> For the complete documentation index, see [llms.txt](https://docs.prismacloud.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.prismacloud.io/release-notes/prisma-cloud-release-information/features-introduced-in-2026/features-introduced-in-october-2026.md).

# Features Introduced in October 2026

Prisma Cloud October 2026 Release Notes

Learn what’s new in the Prisma® Cloud October 2026 release. This release includes updates for Prisma Cloud Enterprise Edition version 26.10.1 and Prisma Cloud Compute Edition version 34.05.168.

* [Enhancements](#enhancements)
* [Changes in Existing Behavior](#changes-in-existing-behavior)
* [Policy Updates](#policy-updates)
* [API Ingestions](#api-ingestions)
* [API Changes and New APIs](#api-changes-and-new-apis)

## Enhancements

| Enhancement                                                                                                        | Details                                                                                                                                                                                                                                                    |
| ------------------------------------------------------------------------------------------------------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| <p><strong>JFrog Artifactory support</strong><br><em>Secure the Runtime</em></p>                                   | Prisma Cloud Compute now supports JFrog Artifactory in the scan flow and in the intelligence stream.                                                                                                                                                       |
| <p><strong>RHEL OS CVE evaluation for OpenShift nodes</strong><br><em>Secure the Runtime</em></p>                  | OpenShift node scans now also report RHEL kernel and OS package CVEs, which were previously never evaluated. OpenShift on RHEL 10 is also supported.                                                                                                       |
| <p><strong>Windows Server 2025 support</strong><br><em>Secure the Runtime</em></p>                                 | Prisma Cloud Compute now supports Windows Server 2025 in the intelligence stream.                                                                                                                                                                          |
| <p><strong>Improved stale CSA endpoint cleanup</strong><br><em>Secure the Runtime</em></p>                         | Stale Cloud Security Agent endpoint cleanup now commits incrementally and continues past individual failures. On large tenants the cleanup previously aborted on any single error and never completed, leaving orphaned images and vulnerabilities behind. |
| <p><strong>Configurable</strong> <strong>log</strong> <strong>rotation</strong><br><em>Secure the Runtime</em></p> | Log rotation settings — maximum backup files and maximum file size — are now configurable through a feature flag instead of hard-coded.                                                                                                                    |
| <p><strong>Faster twistcli scans for explicit image references</strong><br><em>Secure the Runtime</em></p>         | twistcli no longer inspects every local image when given a specific image reference. Wildcard patterns and CI mode are unaffected.                                                                                                                         |

## Changes in Existing Behavior

### Changes in Existing Behavior Enterprise Edition 26.10.1

#### Config APIs Moving to Limited General Availability (LGA)

Starting at the end of October 2026, ingestion for the following config APIs will transition from default general availability to Limited General Availability (LGA). These APIs capture short-lived, transient execution workloads rather than persistent cloud infrastructure configurations:

* gcloud-dataproc-cluster-job
* aws-transcribe-transcription-job
* gcloud-vertex-ai-aiplatform-custom-job

**Impact** - No impact for existing custom policy users. Ingestion will remain enabled for tenants with active custom policies referencing these APIs.

* All other tenants: Ingestion for these APIs will be turned off by default.
* If your organization requires ingestion for any of these APIs, please contact your Palo Alto Networks Customer Support Representative or account team to have them enabled for your tenant.

#### Alerts Endpoint Deprecation

The legacy `alerts/job` API endpoint is deprecated in the 26.10.1 release.

To improve reliability, system stability, and performance, we are transitioning all alert extraction workflows to the `v2/alert` API.

**Key Improvements**

* Paginated Data Retrieval: Fetch large volumes of alerts incrementally without running into timeout errors.
* Backend Efficiency: Reduces load on backend infrastructure, resulting in faster and more predictable response times.
* High Scalability: Built specifically to handle high-throughput workloads seamlessly.

**Impact** - We strongly encourage all customers utilizing the alerts/job endpoint to migrate their integrations to the v2/alert API.

