> For the complete documentation index, see [llms.txt](https://docs.prismacloud.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.prismacloud.io/release-notes/prisma-cloud-release-information/features-introduced-in-2026/features-introduced-in-april-2026.md).

# Features Introduced in April 2026

Learn what’s new in the Prisma® Cloud April 2026 release.

* [Enhancements](#enhancements)
* [Changes in Existing Behavior](#changes-in-existing-behavior)
* [API Ingestions](#api-ingestions)
* [Policy Updates](#policy-updates)
* [Policy Deletions](#policy-deletions)
* [Compliance Updates](#new-compliance-benchmarks-and-updates)

## Enhancements

| **Feature**                                                                                                                                   | **Description**                                                                                                                                                                                                         |
| --------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| <p><strong>AWS SDK for Java 2.x Support</strong></p><p><mark style="background-color:orange;">Secure the Runtime</mark></p>                   | Prisma Cloud now supports the AWS SDK for Java 2.x, replacing the older AWS SDK for Java 1.x.This upgrade ensures compatibility with the latest AWS services and features, providing improved performance and security. |
| <p><strong>Restrict UI access for access key logins</strong></p><p><mark style="background-color:orange;">Secure the Runtime</mark></p>       | Added ability to block login using an access key via the CWP login UI page under a feature flag, aligning with the way access key based logins are handled by the main Prisma login page.                               |
| <p><strong>FIPS configuration via environment variable</strong></p><p><mark style="background-color:orange;">Secure the Runtime</mark></p>    | Added support for setting the `FIPS_ENABLED` configuration from an environment variable in `twistlock.cfg`.                                                                                                             |
| <p><strong>nginx\_unit vulnerability detection</strong></p><p><mark style="background-color:orange;">Secure the Runtime</mark></p>            | Added vulnerability detection support for nginx\_unit application server binaries.                                                                                                                                      |
| <p><strong>Configurable Cap for Per-Image Clusters</strong></p><p><mark style="background-color:orange;">Secure the Runtime</mark></p>        | You can now configure a cap on the number of clusters stored per image in MongoDB. This prevents excessive document growth for widely-deployed images and improves database performance.                                |
| <p><strong>OCI Compartment Support for Agentless Scanning</strong></p><p><mark style="background-color:orange;">Secure the Runtime</mark></p> | Agentless scanning configuration now accepts OCI compartments by OCID in addition to compartment name. Use the OCID when you need to reference compartments programmatically or avoid ambiguity with duplicate names.   |
| <p><strong>Package URL Augmentation for Binary Packages</strong></p><p><mark style="background-color:orange;">Secure the Runtime</mark></p>   | The scanner now augments binary packages with Package URLs (PURLs), improving software composition analysis accuracy and enabling better vulnerability correlation.                                                     |
| <p><strong>Upgrade xmlquery to avoid CVE-2026-32287</strong></p><p><mark style="background-color:orange;">Secure the Runtime</mark></p>       | Upgraded xmlquery (and xpath) dependencies to remediate CVE-2026-32287.                                                                                                                                                 |
| <p><strong>Remove libnghttp2 from Defender Dockerfile</strong></p><p><mark style="background-color:orange;">Secure the Runtime</mark></p>     | Removed the libnghttp2 package from the Defender Dockerfile to eliminate a known vulnerability from the container image.                                                                                                |
| <p><strong>Updated MongoDB to 7.0.31</strong></p><p><mark style="background-color:orange;">Secure the Runtime</mark></p>                      | Updated MongoDB from 7.0.29 to 7.0.31 to address additional security vulnerabilities.                                                                                                                                   |

