Cloud Discovery Enhancements
Secure the Runtime
34.00.137
|Identify Account ID attribution for app-embedded defenders used for defending CaaS assets: The Account ID was previously available for ECS Fargate and Google Cloud Run. This release adds the support for displaying the Account ID for ACI as well. With this release:
Azure Container Instances (ACI): In this release, Account ID is shown for app-embedded defenders installed on ACI containers after you perform the following steps for each container:
Jira Authentication Update for Prisma Cloud Runtime Alerts
Secure the Runtime
34.00.137
|Jira Cloud has deprecated Basic Authentication with passwords and now requires API tokens for authentication. When integrating Prisma Cloud Runtime with Jira as an alert provider, you must use an API token instead of a username-password combination.
Required Actions
To set up a new alert profile for Jira Cloud users, do the following:
Generate an API token from your Jira Cloud account.
For more information, see Manage API tokens for your Atlassian account topic in Jira Documentation site.
Save the token in Prisma Cloud’s Credentials Store and use this new credential when adding a new Jira Alert profile.
For more information, see Adding Jira Cloud Credentials topic in the Prisma Cloud Admin Guide.
To update an existing alert profile for Jira Cloud users, do the following:
Generate an API token from your Jira Cloud account.
For more information, see Manage API tokens for your Atlassian account topic in the Jira Documentation site.
Update the credentials by replacing the password with the API token.
For more information, see Updating Jira Cloud Credentials topic in the Prisma Cloud Admin Guide.
To set Up a new alert profile for Jira Data Center (DC) users, do the following:
Generate a personal access token from your Jira DC account.
For more information, see Using Personal Access Tokens topic in the Jira Documentation site.
Better utilization of vendor-specific feeds
Secure the Runtime
34.00.137
|The National Vulnerability Database (NVD) provides a valuable baseline CVSS score for vulnerabilities. However, vendors often have a more granular understanding of how a specific vulnerability impacts their implementation of a component. This allows them to provide a more accurate CVSS score, especially when considering environmental factors and the specific ways their product utilizes the vulnerable component. In some cases, vendor-specific vulnerability feeds may have the latest CVSS scores before they are reflected in NVD.
This release leverages additional data from vendor-specific vulnerability feeds, such as those from RedHat, Photon OS, and Ruby Gems, and implements several improvements in the extraction and reporting of CVSS scores. These changes provide more accurate and timely CVSS scores, reflecting the latest vendor-specific mitigations, configurations, and environmental impacts.
RedHat Security Feed:
Photon OS Security Feed:
Ruby Gems Security Feed:
Amazon Linux Security Feed:
Fallback to NVD CVSS Scores
If the vendor feed does not provide a CVSS value for any CVE, then the CVSS value from the NVD will be used. This ensures that we always have a CVSS score to guide our risk assessment and mitigation efforts.
| |Customization for Scanning Amazon Machine Images (AMIs)
Secure the Runtime
34.00.137
|Prisma Cloud now offers on-prem users greater flexibility in selecting AMIs.
For on-prem users, the following environment variables enable customization:
AGENTLESS\_USE\_CUSTOM\_AMI – Enables or disables the use of custom AMIs.AGENTLESS\_CUSTOM\_AMI\_PER\_REGION – Specifies custom AMIs per AWS regionExample Configuration:
AGENTLESS\_USE\_CUSTOM\_AMI=true AGENTLESS\_CUSTOM\_AMI\_PER\_REGION='{"us-east-1":"ami-005fc0f236362e99f"}'
In this example, the custom AMI (ami-005fc0f236362e99f) is used in the 'us-east-1' region.
