that produce errors by the PostgreSQL server. Acceptable values, in increasing order of severity: DEBUG5, DEBUG4, DEBUG3, DEBUG2, DEBUG1, INFO, NOTICE, WARNING, ERROR, LOG, FATAL, and PANIC. Each severity level includes the subsequent levels mentioned. Without this flag set, critical error-generating SQL statements may not be logged, leading to insufficient visibility into potential security incidents, failed attacks, or misconfigurations hindering threat detection and post-incident analysis.</p><p>As a security best practice, setting log_min_error_statement to error or higher helps in troubleshooting operational problems and also permits forensic analysis.</p><p><strong>Current RQL–</strong></p><pre><code>config from cloud.resource where cloud.type = 'gcp' AND api.name = 'gcloud-sql-instances-list' AND json.rule = "databaseVersion contains POSTGRES and settings.databaseFlags[?(@.name=='log_min_error_statement')] does not exist"
</code></pre><p><strong>Updated RQL–</strong></p><pre><code>config from cloud.resource where cloud.type = 'gcp' AND api.name = 'gcloud-sql-instances-list' AND json.rule = state equals ignore case 'RUNNABLE' and databaseVersion contains POSTGRES and settings.databaseFlags[?(@.name=='log_min_error_statement')].value is not member of ( "error" , "log", "fatal", "panic")
</code></pre><p><strong>Policy Type–</strong> Config</p><p><strong>Policy Severity–</strong> Informational</p><p><strong>Impact–</strong> Low. New alerts will be triggered in case the log_min_error_statement flag is not set to "error".</p></td></tr><tr><td><strong>GCP IAM principals with service account privileges</strong></td><td><p><strong>Current Description–</strong></p><p>This policy identifies AWS IAM Principals with service account privileges.</p><p>Assigning a principal the Service account role in Google Cloud allows them to impersonate service accounts and use their permissions. This means the principal can perform actions on behalf of the service account, essentially inheriting all permissions granted to that service account.</p><p>To maintain the security of your information and resources, it is crucial to assign this role only to authorized and trusted IAM Principals.</p><p><strong>Updated Description–</strong></p><p>This policy identifies GCP IAM Principals with service account privileges.</p><p>Assigning a principal the Service account role in Google Cloud allows them to impersonate service accounts and use their permissions. This means the principal can perform actions on behalf of the service account, essentially inheriting all permissions granted to that service account.</p><p>To maintain the security of your information and resources, it is crucial to assign this role only to authorized and trusted IAM Principals.</p><p><strong>Policy Type–</strong> Config</p><p><strong>Policy Severity–</strong> Low</p><p><strong>Impact–</strong> Low</p></td></tr></tbody></table>

## New Compliance Benchmarks and Updates

| **Compliance Benchmark**                                          | **Description**                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      |
| ----------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Australian Energy Sector Cyber Security Framework (AESCSF) V2** | <p>Prisma Cloud now supports the Australian Energy Sector Cyber Security Framework (AESCSF) V2. This compliance standard is a specialized cybersecurity standard designed to guide energy sector organizations in Australia. AESCSF V2 provides a structured approach to managing cyber risks by aligning security controls with industry-specific threats and regulatory requirements. It emphasizes resilience, risk management, and continuous improvement to protect critical energy infrastructure from evolving cyber threats.</p><p>You can access this built-in compliance standard and related policies on the <strong>Compliance > Standards</strong> page. Additionally, you can generate reports to instantly view or download them, or set up scheduled reports to continuously monitor compliance.</p> |

## Deprecation Notices

| **Change**               | **Description**                                                                                                                                     |
| ------------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------- |
| **aws-emr-instance API** | The **aws-emr-instance** API has been deprecated and is effectively no longer included in the RQL autosuggest dropdown on the **Investigate** page. |


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.prismacloud.io/release-notes/prisma-cloud-release-information/features-introduced-in-2025/features-introduced-in-june-2025.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.