## Changes in Existing Behavior

| **Audit Log Retention Policy** | <p>The retention period for audit events stored in the Prisma Cloud database changed from 120 days to 30 days. This update is part of our ongoing efforts to optimize performance and resource usage. The new retention period ensures a more responsive experience and efficient resource utilization across all environments.</p><p><strong>Impact</strong>: Features that rely on historical audit data will be impacted:<br>\* Audit Trail & Investigation: Tracing user actions and general audit log investigations will now be limited to the last 30 days of data.<br>\* Alert Details: For alerts triggered by audit events, the associated event details will no longer be available for investigation, when you select <strong>Investigate</strong> 30 + days after the event occurred.<br>\* Policy Evaluation: Evaluation of audit-event-based policies will focus on events within a 30-day window.<br>\* General Impact: Other platform features or custom workflows that rely on the retention of audit events beyond 30 days may be impacted.<br></p><p>The following functional areas will continue to operate without change, as they rely on real-time event processing:<br>\* Event Assisted Ingestion (EAI): Real-time ingestion triggers remain unaffected.<br>\* IAM Security: Real-time IAM analysis and monitoring remain unaffected.<br>\* Real-time Alerting: The triggering of alerts based on immediate event matches is not impacted.<br></p><p>No additional action is required. If your compliance or operational requirements necessitate audit log retention beyond 30 days, we recommend ensuring your CSP (AWS, Azure, GCP) is configured to archive these logs in their respective native storage (e.g., S3, GCS, or Azure Blob Storage).</p> |
| ------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **VPC Resource Ingestion**     | Prisma Cloud will now ingest accepter side VPC connections in addition to requester side VPC connections. This will ensure better coverage of VPC peering endpoints irrespective of whether the given VPC functions as a requester or an accepter for a given connection.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           |