### Changes in Existing Behavior Compute Edition 34.05.168

| **Feature**                                                                                       | **Description**                                                                                                                               |
| ------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------- |
| <p><strong>Redacted tokens in the system settings API</strong><br><em>Secure the Runtime</em></p> | The WildFire API key and intelligence token returned by `GET /api/v1/settings/system` are now redacted for users not authorized to view them. |

***

## Policy Updates - RQL

<table><thead><tr><th>Policy Name</th><th>Details</th></tr></thead><tbody><tr><td>Azure SQL database Transparent Data Encryption (TDE) encryption disabled</td><td><p><strong>Description</strong>: Customer reported a FP on cortex XQL where all types of databases were being reported as opposed to only non system database instances.</p><p><strong>Policy Type</strong>: Config</p><p><strong>Policy Severity</strong>: High</p><p><strong>Impact</strong>: Medium<br><strong>Current RQL</strong>:</p><pre data-overflow="wrap"><code><strong>config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-sql-db-list' AND json.rule = transparentDataEncryption is false
</strong></code></pre><p><br><strong>Updated RQL:</strong></p><pre data-overflow="wrap"><code>config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-sql-db-list' AND json.rule = 'sqlDatabase.kind does not contain system and transparentDataEncryption is false'
</code></pre><p><br></p></td></tr></tbody></table>