Behavior Based on Configuration:
AGENTLESS\_USE\_CUSTOM\_AMI is false, Prisma Cloud falls back to the previous scanner image, which is Ubuntu 20.04.AGENTLESS\_USE\_CUSTOM\_AMI is set to true but AGENTLESS\_CUSTOM\_AMI\_PER\_REGION is not set, Prisma Cloud uses the LaunchDarkly (LD) custom AMI list.AGENTLESS\_USE\_CUSTOM\_AMI is not set, Prisma Cloud defaults to the LD custom AMI list.Removal of Stale Hosts and Images
Secure the Runtime
34.00.137
| We’re implementing a fix that will remove outdated assets that are no longer protected by a Defender. These assets should have been automatically deleted previously, but were not. With this update, you might notice that certain stale assets are no longer present in your inventory. As a result, you might also see a reduction in vulnerabilities and compliance findings due to their removal. | |System Requirements: Changes to supported systems and platforms
Secure the Runtime
34.00.137
|The following changes have been made to the system requirements:
Support added for WAAS
Support removed for WAAS
Support removed for Auto Defend
Support added for Runtime Protection
Support removed for Runtime Protection
Support added for x86 Operating Systems
Support removed for x86 Operating Systems
Support added for x86 Orchestrators
Support removed for x86 Orchestrators
Support added for ARM orchestrators
Support removed for ARM orchestrators
aws-cognito-identity-pool-role
Additional permissions needed:
cognito-identity:ListIdentityPoolscognito-identity:GetIdentityPoolRolesThe Security audit role includes the permissions.
| | **Amazon Connect** |aws-connect-instance-user
Additional permissions needed:
connect:ListUsersconnect:DescribeUserconnect:ListInstancesThe Security audit role includes the connect:ListUsers permissions.
aws-connect-instance-security-profile
Additional permissions needed:
connect:ListSecurityProfilesconnect:DescribeSecurityProfileconnect:ListInstancesThe Security audit role includes the connect:ListInstances permissions.
aws-ec2-describe-images
Additional permission needed:
ec2:DescribeImageAttributeThe Security audit role includes the permission.
Also, the JSON resource for this API includes a new imageAttributes field.
aws-ec2-describe-vpcs
Additional permission needed:
ec2:DescribeImageAttributeec2:DescribeVpcAttributeThe Security audit role includes the permission.
This update requires the new permission`ec2:DescribeVpcAttribute` be added in addition to the existing permission.
| | **Amazon EC2** |aws-ec2-instance-connect-endpoint
Additional permission needed:
ec2:DescribeInstanceConnectEndpointsThe Security audit role includes the permission.
| | **Amazon EC2** |aws-ec2-image-block-public-access-state
Additional permission needed:
ec2:GetImageBlockPublicAccessStateThe Security audit role includes the permission.
| | **Amazon EC2** |aws-ec2-snapshot-block-public-access-state
Additional permission needed:
ec2:GetSnapshotBlockPublicAccessStateThe Security audit role does not include the permission. You must manually add the permission in the CFT template to enable it.
| | **Amazon EventBridge Pipes** |aws-event-bridge-pipe
Additional permissions needed:
pipes:ListPipespipes:DescribePipeThe Security audit role does not include the permissions. You must manually add the permissions in the CFT template to enable them.
| | **Amazon RDS** |aws-rds-db-instance-automated-backup
Additional permission needed:
rds:DescribeDBInstanceAutomatedBackupsThe Security audit role includes the permission.
| | **Amazon RDS** |aws-rds-db-proxy
Additional permission needed:
rds:DescribeDBProxiesThe Security audit role includes the permission.
| | **Amazon RDS** |aws-rds-db-proxy-target
Additional permissions needed:
rds:DescribeDBProxiesrds:DescribeDBProxyTargetsrds:DescribeDBProxyTargetGroupsThe Security audit role includes the permissions.
| | Update **Amazon RDS** |aws-rds-describe-db-instances
The JSON resource for the API will be updated to include a new field latestRestorableTime.
aws-s3-storage-lens-configuration
Additional permission needed:
s3:ListStorageLensConfigurationsThe Security audit role does not include the permission. You must manually add the permission in the CFT template to enable it.
| | **Amazon SNS** |aws-sns-subscriptions-by-topic
Additional permissions needed:
sns:ListTopicssns:ListSubscriptionsByTopicThe Security audit role includes the permissions.
| | **Amazon SQS** |aws-sqs-message-move-task
Additional permissions needed:
sqs:ListQueuessqs:ListMessageMoveTasksThe Security audit role only includes the sqs:ListQueues permission. You must manually include the sqs:ListMessageMoveTasks permission in the CFT template to enable it.
aws-glue-connection
Additional permission needed:
glue:GetTagsThe Security audit role includes the permission.