## API Ingestions

| **Service**                                                                                                             | **API Details**                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |
| ----------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Amazon Web Services**                                                                                                 |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |
| **Amazon AppStream 2.0**                                                                                                | <p><strong>aws-app-stream-app-block-builder</strong></p><p>Additional permissions required:</p><ul><li><code>appstream:DescribeAppBlockBuilders</code></li><li><code>appstream:ListTagsForResource</code></li></ul><p>The Security Audit role does not include the permissions. A custom role is required.</p>                                                                                                                                                                                                        |
| **Amazon Cognito**                                                                                                      | <p><strong>aws-cognito-identity-provider</strong></p><p>Additional permissions required:</p><ul><li><code>cognito-idp:ListUserPools</code></li><li><code>cognito-idp:ListIdentityProviders</code></li><li><code>cognito-idp:DescribeIdentityProvider</code></li></ul><p>The Security Audit role includes the permissions.</p>                                                                                                                                                                                         |
| **Amazon Elasticsearch Service**                                                                                        | <p><strong>aws-es-serverless-access-policy</strong></p><p>Additional permissions required:</p><ul><li><code>aoss:ListAccessPolicies</code></li><li><code>aoss:GetAccessPolicy</code></li></ul><p>The Security Audit role does not include the permissions. You must add a custom role that includes these permissions.</p>                                                                                                                                                                                            |
| **Amazon Elasticsearch Service**                                                                                        | <p><strong>aws-es-serverless-security-policy</strong></p><p>Additional permissions required:</p><ul><li><code>aoss:ListSecurityPolicies</code></li><li><code>aoss:GetSecurityPolicy</code></li></ul><p>The Security Audit role does not include the permissions. You must add a custom role that includes these permissions.</p>                                                                                                                                                                                      |
| **Amazon Neptune**                                                                                                      | <p><strong>aws-neptune-analytics-graph</strong></p><p>Additional permissions required:</p><ul><li><code>neptune-graph:ListGraphs</code></li><li><code>neptune-graph:GetGraph</code></li><li><code>neptune-graph:ListTagsForResource</code></li></ul><p>The Security Audit role does not include the permissions. A custom role is required.</p>                                                                                                                                                                       |
| **Amazon Q Business**                                                                                                   | <p><strong>aws-qbusiness-index</strong></p><p>Additional permissions required:</p><ul><li><code>qbusiness:ListIndices</code></li><li><code>qbusiness:GetIndex</code></li><li><code>qbusiness:ListApplications</code></li><li><code>qbusiness:GetApplication</code></li><li><code>qbusiness:ListDataSources</code></li><li><code>qbusiness:GetDataSource</code></li></ul><p>The Security Audit role includes the permissions.</p>                                                                                      |
| **Amazon Q Business**                                                                                                   | <p><strong>aws-qbusiness-application</strong></p><p>Additional permissions required:</p><ul><li><code>qbusiness:ListApplications</code></li><li><code>qbusiness:GetApplication</code></li><li><code>qbusiness:GetPolicy</code></li><li><code>qbusiness:GetChatControlsConfiguration</code></li><li><code>qbusiness:ListTagsForResource</code></li></ul><p>The Security Audit role includes the permissions.</p>                                                                                                       |
| **Amazon Route53**                                                                                                      | <p><strong>aws-route53-profile</strong></p><p>Additional permissions required:</p><ul><li><code>route53profiles:ListProfiles</code></li><li><code>route53profiles:GetProfile</code></li><li><code>route53profiles:ListTagsForResource</code></li></ul><p>The Security Audit role does not include the permissions. A custom role is required.</p>                                                                                                                                                                     |
| **Amazon Route53**                                                                                                      | <p><strong>aws-route53-domains-operation</strong></p><p>Additional permission required:</p><ul><li><code>route53domains:ListOperations</code></li></ul><p>The Security Audit role includes the permission.</p>                                                                                                                                                                                                                                                                                                        |
| **AWS Database Migration Service**                                                                                      | <p><strong>aws-dms-data-provider</strong></p><p>Additional permissions required:</p><ul><li><code>dms:DescribeDataProviders</code></li><li><code>dms:ListTagsForResource</code></li></ul><p>The Security Audit role includes the permissions.</p>                                                                                                                                                                                                                                                                     |
| **AWS Database Migration Service**                                                                                      | <p><strong>aws-dms-replication-config</strong></p><p>Additional permissions required:</p><ul><li><code>dms:DescribeReplicationConfigs</code></li><li><code>dms:ListTagsForResource</code></li></ul><p>The Security Audit role includes the permissions.</p>                                                                                                                                                                                                                                                           |
