New features

Simplifies Defender deployment in AWS ECS clusters. Defender task definitions are now configured and generated in the Console UI. Everything Defender needs to connect to Console is packaged in the task definition. Defender auto-upgrade is also now supported.

Adds separate port and proxy configuration settings for each Defender deployment. Makes it easier to deploy Defenders across environments.

Increases the number of Defenders that can simultaneously connect to Console to 10K Defenders.

Adds scalable methods for distributing Intelligence Stream data to air-gapped Consoles in environments with many deployed Consoles. Consoles can now be configured to retrieve the latest threat data from HTTPS endpoints or another centrally-maintained Console.

Adds the ability to filter out vulnerabilities introduced by base or middleware images from scan results.

Refactors how policy rules are scoped. Rule scope (the resources a rule targets) is now defined by referencing the relevant collections. Previously, scope was specified inline in each rule. Collections make it easier to visualize and reuse scope settings across the product. As part of this change, all your policy rules are automatically migrated to use collections on upgrade.

Brings back CNNF with enforcement. Policy is now entirely defined by rules; learning is no longer supported. CNNF with enforcement is supported in Compute Edition only. A solution for Enterprise Edition (SaaS) customers will be unveiled shortly. CNNF monitoring is supported in both editions.

Adds support for Prisma Cloud as a pluggable scanner for the Harbor registry.

Adds compliance checks for CRI-O images and containers. Previously, there were only checks for Docker images and containers.

Adds support for custom compliance checks for CRI-O images and containers. To use this feature, you must manually redeploy your Defenders. This feature will not work with auto-upgraded Defenders.

Adds support for the layers view in image scan reports (
Monitor > Vulnerabilities > Images > SCAN-REPORT > Layers
) in CRI-O environments. Also, adds support for listing the labels of CRI-O containers in the image scan reports. Previously, these capabilities were only supported on hosts with Docker Engine.

Integrates the Palo Alto Networks AutoFocus threat feed into the Prisma Cloud Compute Intelligence Stream.

Bolsters support for the cluster resource type as a first class citizen in the product. Container Radar now shows interesting metadata for each cluster. Rules can now be scoped to clusters for things like trusted images and container runtime rules. More audits now include cluster information. More views now support filtering by cluster. Rules scoped by cluster with the block effect now work properly.

Extends the ServiceNow integration to support sending compliance alerts to Security Incident Response with resources information (image, host, collection, project, etc).

Increases the number of CI scan reports that Console can store from 1000 to 5000 or 500 MB (whichever limit is reached first).

Aligns the grace period in vulnerability rules with the CVE’s fix date, rather than the publish date.

Centralizes all AWS credential management and options into the credentials store. Things like IAM role and STS are no longer individually specified in each integration’s setting dialog.

Adds support for Hashicorp Consul. Radar now shows connections between containers with Envoy sidecars.

Adds support for admission control (
Defend > Access > Admission
) on OpenShift 4.

Enhances support for Distroless images, with full package lists and better vulnerability analysis.

[Enterprise Edition (SaaS)]
Updates twistcli to use the latest Prisma Cloud IaC scan REST API 2, with support for Terraform v0.13, larger file sizes, and automatic detection of Terraform module structures and variable files.
[Enterprise Edition (SaaS)]
Updates twistcli so that it works with IP whitelisting. IP whitelisting is a Prisma Cloud Enterprise Edition feature that lets you restrict who can log into the system by IP address.