Alert mechanism
Prisma Cloud lets you surface critical policy breaches by sending alerts to any number of channels.
Alerts ensure that significant events are put in front of the right audience at the right time.
Alerts are built on the following constructs:
- Alert profile--Specifies which events should be sent to which channel. You can create any number of alert profiles, where each profile gives you granular control over which audience should receive which notifications.
- Alert channel--Messaging medium over which alerts are sent. Prisma Cloud supports email, JIRA, Slack, PagerDuty, and others.
- Alert trigger--Events that require further scrutiny. Alerts are raised when the rules that make up your policy are violated. When something in your environment violates a rule, an audit is logged, and an alert is sent to any matching alert profile (channel, audience). Prisma Cloud can be configured to notify the appropriate party when an entire policy, or even a specific rule, is violated.You can also set up alerts for Defender health events. These events tell you when Defender unexpectedly disconnects from Console. Alerts are sent when a Defender has been disconnected for more than 6 hours.
Not all triggers are available for all channels.
For example, new JIRA issues can only be opened when vulnerability rules are triggered.
Triggers
Most alerts trigger on a policy violation.
When policy is the trigger, you can optionally choose to trigger on specific rules rather than the entire policy.
Vulnerability, compliance, and cloud discovery alerts work differently.
Vulnerability alerts that arise from registry scans only trigger for the 50 most recent images, as sorted by last modified date.
The limit is designed to contain Console resource consumption in large environments.
Vulnerability alerts
The number of known vulnerabilities in a resource is not static over time.
As the Prisma Cloud Intelligence Stream is updated with new data, new vulnerabilities might be uncovered in resources that were previously considered clean.
The first time a resource (image, container, host, etc) enters the environment, Prisma Cloud assesses it for vulnerabilities.
If a vulnerability violates a rule in the policy, and the rule has been configured to trigger an alert, an alert is dispatched.
Thereafter, every resource is periodically rescanned.
Additional alerts are dispatched only when new vulnerabilities that match your alert profile settings are detected.
With vulnerability alerts, you get one, and only one, alert for each vulnerability detected (aggregated by scan).
Compliance alerts
Alerts for compliance issues work a little differently.
The resources in your system are either compliant or non-compliant.
When your system is non-compliant, Prisma Cloud sends an alert.
As long as there are non-compliant resources, Prisma Cloud sends an alert every scan interval (default 24 hours).
Compliance alerts list each failed check, and the number of resources that failed the check in the latest scan and the previous scan.
For detailed information about exactly which resources are non-compliant, use Compliance Explorer.
The following screenshot shows an example compliance email alert:
For example:
- Scan period 1: You have non-complaint container named crusty_pigeon. You’ll be alerted about the container compliance issues.
- Scan period 2: Container crusty_pigeon is still running. It’s still non-compliant. You’ll be alerted about the same container compliance issues.
Cloud discovery alerts
Cloud discovery alerts warn you when new cloud native resources are discovered in your environment so that you can inspect and secure them with Prisma Cloud.
Cloud discovery alerts are available on the email channel only.
For each new resource discovered in a scan, Prisma Cloud lists the cloud provider, region, project, service type (i.e. AWS Lambda, Azure AKS) and resoure name (my-aks-cluster).
Limitations
For runtime audits, there’s a limit of 50 runtime audits per aggregation period (seconds, minutes, hours, days) for all alert providers.