| **AWS Database Migration Service**                                                                                      | <p><strong>aws-dms-replication-subnet-group</strong></p><p>Additional permissions required:</p><ul><li><code>dms:DescribeReplicationSubnetGroups</code></li><li><code>dms:ListTagsForResource</code></li></ul><p>The Security Audit role includes the permissions.</p>                                                                                                                                                                                                                                                |
| **AWS Database Migration Service**                                                                                      | <p><strong>aws-dms-instance-profile</strong></p><p>Additional permissions required:</p><ul><li><code>dms:ListInstanceProfiles</code></li><li><code>dms:ListTagsForResource</code></li></ul><p><code>dms:ListTagsForResource</code> is included in the Security Audit role. <code>dms:ListInstanceProfiles</code> is not included in the Security Audit role.</p>                                                                                                                                                      |
| **AWS Service Quotas**                                                                                                  | <p><strong>aws-servicequotas-service-quota</strong></p><p>Additional permissions required:</p><ul><li><code>servicequotas:ListServiceQuotas</code></li><li><code>servicequotas:ListTagsForResource</code></li></ul><p>The Security Audit role includes the permissions.</p><p>This API only supports AWS service 'VPC' quota details.</p>                                                                                                                                                                             |
| **Microsoft Azure**                                                                                                     |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |
| **Azure Power BI Embedded**                                                                                             | <p><strong>azure-powerbi-dedicated-capacities-diagnostic-settings</strong></p><p>Additional permissions required:</p><ul><li><code>Microsoft.PowerBIDedicated/servers/read</code></li><li><code>Microsoft.PowerBIDedicated/capacities/read</code></li></ul><p>The Reader role includes the permissions.</p>                                                                                                                                                                                                           |
| **Google Cloud Platform**                                                                                               |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |
| **Google Backup For GKE**                                                                                               | <p><strong>gcloud-gke-backup-backup-plan</strong></p><p>Additional permissions required:</p><ul><li><code>gkebackup.backupPlans.list</code></li><li><code>gkebackup.backupPlans.getIamPolicy</code></li></ul><p>The Viewer role includes the permissions.</p>                                                                                                                                                                                                                                                         |
| **Google Backup For GKE**                                                                                               | <p><strong>gcloud-gke-backup-restore-plan</strong></p><p>Additional permissions required:</p><ul><li><code>gkebackup.restorePlans.list</code></li><li><code>gkebackup.restorePlans.getIamPolicy</code></li></ul><p>The Viewer role includes the permissions.</p>                                                                                                                                                                                                                                                      |
| **Google Cloud SQL**                                                                                                    | <p><strong>gcloud-sql-instance-user</strong></p><p>Additional permission required:</p><ul><li><code>cloudsql.users.list</code></li></ul><p>The Viewer role includes the permission.</p>                                                                                                                                                                                                                                                                                                                               |
| **Google Network Security**                                                                                             | <p><strong>gcloud-network-security-project-address-group</strong></p><p>Additional permission required:</p><ul><li><code>networksecurity.addressGroups.list</code></li></ul><p>The Viewer role includes the permission.</p>                                                                                                                                                                                                                                                                                           |
| **Google Network Security**                                                                                             | <p><strong>gcloud-network-security-organization-address-group</strong></p><p>Additional permission required:</p><ul><li><code>networksecurity.addressGroups.list</code></li></ul><p>The Viewer role includes the permission.</p>                                                                                                                                                                                                                                                                                      |
| **Google Private Service Connect**                                                                                      | <p><strong>gcloud-psc-service-attachment</strong></p><p>Additional permissions required:</p><ul><li><code>compute.serviceAttachments.list</code></li><li><code>compute.serviceAttachments.getIamPolicy</code></li></ul><p>The Viewer role includes the permissions.</p>                                                                                                                                                                                                                                               |
| **Google Private Service Connect**                                                                                      | <p><strong>gcloud-psc-connection-policy</strong></p><p>Additional permissions required:</p><ul><li><code>networkconnectivity.serviceConnectionPolicies.list</code></li></ul><p>The Viewer role includes the permissions.</p>                                                                                                                                                                                                                                                                                          |
| **Google Private Service Connect**                                                                                      | <p><strong>gcloud-psc-network-attachment</strong></p><p>Additional permissions required:</p><ul><li><code>compute.networkAttachments.list</code></li><li><code>compute.networkAttachments.getIamPolicy</code></li></ul><p>The Viewer role includes the permissions.</p>                                                                                                                                                                                                                                               |