<table><thead><tr><th>Policy Name</th><th>Details</th><th></th></tr></thead><tbody><tr><td>Azure activity log Alert Policies</td><td colspan="2"><p>Updated policy RQL logic to check for "/subscriptions/" string instead of "resourcegroups", this avoids false negatives due to string case.</p><p><strong>Policy Type</strong>: Config</p><p><strong>Policy Severity</strong>: Informational</p><p><strong>Impact</strong>: Low</p><p><strong>Alert Impact</strong>: This update could open new alerts previously not reported due to string case issue.</p></td></tr><tr><td></td><td><strong>Current RQL</strong></td><td><strong>Updated RQL</strong></td></tr><tr><td>Azure Activity log alert for Create or update SQL server firewall rule does not exist</td><td><pre data-overflow="wrap"><code>config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-activity-log-alerts' AND json.rule = "location equal ignore case Global and properties.enabled equals true and properties.scopes[*] does not contain resourceGroups and properties.condition.allOf[?(@.field=='operationName')].equals equals Microsoft.Sql/servers/firewallRules/write" as X; count(X) less than 1
</code></pre></td><td><pre data-overflow="wrap"><code>config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-activity-log-alerts' AND json.rule = "location equal ignore case Global and properties.enabled equals true and properties.scopes[*] starts with /subscriptions/ and properties.condition.allOf[?(@.field=='operationName')].equals equals Microsoft.Sql/servers/firewallRules/write" as X; count(X) less than 1
</code></pre></td></tr><tr><td>Azure Activity log alert for Create or update network security group does not exist</td><td><pre data-overflow="wrap"><code>config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-activity-log-alerts' AND json.rule = "location equal ignore case Global and properties.enabled equals true and properties.scopes[*] does not contain resourceGroups and properties.condition.allOf[?(@.field=='operationName')].equals equals Microsoft.Network/networkSecurityGroups/write" as X; count(X) less than 1
</code></pre></td><td><pre data-overflow="wrap"><code>config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-activity-log-alerts' AND json.rule = "location equal ignore case Global and properties.enabled equals true and properties.scopes[*] starts with /subscriptions/ and properties.condition.allOf[?(@.field=='operationName')].equals equals Microsoft.Network/networkSecurityGroups/write" as X; count(X) less than 1
</code></pre></td></tr><tr><td>Azure Activity log alert for Create or update network security group rule does not exist</td><td><pre data-overflow="wrap"><code>config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-activity-log-alerts' AND json.rule = "location equal ignore case Global and properties.enabled equals true and properties.scopes[*] does not contain resourceGroups and properties.condition.allOf[?(@.field=='operationName')].equals equals Microsoft.Network/networkSecurityGroups/securityRules/write" as X; count(X) less than 1
</code></pre></td><td><pre data-overflow="wrap"><code>config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-activity-log-alerts' AND json.rule = "location equal ignore case Global and properties.enabled equals true and properties.scopes[*] starts with /subscriptions/ and properties.condition.allOf[?(@.field=='operationName')].equals equals Microsoft.Network/networkSecurityGroups/securityRules/write" as X; count(X) less than 1
</code></pre></td></tr><tr><td>Azure Activity log alert for Create or update public IP address rule does not exist</td><td><pre data-overflow="wrap"><code>config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-activity-log-alerts' AND json.rule = "location equal ignore case Global and properties.enabled equals true and properties.scopes[*] does not contain resourceGroups and properties.condition.allOf[?(@.field=='operationName')].equals equals Microsoft.Network/publicIPAddresses/write" as X; count(X) less than 1
</code></pre></td><td><pre data-overflow="wrap"><code>config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-activity-log-alerts' AND json.rule = "location equal ignore case Global and properties.enabled equals true and properties.scopes[*] starts with /subscriptions/ and properties.condition.allOf[?(@.field=='operationName')].equals equals Microsoft.Network/publicIPAddresses/write" as X; count(X) less than 1
</code></pre></td></tr><tr><td>Azure Activity log alert for Create or update security solution does not exist</td><td><pre data-overflow="wrap"><code>config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-activity-log-alerts' AND json.rule = "location equal ignore case Global and properties.enabled equals true and properties.scopes[*] does not contain resourceGroups and properties.condition.allOf[?(@.field=='operationName')].equals equals Microsoft.Security/securitySolutions/write" as X; count(X) less than 1
</code></pre></td><td><pre data-overflow="wrap"><code>config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-activity-log-alerts' AND json.rule = "location equal ignore case Global and properties.enabled equals true and properties.scopes[*] starts with /subscriptions/ and properties.condition.allOf[?(@.field=='operationName')].equals equals Microsoft.Security/securitySolutions/write" as X; count(X) less than 1
</code></pre></td></tr><tr><td>Azure Activity log alert for Create policy assignment does not exist</td><td><pre data-overflow="wrap"><code>config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-activity-log-alerts' AND json.rule = "location equal ignore case Global and properties.enabled equals true and properties.scopes[*] does not contain resourceGroups and properties.condition.allOf[?(@.field=='operationName')].equals equals Microsoft.Authorization/policyAssignments/write" as X; count(X) less than 1
</code></pre></td><td><pre data-overflow="wrap"><code>config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-activity-log-alerts' AND json.rule = "location equal ignore case Global and properties.enabled equals true and properties.scopes[*] starts with /subscriptions/ and properties.condition.allOf[?(@.field=='operationName')].equals equals Microsoft.Authorization/policyAssignments/write" as X; count(X) less than 1
