Alert mechanism

Prisma Cloud lets you surface critical policy breaches by sending alerts to any number of channels. Alerts ensure that significant events are put in front of the right audience at the right time.
Alerts are built on the following constructs:
  • Alert profile
    --
    Specifies which events should be sent to which channel. You can create any number of alert profiles, where each profile gives you granular control over which audience should receive which notifications.
  • Alert channel
    --
    Messaging medium over which alerts are sent. Prisma Cloud supports email, JIRA, Slack, PagerDuty, and others.
  • Alert trigger
    --
    Events that require further scrutiny. Alerts are raised when the rules that make up your policy are violated. When something in your environment violates a rule, an audit is logged, and an alert is sent to any matching alert profile (channel, audience). Prisma Cloud can be configured to notify the appropriate party when an entire policy, or even a specific rule, is violated.
    You can also set up alerts for Defender health events. These events tell you when Defender unexpectedly disconnects from Console. Alerts are sent when a Defender has been disconnected for more than 6 hours.
Not all triggers are available for all channels. For example, new JIRA issues can only be opened when vulnerability rules are triggered.

Prisma Cloud Notification provider integration

You can use the same notification settings set up in the platform for CSPM alerts by importing them into Compute in an Alert Profile.
These configurations are setup in the platform under
Settings > Integrations
tab and cannot be configured from within Compute. Any changes to the provider settings will need to be done on the platform side.

Importing platform configurations inside Compute

To learn more about setting up integration / alert providers in the platform, follow steps documented here.
  1. Navigate to
    Manage > Alerts
    tab in Compute, click on "Add Profile".
  2. From the
    Provider
    drop down, select
    Prisma Cloud
    .
  3. In the
    Integrations
    field, select the configuration you want to choose.
  4. Select triggers to be sent to this channel.
And hit Save.
Test alert notifications are sent immediately to the provider channels regardless of alert aggregation period chosen.

Supported Prisma Cloud Integrations

  • Email
  • JIRA
  • Slack
  • Splunk
  • PagerDuty
  • Webhooks
  • Google Cloud Security Command Center - Only available for onboarded PC accounts.
  • AWS Security Hub - Only available for onboarded PC accounts.
  • ServiceNow - Only Incident Response
The alert profiles from platform are fetched upon refresh / reload of the tab. If the user session is active and an integration was deleted from platform, it will not be reflected upon browser refresh / re-login into Compute tab.

Limitations

Prisma Cloud plaform currently supports a size limit of 1M for alert notifications payload. Hence the notifications set up using Prisma Cloud integration, will be limited to this size. A log message will be added when an alert message of this size is generated on Compute side.

Triggers

Most alerts trigger on a policy violation, and are aggregated by the audit aggregation period. Vulnerability, compliance, and cloud discovery alerts work differently, as described below.
In any case, you can optionally choose to trigger on specific rules rather than the entire policy.

Vulnerability alerts

The number of known vulnerabilities in a resource is not static over time. As the Prisma Cloud Intelligence Stream is updated with new data, new vulnerabilities might be uncovered in resources that were previously considered clean. The first time a resource (image, container, host, etc.) enters the environment, Prisma Cloud assesses it for vulnerabilities. Thereafter, every resource is periodically rescanned.
As long as there are new vulnerabilities detected on your resources, Prisma Cloud sends a vulnerabilities alert report every 24 hours. The report lists all new vulnerabilities that were detected in the past 24 hours.

Immediate alerts

You can configure sending alerts immediately when the number of vulnerabilities for the resource increased, which can happen in one of the following scenarios:
  • Deploy a new image/host with vulnerabilities.
  • Detect new vulnerabilities when re-scanning existing image/host, in that case an alert is dispatched again for this resource with all its vulnerabilities.
Immediate alerts are not supported for registry scan vulnerabilities.
Sending immediate vulnerability alerts can be configured per alert profile and is disabled by default.
The immediate alerting won’t affect the vulnerabilities report that is generated every 24 hours. The report will include all vulnerabilities that were detected in the last 24 hours, including those which were sent via an immediate alert.

Compliance alerts

Compliance alerts are sent in one of two ways. Each alert channel that has compliance alert triggers ("Container and image compliance", "Host compliance"), only uses one of these ways.

Compliance reports

This form of compliance alert works under the idea that resources in your system can only be in one of two states: compliant or non-compliant. When your system is non-compliant, Prisma Cloud sends an alert. As long as there are non-compliant resources, Prisma Cloud sends an alert every 24 hours. Compliance reports list each failed check, and the number of resources that failed the check in the latest scan and the previous scan. For detailed information about exactly which resources are non-compliant, use Compliance Explorer.
For example:
  • Scan period 1: You have non-complaint container named crusty_pigeon. You’ll be alerted about the container compliance issues.
  • Scan period 2: Container crusty_pigeon is still running. It’s still non-compliant. You’ll be alerted about the same container compliance issues.
The following screenshot shows an example compliance email alert:
This method applies to the following alert channels: email, Cortex XSOAR.

Compliance scans

This form of compliance alert is emitted whenever there is an increasment in the number of compliance issues detected on a resource. The first time a resource (image, container, host, etc) enters the environment, Prisma Cloud assesses it for compliance issues. If a compliance issue violates a rule in the policy, and the rule has been configured to trigger an alert, an alert is dispatched. Thereafter, every time a resource is rescanned (periodically or manually), and there is an increasment in the resource’s compliance issues, an alert is dispatched again for this resource with all its compliance issues.
This method applies to the following alert channels: Webhook, ServiceNow.

Cloud discovery alerts

Cloud discovery alerts warn you when new cloud native resources are discovered in your environment so that you can inspect and secure them with Prisma Cloud. Cloud discovery alerts are available on the email channel only. For each new resource discovered in a scan, Prisma Cloud lists the cloud provider, region, project, service type (i.e. AWS Lambda, Azure AKS) and resoure name (my-aks-cluster).

Limitations

  • Vulnerability alerts that arise from registry scans only trigger for the 50 most recent images, as sorted by last modified date. The limit is designed to contain Console resource consumption in large environments.
  • For runtime audits, there’s a limit of 50 runtime audits per aggregation period (seconds, minutes, hours, days) for all alert providers.

Recommended For You