Prisma Cloud Advanced Threat Protection
Prisma Cloud Advanced Threat Protection (TATP) is a collection of malware signatures and IP reputation lists aggregated from commercial threat feeds, open source threat feeds, and Prisma Cloud Labs.
It is delivered to your installation via the Prisma Cloud Intelligence Stream.
The data in TATP is used by Prisma Cloud’s runtime defense system to detect suspicious activities, such as a container communicating with a botnet herder or Tor entry node.
You can augment TATP by importing custom malware data and importing IP reputation lists.
TATP is the combination of both the Prisma Cloud-provided data set and your own custom data set.
The following hypothetical scenario illustrates how TATP protects your containers:
- An attacker exploits a vulnerability in an app running in a container.
- The attacker attempts to download malware into the container from a distribution point.
- TATP detects both the connection to the malware server and the write of the malicious file to the container file system.
- An audit is generated. Audits can be viewed in Console underMonitor > Events > Container Audits.
TATP also protects hosts.
Host audits can viewed under
Monitor > Events > Host Audits
.Enabling TATP
TATP is enabled in the default rules that ship with the product, with the effect set to alert.
You can impose more stringent control by setting effect to prevent or block.
Runtime defense for file systems lets you actively stop (block) any container that tries to download malware.
To disable TATP, create or modify a runtime rule, select the
General
tab, and set Enable Prisma Cloud Advanced Threat Protection
to Off
.
When TATP is disabled, container interaction with malicious files or IP endpoints does not trigger a runtime event.