Also, the JSON resource for this API includes tags field.
aws-glue-blueprint
Additional permissions needed:
glue:ListBlueprintsglue:GetBlueprintThe Security audit role does not include the permissions. You must manually add the permissions in the CFT template to enable them.
| | **AWS Glue** |aws-glue-blueprint-run
Additional permissions needed:
glue:GetBlueprintRunsglue:GetBlueprintRunThe Security audit role does not include the permissions. You must manually add the permissions in the CFT template to enable them.
| | **AWS Lambda** |aws-lambda-function-event-invoke-config
Additional permissions needed:
lambda:ListFunctionslambda:GetFunctionEventInvokeConfigThe Security audit role includes the permissions.
| | **AWS Lambda** |aws-lambda-versions-by-function
Additional permissions needed:
lambda:ListFunctionslambda:ListVersionsByFunctionThe Security audit role includes the permissions.
| | **AWS Lambda** |aws-lambda-function-concurrency
Additional permissions needed:
lambda:ListFunctionslambda:GetFunctionConcurrencyThe Security audit role only includes the lambda:ListFunctions permission. You must manually include the lambda:GetFunctionConcurrency permission in the CFT template to enable it.
aws-lambda-runtime-management-config
Additional permissions needed:
lambda:ListFunctionslambda:GetRuntimeManagementConfigThe Security audit role only includes the lambda:ListFunctions permission. You must manually include the lambda:GetRuntimeManagementConfig permission in the CFT template to enable it.
aws-region
The JSON resource for the API is updated to include a new field accountId.
aws-region
The resource output of the API aws-region includes the new field accountId.
azure-api-management-service-authorization-server
Additional permissions needed:
Microsoft.ApiManagement/service/readMicrosoft.ApiManagement/service/authorizationServers/readThe Reader role includes the permissions.
| | **Azure API Management Services** |azure-api-management-service-backend
Additional permissions needed:
Microsoft.ApiManagement/service/readMicrosoft.ApiManagement/service/backends/readThe Reader role includes the permissions.
| | **Azure API Management Services** |azure-api-management-service-openid-connect-provider
Additional permissions needed:
Microsoft.ApiManagement/service/readMicrosoft.ApiManagement/service/openidConnectProviders/readThe Reader role includes the permissions.
| | **Azure API Management Services** |aazure-api-management-service-user
Additional permissions needed:
Microsoft.ApiManagement/service/readMicrosoft.ApiManagement/service/users/readThe Reader role includes the permissions.
| | **Azure Kubernetes Service** |azure-kubernetes-connected-cluster
Additional permissions needed:
Microsoft.Kubernetes/connectedClusters/ReadThe Reader role includes the permission.
| | **Azure CDN** |azure-frontdoor-standardpremium-origin-groups-origin
Additional permissions needed:
Microsoft.Cdn/profiles/readMicrosoft.Cdn/profiles/origingroups/readMicrosoft.Cdn/profiles/origingroups/origins/readThe Reader role includes the permissions.
| | **Azure Network Manager** |azure-network-manager-static-members
Additional permissions needed:
Microsoft.Network/networkManagers/readMicrosoft.Network/networkManagers/networkGroups/readMicrosoft.Network/networkManagers/networkGroups/staticMembers/readThe Reader role includes the permissions.
| | **Azure Network Manager** |azure-network-manager-security-admin-configuration
Additional permissions needed:
Microsoft.Network/networkManagers/readMicrosoft.Network/networkManagers/securityAdminConfigurations/readThe Reader role includes the permissions.
| | **Azure Network Manager** |azure-network-manager-network-group
Additional permissions needed:
Microsoft.Network/networkManagers/readMicrosoft.Network/networkManagers/networkGroups/readThe Reader role includes the permissions.
| | **Azure Recovery Services** |azure-recovery-service-site-recovery-protected-item
Additional permissions needed:
Microsoft.RecoveryServices/Vaults/readMicrosoft.RecoveryServices/vaults/replicationProtectedItems/readThe Reader role includes the permissions.
| | **Azure Storage** |azure-storage-account-blob-container
Additional permissions needed:
Microsoft.Storage/storageAccounts/readMicrosoft.Storage/storageAccounts/blobServices/containers/readThe Reader role includes the permissions.