| **Oracle Cloud Infrastructure**                                                                                         |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |
| <p><strong>OCI Regions</strong></p><p><mark style="background-color:orange;">Update</mark></p>                          | <p>Prisma Cloud now supports the following four new Oracle Cloud Infrastructure (OCI) regions:</p><ul><li>Indonesia North (Batam) - <code>ap-batam-1</code></li><li>Serbia Central (Jovanovac) - <code>eu-jovanovac-1</code></li><li>Spain Central (Madrid 3) - <code>eu-madrid-3</code></li><li>Italy North (Turin) - <code>eu-turin-1</code></li></ul>                                                                                                                                                              |
| **API Updates**                                                                                                         |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |
| <p><strong>Amazon EventBridge</strong></p><p><mark style="background-color:orange;">Update</mark></p>                   | <p><strong>aws-events-eventbus</strong></p><p>Additional permission required:</p><ul><li><code>events:DescribeEventBus</code></li></ul><p>The API now ingests additional fields related to the eventbus resource.</p>                                                                                                                                                                                                                                                                                                 |
| <p><strong>Amazon Route 53</strong></p><p><mark style="background-color:orange;">Update</mark></p>                      | <p><strong>aws-route53-list-hosted-zones</strong></p><p>The API now ingests additional fields related to the hosted zones resource:</p><ul><li><code>DelegationSet →Id CallerReference NameServers</code></li></ul>                                                                                                                                                                                                                                                                                                   |
| <p><strong>Amazon Route53 Resolver</strong></p><p><mark style="background-color:orange;">Update</mark></p>              | <p><strong>aws-route53resolver-resolver-endpoint</strong></p><p>The API now ingests additional attribute <code>IpAddresses</code>.</p><p>Additional permission required:</p><ul><li><code>route53resolver:ListResolverEndpointIpAddresses</code></li></ul><p>The Security Audit role includes the permission.</p>                                                                                                                                                                                                     |
| <p><strong>Amazon S3</strong></p><p><mark style="background-color:orange;">Update</mark></p>                            | <p><strong>aws-s3api-get-bucket-acl</strong></p><p>The API now ingests an additional field <code>BucketArn</code> related to the S3 bucket resource.</p>                                                                                                                                                                                                                                                                                                                                                              |
| <p><strong>AWS Secrets Manager</strong></p><p><mark style="background-color:orange;">Update</mark></p>                  | <p><strong>aws-secretsmanager-describe-secret</strong></p><p>The API now ingests additional attribute <code>replicationStatus</code>.</p><p>Additional permission required:</p><ul><li><code>secretsmanager:DescribeSecret</code></li></ul><p>The Security Audit role includes the permission.</p>                                                                                                                                                                                                                    |
| <p><strong>Azure App Service</strong></p><p><mark style="background-color:orange;">Update</mark></p>                    | <p><strong>azure-app-service</strong> and <strong>azure-app-service-deployment-slots</strong></p><p>The APIs have been updated with permission changes for App Service and App Service Deployment Slots ingestion.</p>                                                                                                                                                                                                                                                                                                |
| <p><strong>Azure Storage Account Access Key</strong></p><p><mark style="background-color:orange;">Update</mark></p>     | <p><strong>azure-storage-account-access-key</strong></p><p>The API now ingests additional parameter <code>allowSharedKeyAccess</code>.</p>                                                                                                                                                                                                                                                                                                                                                                            |
| <p><strong>Azure App Service</strong></p><p><mark style="background-color:orange;">Update</mark></p>                    | <p><strong>azure-app-service-deployment-slots</strong></p><p>The API now ingests Slot Configuration fields for Azure App Service Deployment Slots. The following additional JSON fields are now available:</p><ul><li><code>config.storageType</code></li><li><code>config.http20Enabled</code></li><li><code>config.loadBalancing</code></li><li><code>config.minTlsVersion</code></li><li><code>config.ftpsState</code></li></ul><p>The List Slot Configuration response is now stitched into the API response.</p> |
| **API Deprecations**                                                                                                    |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |
| <p><strong>Azure Orbital and Mixed Reality</strong></p><p><mark style="background-color:orange;">Deprecation</mark></p> | <p>The following Azure APIs have been deprecated as the underlying Azure services were retired:</p><ul><li><strong>azure-orbital-spacecrafts</strong> - Azure Orbital Ground Station was retired by Microsoft.</li><li><strong>azure-mixed-reality-object-anchors-accounts</strong> - Azure Object Anchors (AOA) was retired by Microsoft.</li></ul><p>These APIs will no longer ingest data.</p>                                                                                                                     |
| <p><strong>GCP Data Catalog</strong></p><p><mark style="background-color:orange;">Deprecation</mark></p>                | <p>GCP Data Catalog is deprecated and will be discontinued. The following Data Catalog APIs are deprecated on Prisma Cloud:</p><ul><li><code>gcloud-data-catalog-taxonomy</code></li><li><code>gcloud-data-catalog-entry-group</code></li><li><code>gcloud-data-catalog-tag-template</code></li></ul>                                                                                                                                                                                                                 |

