New Features in the Core Platform

Log in to the Palo Alto Networks Customer Support Portal.
Go to
Updates > Software Updates
and select
Prisma Cloud Compute Edition
.

New Filters in the Vulnerability Explorer

On the Vulnerability Explorer, you can now generate a vulnerabilities report using new filters such as CVSS score and severity threshold. In addition to viewing the filtered results for deployed images, registry images, hosts, and functions under

Vulnerability (CVE) results

, on

Monitor > Vulnerabilities > Vulnerability Explorer

, you can also download a detailed report for CVEs in a CSV format or a detailed report for impacted resources in a CSV format from the Vulnerability Explorer.

Vulnerability Scan Report for Registry Images

With the vulnerabilities report for registry images (

Monitor > Vulnerabilities > Images > Registries

), you can review the top 10 critical CVEs discovered in your registry images and search by a CVE ID to view the results for both registry and deployed images that are impacted by a CVE.

New Features in Container Security

Vulnerability and Compliance Scanning for Workloads Protected by App-Embedded Defenders

App-Embedded Defenders can now scan the workloads they protect for vulnerabilities and compliance issues. They can also collect and report package information and metadata about the cloud environments in which they run.

Go to

Monitor > Vulnerabilities > Images > Deployed

and

Monitor > Compliance > Images > Deployed

to review the scan reports.

Improved Visibility for CaaS Workloads Protected by App-Embedded Defenders

For CaaS (Container as a Service) workloads protected by the App-Embedded Defenders, you can now view more metadata on the cloud environment on which it is deployed, forensics, and runtime audits on the

Monitor > Runtime > App-Embedded observations

page. You can filter the workloads in the table by a number of facets, including collections, account ID, and clusters.

Runtime File System Audits for App-Embedded Defenders

App-Embedded Defender runtime defense now includes support for container file systems so that you can continuously monitor and protect containers from suspicious file system activities and malware.

Automatically Extract Fargate Task Entrypoint at Embed-Time

To streamline the embed flow and eliminate manual intervention (that is updating task definitions to explicitly specify entrypoints), Prisma Cloud can automatically find the image entrypoint and set it up in the protected task definition.

Now, when Prisma Cloud generates a protected task definition, it knows the entrypoint and/or cmd instructions of the container image during the first run of the App-Embedded Defender.

CloudFormation Template (CFT) Support for Fargate Task Definitions

You can now generate protected Fargate task definitions in the CFT format for embedding an App-Embedded Defender.

Additional Checks for CIS Benchmark for OpenShift

In 22.06, we’ve added support for more checks from the CIS OpenShift benchmark.

For more information, see CIS Benchmarks.

Support for Google Artifact Registry

You can now scan Google Artifact Registries using Prisma Cloud Compute.

Rule to Allow Activity in Attached Sessions

When you start a session inside pods or containers running in your deployment using commands such as kubectl exec or docker exec, you can now explicitly specify whether the rule should allow the activity in attached sessions. This option on

Defend Runtime Container Policy > Add rule > Processes

helps you reduce the volume of alerts generated for the allowed activities and processes.

When enabled, process, network, and filesystem activity executed in an attached session such as kubectl exec, is explicitly allowed without additional runtime analysis.

Only Defender versions 22.06 or later will support this capability.

New Features in Agentless Security

Support for Microsoft Azure

Agentless scanning is now available for vulnerability scanning and compliance scanning on Azure. To configure and onboard agentless scanning on Azure, see configure agentless scanning.

Support for Google Cloud

Agentless scanning is now available for vulnerability scanning and compliance scanning on Google Cloud. To configure and onboard agentless scanning on Google Cloud, see configure agentless scanning.

Compliance and Custom Compliance Support

With agentless scanning you can now scan hosts from all three major cloud providers—AWS, Azure, and Google Cloud—against compliance benchmarks. In addition to out of-the-box checks, you can apply user defined custom compliance checks and scan against the host file system.

Unpatched OS Detection

In addition to vulnerabilities and compliance scanning, you can now track pending OS security updates in this release with agentless scanning.

Unscanned Cloud Account Detection

You can now easily discover regions within AWS, Azure, or Google Cloud accounts where agentless scanning is not enabled, and enable scanning for those cloud accounts.

New Features in Host Security

New Features in Serverless Security

Runtime Protection for Azure Functions

Serverless Defenders now offer runtime protection for Azure Functions. Functions implemented in C# (.NET Core) 3.1 and 6.0 are supported.

New features in Web Application and API Security (WAAS)

WAAS Out of Band Detection

Out of band is a new mode for deploying Web Application and API Security (WAAS). It enables you to inspect HTTP messages to an application based on a mirror of the traffic, without the need for setting up WAAS as an inline proxy, so that you can receive alerts on malicious requests such as OWASP top alerts, bot traffic, and API events. It provides you with API discovery and alerting without impacting the flow, availability, or response time of the protected web application.

Out of band detection also allows you to extend your WAAS approach:

You can monitor your resources deployed on AWS with VPC traffic mirroring from workloads. This option gives you the flexibility to monitor environments without deploying Defenders.
If you have deployed Defenders in your environment, but are not using the WAAS capabilities on Compute, you can mirror traffic for an out of band inspection without requiring any additional configuration.

After you configure a custom rule for out of band mode (

Defend > WAAS > Out of band

), all the detections are applied on a read-only copy of the traffic. And you can view the out of band traffic details on

Monitor > WAAS > API observations > Out of band observations

.