| | **Azure Storage** |azure-storage-account-file-service-property
Additional permissions needed:
Microsoft.Storage/storageAccounts/readMicrosoft.Storage/storageAccounts/fileServices/readThe Reader role includes the permissions.
| | **Google Data Catalog** |gcloud-data-catalog-tag-template
Additional permissions needed:
datacatalog.catalogs.searchAlldatacatalog.tagTemplates.getdatacatalog.tagTemplates.getIamPolicyThe Viewer role includes the permissions.
| ## New Policies| Policies | Description |
| AWS Lightsail bucket accessible to unmonitored cloud accounts | Policy Description— AWS Lightsail buckets with permissions granted to unmonitored cloud accounts pose a significant security risk. These buckets, offering internet-accessible storage, could be compromised if unauthorized accounts gain access. Lightsail buckets provide object storage, allowing data retrieval from anywhere. Granting 'read' access to unmonitored cloud accounts introduces a substantial risk. Attackers might exploit this misconfiguration to exfiltrate sensitive data or inject malicious content, potentially leading to data breaches or system compromise. To mitigate this risk, restrict access to Lightsail buckets to only explicitly trusted and monitored cloud accounts. Only trusted and monitored cloud accounts should possess the necessary permissions. Regularly review and audit bucket permissions, removing access for any unmonitored or untrusted accounts. Implement robust monitoring and alerting to detect any unauthorized access attempts. Policy Severity— Medium Policy Type— Config |
| AWS Lightsail bucket publicly readable | Policy Description— Publicly readable objects in AWS Lightsail buckets expose sensitive data to unauthorized access, increasing the risk of data breaches and reputational harm. AWS Lightsail provides object storage through buckets, enabling data storage and retrieval. A misconfiguration allowing public readability exposes all stored data. Untrusted parties can freely access this information, leading to data exfiltration, intellectual property theft, and financial losses. To mitigate this risk, enforce the principle of least privilege. Restricting bucket access to authorized users is crucial for maintaining data confidentiality and integrity. Configure bucket permissions to be private, only granting access to specific users or groups needing it. Regularly review and audit bucket access controls to detect and address any misconfigurations promptly. Policy Severity— High Policy Type— Config |
| AWS Lightsail bucket object versioning is disabled | Policy Description— AWS Lightsail buckets lacking object versioning are susceptible to data loss and unauthorized modification. Disabling this feature removes the ability to revert to previous versions of objects after accidental deletion or malicious alteration. Lightsail buckets provide object storage, allowing data access from anywhere. Object versioning creates version history for every object stored. Without versioning, accidental deletion or malicious overwrites result in permanent data loss, severely impacting data integrity and potentially leading to business disruption or data breaches. Attackers could exploit this misconfiguration to permanently delete or modify critical data. To mitigate this risk, enable object versioning on all AWS Lightsail buckets, this ensures data recoverability, protecting against accidental or malicious actions and mitigating the risk of significant data loss. Regularly review bucket configurations to ensure object versioning remains active. Implement robust access control mechanisms. Policy Severity— Low Policy Type— Config |
| Policy Updates | Description |
| Policy Updates—RQL | |
| AWS CloudTrail is not enabled with multi-trail and not capturing all management events | Changes— The policy RQL is updated to reduce false positives when both management events and network activity events are configured. Current RQL– Updated RQL– Policy Type– Config Policy Severity– Informational Impact– Low. Existing alerts where all management event is configured and the event selector is configured as part of network activity event will be resolved. |
| Azure Container Registry with anonymous authentication enabled | Changes— The policy RQL will be updated to trigger an alert on Azure container registry when anonymous pull is enabled, resolving false alerts. Current RQL– Updated RQL– Policy Type– Config Policy Severity– High Impact– High. Existing alerts where the anonymous pull is disabled will be resolved and new alerts will be generated where the anonymous pull is enabled. |
| GCP Load balancer HTTPS target proxy is not configured with QUIC protocol | Changes— The policy RQL policy will be updated in the case of regional internal load balancers. Current RQL– Updated RQL– Policy Type– Config Policy Severity– Informational Impact– Low. Existing alerts for regional internal application load balancer will be resolved. |
| Instance affected by Spring Cloud Function SpringShell vulnerability is exposed to network traffic from the internet [CVE-2022-22963] | Changes— The policy RQL policy will be updated to consider internet network traffic as the source. Current RQL– Updated RQL– Policy Type– Network Policy Severity– Critical Impact– Low. |
Prisma Cloud now supports the latest version of Cloud Security Assurance Program (CSAP). This compliance standard supports five different levels - IaaS, SaaS Standard, SaaS Simplified, Low and Low SaaS. CSAP aims to boost confidence among public and private sector users, promoting secure cloud adoption and enhancing overall national cybersecurity.