## Policy Updates

<table data-header-hidden><thead><tr><th></th><th></th></tr></thead><tbody><tr><td><strong>Policy Name</strong></td><td><strong>Details</strong></td></tr><tr><td><strong>Azure VM disk configured with overly permissive network access</strong></td><td><p><strong>Severity:</strong> Medium</p><p><strong>Changes:</strong> The policy RQL has been updated to exclude Azure VM disks created for Prisma Cloud Azure agentless scanning (tagged with 'prismacloud-agentless-scan').</p><p><strong>Current RQL:</strong></p><pre><code>config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-disk-list' AND json.rule = publicNetworkAccess equal ignore case Enabled and networkAccessPolicy equal ignore case AllowAll and managedBy contains virtualMachines
</code></pre><p><strong>Updated RQL:</strong></p><pre><code>config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-disk-list' AND json.rule = publicNetworkAccess equal ignore case Enabled and networkAccessPolicy equal ignore case AllowAll and managedBy contains virtualMachines and tags.created-by does not equal ignore case "prismacloud-agentless-scan"
</code></pre><p><strong>Impact:</strong> Medium - Previously reported disks tagged with 'prismacloud-agentless-scan' will be resolved as Policy Updated.</p></td></tr><tr><td><strong>Azure VM OS disk is encrypted with the default encryption key instead of ADE/CMK</strong></td><td><p><strong>Severity:</strong> Informational</p><p><strong>Changes:</strong> The policy RQL has been updated to remove the legacy <code>encryptionSettings</code> attribute check.</p><p><strong>Current RQL:</strong></p><pre><code>config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-disk-list' and json.rule = 'osType exists and managedBy exists and (encryptionSettings does not exist or encryptionSettings.enabled == false) and encryption.type is not member of ("EncryptionAtRestWithCustomerKey", "EncryptionAtRestWithPlatformAndCustomerKeys")'
</code></pre><p><strong>Updated RQL:</strong></p><pre><code>config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-disk-list' and json.rule = 'osType exists and managedBy exists and encryption.type is not member of ("EncryptionAtRestWithCustomerKey", "EncryptionAtRestWithPlatformAndCustomerKeys")'
</code></pre><p><strong>Impact:</strong> Low</p></td></tr><tr><td><strong>GCP Dataproc Cluster on GKE is using default network</strong></td><td><p><strong>Severity:</strong> Medium</p><p><strong>Changes:</strong> Policy RQL has been updated to cover Dataproc clusters using zonal GKE clusters.</p><p><strong>Current RQL:</strong></p><pre><code>config from cloud.resource where api.name = 'gcloud-dataproc-clusters-list' AND json.rule = status.state is member of ("SCHEDULED", "CREATING", "RUNNING") as X; config from cloud.resource where api.name = 'gcloud-container-describe-clusters' AND json.rule = status equals RUNNING and ['network'] ends with "default" as Y; filter ' $.Y.selfLink contains $.X.virtualClusterConfig.kubernetesClusterConfig.gkeClusterConfig.gkeClusterTarget '; show X;
</code></pre><p><strong>Updated RQL:</strong></p><pre><code>config from cloud.resource where api.name = 'gcloud-dataproc-clusters-list' as X; config from cloud.resource where api.name = 'gcloud-container-describe-clusters' AND json.rule = status equals RUNNING and ['network'] ends with "default" as Y; filter ' $.X.virtualClusterConfig.kubernetesClusterConfig.gkeClusterConfig.gkeClusterTarget contains $.Y.location and $.X.virtualClusterConfig.kubernetesClusterConfig.gkeClusterConfig.gkeClusterTarget contains $.Y.name and $.Y.selfLink contains $.X.projectId '; show X;
</code></pre><p><strong>Impact:</strong> Low - New alerts will be generated as per new RQL.</p></td></tr><tr><td><strong>GCP Dataproc Cluster on Compute Engine is using default network</strong></td><td><p><strong>Severity:</strong> Medium</p><p><strong>Changes:</strong> Policy RQL has been updated to match GCP API.</p><p><strong>Current RQL:</strong></p><pre><code>config from cloud.resource where cloud.type = 'gcp' AND api.name = 'gcloud-dataproc-clusters-list' AND json.rule = status.state is member of ("SCHEDULED", "CREATING", "RUNNING") and ( environmentConfig.executionConfig.networkUri ends with "default" or environmentConfig.executionConfig.subnetworkUri ends with "default" or ( environmentConfig.executionConfig.networkUri does not exist and environmentConfig.executionConfig.subnetworkUri does not exist ) )
</code></pre><p><strong>Updated RQL:</strong></p><pre><code>config from cloud.resource where cloud.type = 'gcp' AND api.name = 'gcloud-dataproc-clusters-list' AND json.rule = status.state is member of ("SCHEDULED", "CREATING", "RUNNING") and ['config'] exists and ( config.gceClusterConfig.networkUri ends with "default" or config.gceClusterConfig.subnetworkUri ends with "default" or ( config.gceClusterConfig.networkUri does not exist and config.gceClusterConfig.subnetworkUri does not exist ) )
</code></pre><p><strong>Impact:</strong> Low - New alerts will be generated as per new RQL.</p></td></tr></tbody></table>