</code></pre></td></tr><tr><td>Azure Activity log alert for Delete SQL server firewall rule does not exist</td><td><pre data-overflow="wrap"><code>config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-activity-log-alerts' AND json.rule = "location equal ignore case Global and properties.enabled equals true and properties.scopes[*] does not contain resourceGroups and properties.condition.allOf[?(@.field=='operationName')].equals equals Microsoft.Sql/servers/firewallRules/delete" as X; count(X) less than 1
</code></pre></td><td><pre data-overflow="wrap"><code>config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-activity-log-alerts' AND json.rule = "location equal ignore case Global and properties.enabled equals true and properties.scopes[*] starts with /subscriptions/ and properties.condition.allOf[?(@.field=='operationName')].equals equals Microsoft.Sql/servers/firewallRules/delete" as X; count(X) less than 1
</code></pre></td></tr><tr><td>Azure Activity log alert for Delete network security group does not exist</td><td><pre data-overflow="wrap"><code>config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-activity-log-alerts' AND json.rule = "location equal ignore case Global and properties.enabled equals true and properties.scopes[*] does not contain resourceGroups and properties.condition.allOf[?(@.field=='operationName')].equals equals Microsoft.Network/networkSecurityGroups/delete" as X; count(X) less than 1
</code></pre></td><td><pre data-overflow="wrap"><code>config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-activity-log-alerts' AND json.rule = "location equal ignore case Global and properties.enabled equals true and properties.scopes[*] starts with /subscriptions/ and properties.condition.allOf[?(@.field=='operationName')].equals equals Microsoft.Network/networkSecurityGroups/delete" as X; count(X) less than 1
</code></pre></td></tr><tr><td>Azure Activity log alert for Delete network security group rule does not exist</td><td><pre data-overflow="wrap"><code>config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-activity-log-alerts' AND json.rule = "location equal ignore case Global and properties.enabled equals true and properties.scopes[*] does not contain resourceGroups and properties.condition.allOf[?(@.field=='operationName')].equals equals Microsoft.Network/networkSecurityGroups/securityRules/delete" as X; count(X) less than 1
</code></pre></td><td><pre data-overflow="wrap"><code>config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-activity-log-alerts' AND json.rule = "location equal ignore case Global and properties.enabled equals true and properties.scopes[*] starts with /subscriptions/ and properties.condition.allOf[?(@.field=='operationName')].equals equals Microsoft.Network/networkSecurityGroups/securityRules/delete" as X; count(X) less than 1
</code></pre></td></tr><tr><td>Azure Activity log alert for Delete public IP address rule does not exist</td><td><pre data-overflow="wrap"><code>config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-activity-log-alerts' AND json.rule = "location equal ignore case Global and properties.enabled equals true and properties.scopes[*] does not contain resourceGroups and properties.condition.allOf[?(@.field=='operationName')].equals equals Microsoft.Network/publicIPAddresses/delete" as X; count(X) less than 1
</code></pre></td><td><pre data-overflow="wrap"><code>config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-activity-log-alerts' AND json.rule = "location equal ignore case Global and properties.enabled equals true and properties.scopes[*] starts with /subscriptions/ and properties.condition.allOf[?(@.field=='operationName')].equals equals Microsoft.Network/publicIPAddresses/delete" as X; count(X) less than 1
</code></pre></td></tr><tr><td>Azure Activity log alert for Delete security solution does not exist</td><td><pre data-overflow="wrap"><code>config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-activity-log-alerts' AND json.rule = "location equal ignore case Global and properties.enabled equals true and properties.scopes[*] does not contain resourceGroups and properties.condition.allOf[?(@.field=='operationName')].equals equals Microsoft.Security/securitySolutions/delete" as X; count(X) less than 1
</code></pre></td><td><pre data-overflow="wrap"><code>config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-activity-log-alerts' AND json.rule = "location equal ignore case Global and properties.enabled equals true and properties.scopes[*] starts with /subscriptions/ and properties.condition.allOf[?(@.field=='operationName')].equals equals Microsoft.Security/securitySolutions/delete" as X; count(X) less than 1
</code></pre></td></tr><tr><td>Azure Activity log alert for Update security policy does not exist</td><td><pre data-overflow="wrap"><code>config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-activity-log-alerts' AND json.rule = "location equal ignore case Global and properties.enabled equals true and properties.scopes[*] does not contain resourceGroups and properties.condition.allOf[?(@.field=='operationName')].equals equals Microsoft.Security/policies/write" as X; count(X) less than 1
</code></pre></td><td><pre data-overflow="wrap"><code>config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-activity-log-alerts' AND json.rule = "location equal ignore case Global and properties.enabled equals true and properties.scopes[*] starts with /subscriptions/ and properties.condition.allOf[?(@.field=='operationName')].equals equals Microsoft.Security/policies/write" as X; count(X) less than 1
</code></pre></td></tr><tr><td>Azure Activity log alert for delete policy assignment does not exist</td><td><pre data-overflow="wrap"><code>config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-activity-log-alerts' AND json.rule = "location equal ignore case Global and properties.scopes[*] does not contain resourceGroups and properties.enabled equals true and properties.condition.allOf[?(@.field=='operationName')].equals equals Microsoft.Authorization/policyAssignments/delete" as X; count(X) less than 1
</code></pre></td><td><pre data-overflow="wrap"><code>config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-activity-log-alerts' AND json.rule = "location equal ignore case Global and properties.scopes[*] starts with /subscriptions/ and properties.enabled equals true and properties.condition.allOf[?(@.field=='operationName')].equals equals Microsoft.Authorization/policyAssignments/delete" as X; count(X) less than 1
</code></pre></td></tr></tbody></table>

