1. Home
    2. Prisma
    3. Prisma Cloud
    4. Prisma Cloud Compute Edition Administrator’s Guide
    5. Runtime defense
    6. Runtime Audits

    Runtime Audits

    This document summarizes all the runtime audits (detections) that are available in Prisma Cloud Compute. For each detection, you can learn more about what it actually detects, how to enable or disable it, avoid false positives, relevant workloads (Containers, Hosts, Serverless and App-embedded), and if the audit also generates an incident.

    Runtime detections for processes

    Detection
    Context
    Audit message
    Triggers an incident
    Workloads
    Unexpected Process
    Indicates when a process that is not part of the runtime model was spawned.
    • Avoid audits for specific known and allowed processes, by adding the process name to the runtime rules processes
      Allowed
       list.
    • In order to add the processes to the model, navigate to the relevant model under
      Monitor > Runtime > Container
       models, then click on
      …​
       and select
      Extend learning
    • <process> launched but is not found in the runtime model
    • <process> launched from <parent process> but is not found in the runtime model
    Containers
    Port Scanning Process
    Indicates a process was spawned, that is identified as being used for port scanning.
    • Enable and disable this detection via the
      Port scanning
       toggle, under the Runtime rule Processes tab
    • Avoid audits on specific known and allowed processes, by adding process names to the runtime rule processes
      Allowed
       list.
    <process> launched and is identified as a process used for port scanning
    Containers
    Explicitly Denied Process
    Indicates that a process listed in the
    Denied & fallback
     list was spawned.
    • For App-embedded and Serverless, this indicates that a process that is not listed in the
      Allowed
       list was spawned
    <process> launched and is explicitly denied by runtime rule. Full command <command>
    Containers, Host, Serverless, App-embedded
    Modified Process
    Indicates a modified process was spawned. A modified process is a process whose binary was created or modified after the container was started.
    • Enable and disable this detection via the
      Processes started from modified binaries
       toggle, under the Runtime rule Processes tab
    • Avoid audits on specific known and allowed processes, by adding process names to the runtime rules processes
      Allowed
       list.
    A modified executable <process> was launched
    Containers, App-embedded
    Altered Binary
    Indicates that a package binary file was replaced during image build. This detection will generate an audit when a process is started from an altered binary.
    • Enable and disable this detection via the
      Processes started from modified binaries
       toggle, under the Runtime rule Processes tab
    • Avoid audits on specific known and allowed processes, by adding process names to the runtime rules processes
      Allowed
       list.