## Policy Deletions

| **Policy Updates**             | **Description**                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    |
| ------------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **AutoFocus Policy Deletions** | <p><strong>Changes–</strong> Palo Alto Networks' AutoFocus product has reached its End of Life (EOL) date. As a result, the following AutoFocus Anomaly policies will be removed from Prisma Cloud. Learn more about <a href="https://live.paloaltonetworks.com/t5/community-blogs/autofocus-end-of-sale-faq-and-alternatives/ba-p/516051">AutoFocus EOL</a>.</p><ul><li>Traffic to a suspicious IP address associated with Loader activity</li><li>Traffic from a suspicious IP address associated with File Infector activity</li><li>Traffic to a suspicious IP address associated with File Infector activity</li><li>Traffic from a suspicious IP address associated with Dropper activity</li><li>Traffic to a suspicious IP address associated with Ransomware activity</li><li>Traffic to a suspicious IP address associated with Backdoor activity</li><li>Traffic to a suspicious IP address associated with Cryptominer activity</li><li>Traffic from a suspicious IP address associated with Botnet activity</li><li>Traffic from a suspicious IP address associated with Cryptominer activity</li><li>Traffic from a suspicious IP address associated with Ransomware activity</li><li>Traffic to a suspicious IP address associated with Linux Malware activity</li><li>Traffic to a suspicious IP address associated with Botnet activity</li><li>Traffic from a suspicious IP address associated with Backdoor activity</li><li>Traffic from a suspicious IP address associated with Linux Malware activity</li><li>Traffic from a suspicious IP address associated with Remote Access Trojan activity</li><li>Traffic to a suspicious IP address associated with Remote Access Trojan activity</li><li>Traffic from a suspicious IP address associated with DDoS activity</li><li>Traffic from a suspicious IP address associated with InfoStealer activity</li><li>Traffic to a suspicious IP address associated with DDoS activity</li><li>Traffic to a suspicious IP address associated with InfoStealer activity</li><li>Traffic from a suspicious IP address associated with Wiper activity</li><li>Traffic to a suspicious IP address associated with Wiper activity</li><li>Traffic to a suspicious IP address associated with Dropper activity</li><li>Traffic from a suspicious IP address associated with Loader activity</li><li>Traffic from a suspicious IP address associated with Rootkit activity</li><li>Traffic to a suspicious IP address associated with Webshell activity</li><li>Traffic from a suspicious IP address associated with Webshell activity</li><li>Traffic to a suspicious IP address associated with Rootkit activity</li><li>Traffic to a suspicious IP address associated with Exploit Kit activity</li><li>Traffic from a suspicious IP address associated with Exploit Kit activity</li><li>Traffic to a suspicious IP address associated with Hacking Tool activity</li><li>Traffic from a suspicious IP address associated with Hacking Tool activity</li><li>Traffic from a suspicious IP address associated with Worm activity</li><li>Traffic to a suspicious IP address associated with Worm activity</li><li>Traffic from a suspicious IP address associated with Downloader activity</li><li>Traffic to a suspicious IP address associated with Downloader activity</li></ul><p><strong>Impact</strong>– Keep in mind the following potential effects of this change:<br>\* Existing alerts will be resolved as <code>Policy\_Deleted</code>.<br>\* All policies related to AutoFocus will be deprecated.<br>\* Attack Path policies associated with AutoFocus will be deprecated.<br>\* RQL support for AutoFocus suggestions will be removed.<br>\* The ability to add trusted IP addresses to AutoFocus anomaly polices will be deprecated.<br>\* Any custom policies that use AutoFocus attributes will also be impacted.</p> |

## Compliance Updates

| **Compliance Standard**                                  | **Details**                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          |
| -------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| **CIS Amazon Web Services Foundations Benchmark v6.0.0** | <p>Prisma Cloud now supports CIS Amazon Web Services Foundations Benchmark v6.0.0 Level 1 and Level 2.</p><p>Level 1 defines a set of fundamental, broadly applicable security best practices that harden core AWS services while minimizing impact on usability and operations for most environments.</p><p>Level 2 builds on this with more stringent, defense-in-depth requirements intended for organizations with elevated risk or regulatory needs.</p><p>You can view this built-in standard and the associated policies on the <strong>Compliance > Standards</strong> page. You can also generate reports for immediate viewing or download, or schedule recurring reports to track this compliance standard over time.</p> |
| **CIS Microsoft Azure Foundations Benchmark v5.0.0**     | <p>Prisma Cloud now supports CIS Microsoft Azure Foundations Benchmark v5.0.0 Level 1 and Level 2.</p><p>Level 1 provides baseline, broadly applicable security controls designed to strengthen an Azure environment without causing significant disruption to usability or operations.</p><p>Level 2 introduces more stringent, defense-in-depth controls intended for organizations with heightened security or regulatory requirements.</p><p>You can view this built-in standard and the associated policies on the <strong>Compliance > Standards</strong> page. You can also generate reports for immediate viewing or download, or schedule recurring reports to track this compliance standard over time.</p>                |


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.prismacloud.io/release-notes/prisma-cloud-release-information/features-introduced-in-2026/features-introduced-in-april-2026.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.