1. Home
    2. Prisma
    3. Prisma Cloud
    4. Prisma Cloud Compute Edition Administrator’s Guide
    5. Runtime defense
    6. Runtime defense for serverless functions

    Runtime defense for serverless functions

    Prisma Cloud lets you monitor process, network and filesystem activity within your serverless functions and enforce policies to allow or deny these activities. Policies let you define:
    • Process activity - enables specifying specific whitelisted processes, blocking all processes except the main process and detecting cryptomining attempts.
    • Network activity - enables monitoring and enforcement of DNS resolutions, inbound and outbound network connections.
    • Filesystem activity - enables defining specific paths in an allowed or denied list.
    In addition to runtime policy, you can also configure multiple WAAS application firewall protections to defend your functions from application layer attacks.

    Securing serverless functions

    To secure Serverless functions:
    1. Verify that you have installed Serverless Defenders on your functions.
      You must install Serverless Defenders before you can create serverless runtime policy.
    2. Log in to the Prisma Cloud Console and select
      Defend > Runtime > Serverless policy
       to add policies.
    3. Embed the Serverless Defender into your function either manually or with Auto-defend:

    Defining your policy

    Add runtime protection for your serverless function by defining a runtime rule for it in the Prisma Cloud Console.
    Prisma Cloud ships without a Serverless runtime policy. Serverless Defenders fetch the policy from the TW_POLICY environment variable and dynamically during runtime from the console (every 2 minutes).
    By default, new rules apply to functions (*), but you can target them to specific functions and regions using pattern matching.
    1. Log into Prisma Cloud Console.
    2. Go to
      Defend > Runtime > Serverless Policy
      .
    3. Click
      Add rule
      .
      1. Enter a rule name.
      2. By default, the rule applies to all functions in all regions and accounts.
        Target the rule to specific functions.
      3. Click the
        Networking
         tab.
      4. Enable
        DNS
         toggle
      5. Set
        Effect
         to
        Prevent
        .
      6. Add *amazon.com to the
        DNS allow list
        By default, rules are set to allow traffic. When adding a domain to the allow list, then everything outside the allow list is denied by default. The above rule will block all traffic except to *amazon.com.
      7. Click
        Save
        .

    View runtime audits

    To view the security audits, go to
    Monitor > Events > Serverless Audits
    . You should see audits with the following messages:
    DNS resolution of domain name yahoo.com triggered by /usr/bin/wget explicitly denied by a runtime rule.