Disable automatic learning
Prisma Cloud lets you disable automatic learning to give you full control over creating, managing, and maintaining runtime rules for your apps.
Disabling automatic runtime learning is strongly discouraged. Prisma Cloud has been architected and optimized to automatically learn known good runtime behaviors, then create models that explicitly allow those behaviors. Disabling learning requires creating manual rules for all of these behaviors and greatly increases the likelihood of encountering false positive events.
If you have a regimented deployment process that must guarantee consistency between your test environment and your production environment, then you might want to disable automatic runtime learning, and manually create runtime rules instead. With this approach, the full range of runtime behaviors is locked down in production, and cannot be extended without manually adding new rules.
Models and learning
When a model is created for an entity, it’s initially empty. Empty models don’t allow any runtime behaviors. In a default installation, Prisma Cloud uses machine learning to compose models that encapsulate all known good behaviors. Models are sets of rules that allow process, network, and file system activity.
When learning is disabled, newly created models are empty. Since empty models don’t allow any behaviors, you must manually create rules that explicitly allow process, network, and file system activity. Remember that rules come from two places: models (automatically created) and runtime rules (manually created). Manually created rules are designed to augment models when learning does not capture the full range of known good behaviors. When automatic learning is disabled, they must fully specify the full range of known good behaviors.
Deploying Prisma Cloud
Models created before automatic learning is disabled might still contain learned content. To guarantee all models are empty, disable automatic learning before deploying Defenders to your environment. Deploy Prisma Cloud in the following order:
- Deploy Console.
- Disable automatic learning.
- Deploy Defenders.
You should have two environments: test and production. Deploy Prisma Cloud Console to each environment. In the test environment, enable automatic learning. You’ll use automatic learning to assist with the creation of rules. In the production environment, disable automatic learning. You’ll port the rules from the test environment to the production environment.
The recommended workflow is:
- Deploy your app to the test environment, and fully exercise it.
- Validate models that were automatically created.
- Export models from the test environment as rules.
- Optionally store the rules in a source control system.
- Import the rules into your production environment, where automatic learning is disabled.
Exporting and importing rules from the Console UI
After your app has been fully exercised in the test environment, create a rule from the runtime model. In
Monitor > Runtime > Container Models, find your model, click
Actions, then click
Copy Into Rule.