## API Ingestions

| **Service**                                              | **API Details**                                                                                                                                                                                                                                                                                                                                                                                                                                   |
| -------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Alibaba Cloud ApsaraDB RDS**                           | <p><strong><code>alibaba-cloud-rds-instance</code></strong><br><br>Additional permission required:<br><br>- <code>rds:DescribeParameters</code><br><br>The <code>AliyunReadOnlyAccess</code> policy includes the permission.</p>                                                                                                                                                                                                                  |
| **Alibaba Cloud Security Center (SAS)**                  | <p><strong><code>alibaba-cloud-security-center-instance</code></strong><br><br>Additional permissions required:<br><br>- <code>yundun-sas:DescribeCloudCenterInstances</code><br>- <code>yundun-sas:DescribeVersionConfig</code><br>- <code>yundun-sas:DescribeSecurityCheckScheduleConfig</code><br><br>The <code>AliyunReadOnlyAccess</code> policy includes the permissions.</p>                                                               |
| **Alibaba Cloud Container Service for Kubernetes (ACK)** | <p><strong><code>alibaba-cloud-container-service-cluster</code></strong><br><br>Additional permissions required:<br><br>- <code>cs:GetClusters</code><br>- <code>cs:DescribeClusterDetail</code><br><br>The <code>AliyunReadOnlyAccess</code> policy includes the permissions.</p>                                                                                                                                                                |
| **Alibaba Cloud ApsaraDB RDS**                           | <p><strong><code>alibaba-cloud-rds-instance</code></strong><br><br>The following existing permission is required:<br><br>- <code>rds:DescribeDBInstances</code><br><br>The <code>AliyunReadOnlyAccess</code> policy includes the permission.</p>                                                                                                                                                                                                  |
| **Alibaba Cloud Object Storage Service (OSS)**           | <p><strong><code>alibaba-cloud-oss-bucket-info</code></strong><br><br>Additional permissions required:<br><br>- <code>oss:GetPublicAccessBlock</code><br>- <code>oss:GetBucketPublicAccessBlock</code><br><br>The <code>AliyunReadOnlyAccess</code> policy includes the permissions.</p>                                                                                                                                                          |
| **Alibaba Cloud Key Management Service (KMS)**           | <p><strong><code>alibaba-cloud-kms-key</code></strong><br><br>Additional permissions required:<br><br>- <code>kms:ListKeys</code><br>- <code>kms:DescribeKey</code><br>- <code>kms:DescribeKeyVersion</code><br>- <code>kms:ListAliasesByKeyId</code><br><br>The <code>AliyunReadOnlyAccess</code> policy includes the permissions.</p>                                                                                                           |
| **Alibaba Cloud Firewall**                               | <p><strong><code>alibaba-cloud-cloud-firewall-log-store</code></strong><br><br>Additional permission required:<br><br>- <code>yundun-cloudfirewall:DescribeLogStoreInfo</code><br><br>The <code>AliyunReadOnlyAccess</code> policy includes the permission.</p>                                                                                                                                                                                   |
| **Google Dataplex**                                      | <p><strong><code>gcloud-dataplex-datascan</code></strong><br><br>Additional permissions required:<br><br>- <code>dataplex.datascans.list</code><br>- <code>dataplex.datascans.get</code><br>- <code>dataplex.datascans.getData</code><br>- <code>dataplex.datascans.getIamPolicy</code><br><br>The Viewer role does not include the permissions. A custom role is required. This API is not enabled by default but can be enabled by request.</p> |

## API Changes and New APIs

| Feature                                                                                             | Description                                                                                                                                                                                                                                                                                                                                                                                                                                                  |
| --------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| <p><strong>Cursor pagination for the container list API</strong><br><em>Secure the Runtime</em></p> | `GET /api/v1/containers` now supports cursor pagination, giving flat page latency at any depth. Offset pagination previously slowed from roughly 0.6 s on early pages to 8–10 s on deep pages and could trigger HTTP 429 rate limiting. Offset pagination remains supported. **Customer action required:** to benefit, clients must stop incrementing `offset` and instead pass the `Next-Cursor` token returned on each response until it comes back empty. |


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.prismacloud.io/release-notes/prisma-cloud-release-information/features-introduced-in-2026/features-introduced-in-october-2026.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.