You can now access this built-in standard and related policies on the Compliance > Standards page. Additionally, you can generate reports to instantly view or download them, or set up scheduled reports to continuously monitor compliance.
| | **\[Update] Korea – Information Security Management System** |New Policy mappings are added to Korea – Information Security Management System (ISMS) compliance standard.
Impact: As new mappings are introduced, compliance scoring might vary.
| | **\[Update] NIST CSF v2.0** |New Policy mappings are added to the National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF) v2.0 compliance standard.
Impact: As new mappings are introduced, compliance scoring might vary.
| ## REST API Updates | **REST API** | **Description** | | ----------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **Perform Event Search API** |The request body for Perform Event Search - POST /search/event has been updated.
Possible values for sort fields are updated from upper case to lower case.
| | **Support CaaS Specification References Field** | A new `hasCAASSpecReferences` query parameter has been introduced to [Get Registry Scan Results](https://pan.dev/compute/api/get-registry/), [Download Registry Scan Results](https://pan.dev/compute/api/get-registry-download/) and [Get Registry Image Names](https://pan.dev/compute/api/get-registry-names/) APIs to enable registry image filtering deployed as part of CaaS specifications (AWS Fargate, GCP Cloud Run, ACI). This parameter only applies to Prisma onboarded accounts. | | **Support Images Field** | A new `images` query parameter has been added to the [Get Discovered Cloud Entities](https://pan.dev/compute/api/get-cloud-discovery-entities/) API to filter cloud-discovered entities by the container image names defined in a CaaS specification (AWS Fargate Task Definition, GCP Cloud Run, ACI). This parameter only applies to Prisma onboarded accounts. | | **Support Service Field** | A new `service` parameter has been introduced to the [Get Discovered Cloud Entities](https://pan.dev/compute/api/get-cloud-discovery-entities/) API response to specify the discovered GCP Cloud Run service name. This parameter only applies to Prisma onboarded accounts. | | **Support CaaS Specification References Total Field** | A new `caasSpecReferencesTotal` parameter has been introduced to [Get Host Scan Results](https://pan.dev/compute/api/get-hosts/), [Get Image Scan Results](https://pan.dev/compute/api/get-images/), [Get Impacted Container Compliance Policy](https://pan.dev/compute/api/get-policies-compliance-container-impacted/), [Get Impacted VMs Compliance Policy](https://pan.dev/compute/api/get-policies-compliance-vms-impacted/), [Host App Firewall Policy Impacted](https://pan.dev/compute/api/get-policies-firewall-app-host-impacted/), [Get Impacted Host Vulnerability Policy](https://pan.dev/compute/api/get-policies-vulnerability-host-impacted/), [Get Impacted Image Vulnerability Policy](https://pan.dev/compute/api/get-policies-vulnerability-images-impacted/), [Get Registry Scan Results](https://pan.dev/compute/api/get-registry/) and [Get VM Image Scan Results](https://pan.dev/compute/api/get-vms/) APIs to specify the referenced number of CaaS specifications (AWS Fargate Task Definition, GCP Cloud Run, ACI). This parameter only applies to Prisma onboarded accounts. | | **Support for a Amazon Fargate Task Definition** | A new Enum value `aws-fargate-task-definition` has been added to `shared.ScanResultType` schema to specify a new scan result type of Amazon Fargate Task Definition. This parameter only applies to Prisma onboarded accounts. | --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.prismacloud.io/release-notes/prisma-cloud-release-information/features-introduced-in-2025/features-introduced-in-march-2025.md?ask=