Runtime defense for serverless functions
Prisma Cloud lets you monitor process, network and filesystem activity within your serverless functions and enforce policies to allow or deny these activities. Policies let you define:
- Process activity - enables specifying specific whitelisted processes, blocking all processes except the main process and detecting cryptomining attempts.
- Network activity - enables monitoring and enforcement of DNS resolutions, inbound and outbound network connections.
- Filesystem activity - enables defining specific paths in an allowed or denied list.
In addition to runtime policy, you can also configure multiple WAAS application firewall protections to defend your functions from application layer attacks.
Securing serverless functions
To secure Serverless functions:
- Verify that you have installed Serverless Defenders on your functions.You must install Serverless Defenders before you can create serverless runtime policy.
- Log in to the Prisma Cloud Console and selectDefend > Runtime > Serverless policyto add policies.
- Embed the Serverless Defender into your function either manually or with Auto-defend:
Defining your policy
Add runtime protection for your serverless function by defining a runtime rule for it in the Prisma Cloud Console.
Prisma Cloud ships without a Serverless runtime policy. Serverless Defenders fetch the policy from the TW_POLICY environment variable and dynamically during runtime from the console (every 2 minutes).
By default, new rules apply to functions (*), but you can target them to specific functions and regions using pattern matching.
- Log into Prisma Cloud Console.
- Go toDefend > Runtime > Serverless Policy.
- ClickAdd rule.
- Enter a rule name.
- By default, the rule applies to all functions in all regions and accounts.Target the rule to specific functions.
- Click theNetworkingtab.
- Add *amazon.com to theDNS allow listBy default, rules are set to allow traffic. When adding a domain to the allow list, then everything outside the allow list is denied by default. The above rule will block all traffic except to *amazon.com.
View runtime audits
To view the security audits, go to
Monitor > Events > Serverless Audits. You should see audits with the following messages:
DNS resolution of domain name yahoo.com triggered by /usr/bin/wget explicitly denied by a runtime rule.