1. Home
    2. Prisma
    3. Prisma Cloud
    4. Prisma Cloud Compute Edition Administrator’s Guide
    5. Alerts
    6. Alert mechanism

    Alert mechanism

    Prisma Cloud lets you surface critical policy breaches by sending alerts to any number of channels. Alerts ensure that significant events are put in front of the right audience at the right time.
    Alerts are built on the following constructs:
    • Alert profile
       --
      Specifies which events should be sent to which channel. You can create any number of alert profiles, where each profile gives you granular control over which audience should receive which notifications.
    • Alert channel
       --
      Messaging medium over which alerts are sent. Prisma Cloud supports email, JIRA, Slack, PagerDuty, and others.
    • Alert trigger
       --
      Events that require further scrutiny. Alerts are raised when the rules that make up your policy are violated. When something in your environment violates a rule, an audit is logged, and an alert is sent to any matching alert profile (channel, audience). Prisma Cloud can be configured to notify the appropriate party when an entire policy, or even a specific rule, is violated.
      You can also set up alerts for Defender health events. These events tell you when Defender unexpectedly disconnects from Console. Alerts are sent when a Defender has been disconnected for more than 6 hours.
    Not all triggers are available for all channels. For example, new JIRA issues can only be opened when vulnerability rules are triggered.

    Prisma Cloud Notification provider integration

    You can use the same notification settings set up in the platform for CSPM alerts by importing them into Compute in an Alert Profile.
    These configurations are setup in the platform under
    Settings > Integrations
     tab and cannot be configured from within Compute. Any changes to the provider settings will need to be done on the platform side.

    Importing platform configurations inside Compute

    To learn more about setting up integration / alert providers in the platform, follow steps documented here.
    1. Navigate to
      Manage > Alerts
       tab in Compute, click on "Add Profile".
    2. From the
      Provider
       drop down, select
      Prisma Cloud
      .
    3. In the
      Integrations
       field, select the configuration you want to choose.
    4. Select triggers to be sent to this channel.
    And hit Save.
    Test alert notifications are sent immediately to the provider channels regardless of alert aggregation period chosen.

    Supported Prisma Cloud Integrations

    • Email
    • JIRA
    • Slack
    • Splunk
    • PagerDuty
    • Webhooks
    • Google Cloud Security Command Center - Only available for onboarded PC accounts.
    • AWS Security Hub - Only available for onboarded PC accounts.
    • ServiceNow - Only Incident Response
    The alert profiles from platform are fetched upon refresh / reload of the tab. If the user session is active and an integration was deleted from platform, it will not be reflected upon browser refresh / re-login into Compute tab.