: VMware Tanzu Application Service (TAS) Defender

VMware Tanzu Application Service (TAS) Defender

Table of Contents
End-of-Life (EoL)

VMware Tanzu Application Service (TAS) Defender

You can deploy a dedicated Defender on the Diego cells (Hosts) in your environment. The Prisma Cloud tile installs a TAS Defender on every Diego cell in the TAS environment, including Diego cells that run in Isolation Segments.
Tanzu Application Service (TAS) Defender supports the following functions:
  • Vulnerability scanning for running apps.
  • Vulnerability and compliance scanning for the underlying Diego cell hosts.
  • Blobstore scanning for buildpack-based apps.
  • Runtime protection (process, networking, and file system).
Defender is deployed as BOSH Director addon. Addons are BOSH release jobs that run on each Diego cell host. Defender runs as a service under the root user. The Defender service is monitored by the Bosh agent, with the help of Monit. Note that the Defender service isn’t a Garden container.
Console lets you deploy Defender to multiple TAS environments. In Console, Defenders report which Cloud Controller they report to.
Currently, TAS Defender doesn’t support blocking for runtime rules, vulnerability rules, and compliance rules. The block action stops the entire container. The app lifecycle is controlled by the Tanzu Application Service framework, so Prisma Cloud cannot effectively block running apps. TAS Defender, however, does support the prevent action.
TAS Defender currently doesn’t support custom compliance checks.

Install the TAS Defender

Go to the Tanzu Ops Manager Installation Dashboard to install TAS Defender.
If you’re upgrading from a release earlier than 20.09, you must first uninstall any previous versions of TAS Defender. In version 20.09, the tile has been rearchitected. The old tile created a dedicated VM in the TAS environment with a Defender installed, and supported blobstore scanning only. The new tile installs Defender on every Diego cell in the TAS environment, with expanded support for app scanning, host scanning, and runtime defense.
  • Prisma Cloud Compute Console has already been installed somewhere in your environment.
  1. In Prisma Cloud Console, go to
    Manage > System > Utilities
    , and download the TAS tile.
  2. In the Ops Manager Installation Dashboard, click
    Import a Product
    , and select the tile you downloaded.
  3. Retrieve the install command from Prisma Cloud Console. It’s used to configure the tile.
    1. Go to
      Manage > Defenders > Deploy > Single Defender
    2. Choose the DNS name or IP address the TAS Defender will use to connect to Console. If a suitable option is not available, go to
      Manage > Defenders > Names
      , and add a DNS name or IP address to the SAN table.
    3. Set the Defender type to
      TAS Defender
    4. Copy the install command and set it aside.
  4. Go to the Tanzu Ops Manager Installation Dashboard.
  5. Add the Prisma Cloud tile to your staging area. Click the
    button next to the version of the tile you want to install.
  6. Click the newly added
    Prisma Cloud for TAS
  7. Configure the tile.
    1. In
      Prisma Cloud Component Configuration
      , paste the install command you copied from Prisma Cloud Console. Provide a name for this specific TAS Foundation, then click
      By default Prisma Cloud performs strict validation of your Cloud Controller’s (CC) TLS certificate. If you’re using self-signed certificates, this check will fail. To add your custom certificates to trusted cert list, you need to add the custom CA’s cert on the VM where the Prisma Cloud tile runs. For more information, see the article on trusted certificates.
      To skip strict validation of your Cloud Controller’s (CC) TLS certificate, enable
      Skip Cloud Controller TLS validation
      . Strict validation verifies the name, signer, and validity date of the CC’s certificate. Even with strict validation disabled, the sesssion is still encrypted. Skip strict validation when:
      • You’re using self-signed certificates.certificates.
      • You’re using certificates signed by a CA that isn’t in your cert store..
      • When there’s a mismatch between the address you’re using to connect to the CC and the common name (CN) or subject alternative name (SAN) in the CC’s certificate.
    2. In
      , select your preferred authentication method: Basic Authentication or Certificate-based Authentication:
      For Basic Authentication, enter your Prisma Cloud Console credentials, then click
      For certificate-based Authentication, paste the certificate and private key used for authentication in PEM format, then click
      • Your role must be Defender Manager or higher.
      • For Certificate-based Authentication, the root CA used to sign the certificate used for authentication must be entered under
        Manage > Authentication > System Certificates > Certificate-based authentication to Console
  8. Install the Prisma Cloud tile. Return to the Ops Manager Installation Dashboard, click
    Review Pending Changes
    , select both
    Prisma Cloud for TAS
    Tanzu Application Service
    , then click
    Apply changes
    Tanzu Application Service must be staged when installing the Prisma Cloud tile.
    In order to deploy a new Defender after the Prisma Cloud tile is installed (e.g. if new Diego cells or isolation segments have been installed in the TAS environment),
    Apply changes
    on Ops Manager is required.
  9. After the changes are applied, validate that Prisma Cloud Defenders are running in your environment.
    1. Log into Prisma Cloud Console.
    2. Go to
      Manage > Defenders > Manage > Defenders
      In the table of deployed Defenders, you should see a Defender of type
      Tanzu Application Service
      , one per Diego cell, including Diego cells that run in the Isolation Segments of your TAS environment.
      Prisma Cloud reports the agentID in the Host field. To correlate an agentID to a Diego cell IP address, and determine exactly which host runs a Defender, login to an Diego cell, and inspect /var/vcap/instance/dns/records.json. This file shows how the agentID maps to a host IP address.
      If a TAS Defender disconnects from Console for more than one day, all data it collected is purged from Console. The Defender is also removed from the table in
      Manage > Defenders > Manage
      . The period of time that data from a disconneted Defender is retained (by default, one day) can be configured in
      Manage > Defenders > Manage > Defenders > Advanced Settings

Utilizing collections with TAS metadata fields

Prisma Cloud automatically collects metadata fields such as Foundation, Organization Name, Application Name and ID, and Space Name and ID. To utilize these fields, you’ll have to
manually create
appropriate collections that can then be used for filtering and aggregation.
Resource type
Supported Labels
Containers (running applications)
tas-application-id, tas-application-name, tas-space-id, tas-space-name, tas-org-id, tas-org-name, tas-foundation
tas-application-id, tas-application-name, tas-space-id, tas-space-name, tas-org-id, tas-org-name, tas-foundation

Recommended For You