OpenAPI Definition File Scanning

You can scan OpenAPI 2.X and 3.X definition files in either YAML or JSON formats, and generate a report for any errors or shortcomings such as structural issues, gaps in adherence to security guidelines and best practices.

You can initiate a scan through twistcli, upload a file to the Console, or import a definition file in to a WAAS app. The scan reports are available under

Monitor

>

WAAS

>

API definition scan

.

Automatic Port Detection of WAAS Applications for Containers or Hosts

When you enable the automatic detection of ports in WAAS

Container

,

Host

, or

Out of band

rules, you can secure ports used by unprotected web applications. The automatic detection of ports makes it easier to deploy WAAS at scale because you can protect web applications without the knowledge of which ports are used. Additionally, you can add specific ports to the protected HTTP endpoints within each app in your deployment.

Customization of Response Headers

You can append or override names and values in HTTP response headers for

Containers

,

Hosts

, and

App Embedded

deployments that are sent from WAAS protected applications.

WAAS Actions for HTTP Messages that Exceed Body Inspection Limits

You can now apply the

Alert

,

Prevent

, or

Ban

WAAS actions for HTTP messages that exceed the body inspection limit and ensure that messages that exceed the inspection limit are not forwarded to the protected application.

To enforce these limitions, you must have a minimum Defender version of 22.01 (Joule).

And with custom rules (

Defend

>

WAAS

>

Out of band

), you can apply

Disable

or

Alert

actions for HTTP messages that exceed the body inspection limit.

Attacker IP Addition to a Network List

When a WAAS event includes an attacker IP address, you can now directly click a link to add the attacker IP address to an existing or new network list from

Monitor

>

Events

>

Aggregated WAAS events

>

Attacker

.

Regex Match in Forensics Message

When defining a custom rule, you can now define a regular expression to match for strings and include the matched information in the forensics message.

Defender Compatibility with Custom Rules

To make it easier to review and make sure that all Defenders meet the minimum version requirement for a rule, you can now view the minimum Defender version required to use each rule. The Defender version information is displayed in a new column within the custom rules table.

WAAS Proxy Error Statistics

On

Radar

>

WAAS connectivity monitor

you can view WAAS proxy statistics for blocked requests, count of requests when the inspection limit was exceeded, and parsing errors.

DISA STIG Scan Findings and Justifications

API Changes

Addressed Issues

Fixed an issue where fixedDate for Windows vulnerabilities did not update.

The Intelligence Stream is updated to fix an issue where some Red Hat Enterprise Linux (RHEL) packages were incorrectly reported as vulnerable.
This issue occurred because Red Hat had duplicate records of the same CVE in their OVAL feed, where one was fixed and the other one was not.
Security Fixes
In accordance with the security assurance policy, this release contains updates to resolve older vulnerabilities in packaged dependencies:
Console & Defender
:
Upgraded Go Lang version
Removed mongodb-tools binaries
Containerd updates for Kubernetes (github.com/containerd/containerd)
Open Policy Agent updates (github.com/open-policy-agent/opa)
Runc updates (github.com/opencontainers/runc)
Kubernetes (k8s.io/kubernetes)
Mongod
Mongodb Go driver (go.mongodb.org/mongo-driver)
AWS SDK for Go (github.com/aws/aws-sdk-go)
Dependency updates for:
Package xz (github.com/ulikunitz/xz)
YAML for Go package (gopkg.in/yaml.v3)
Defender
github.com/docker/distribution
github.com/tidwall/gjson
Console
Dependency updates for com.google.code.gson_gson

Supported Host Operating Systems

Changes in Existing Behavior

For short-lived containers, that is when a container is created and immediately terminated, the image will not be scanned. In previous versions, the image was scanned by monitoring pull events from the registry.
An additional permission is added to AWS agentless scanning template.
For existing accounts that are enabled for agentless scans you will need to update the permissions.
Credentials for AWS, GCP, and Azure cloud accounts are now under
Manage > Cloud Accounts
.

In 22.01 update 2, we updated how the scanning process impacts artifact metadata in JFrog Artifactory. The scanning process no longer updates the
Last Downloaded
date for all manifest files of all the images in the registry.
In 22.06, we’ve further refined how this works:
As part of the process for evaluating which images should be scanned, in addition to reviewing the manifest files, Prisma Cloud also examines the actual images. Now the
Last Downloaded
date won’t change unless the image is actually pulled and scanned.
"Transparent security tool scanning" is
not
supported for anything other than Local repositories. If you select anything other than
Local
in your scan configuration (including virtual repositories backed by local repositories), then Prisma Cloud automatically uses the Docker API to scan all repositories (local, remote, and virtual). When using Docker APIs, the
Last Downloaded
field in local JFrog Artifactory registries will be impacted by scanning.
If you’ve got a mix of local, remote, and virtual repositories, and you want to ensure that the
Last Downloaded
date isn’t impacted by Prisma Cloud scanning, then create separate scan configurations for local repositories and remote/virtual repositories.

The data collection for incidents in the Prisma Cloud Compute database is capped to 25,000 incidents or 50 MB, whichever limit is reached first.
When upgrading from 22.01 to 22.06, if the size of your incident collection exceeds this limit, then the oldest incidents that exceed the limit will be dropped.
As part of this change, the serial number field for incidents will now be empty. The serial number was a running count of the incidents according to the size of the data collection. Now that the collection is capped, the serial number is no longer available. To uniquely identify incidents, use the ID field instead.

A new field
category
is now available for incidents alert integration with Webhook and Splunk to identify the incident type.

With 22.06, all App-Embedded collections including Fargate tasks, will be grouped together in collections using the
App ID
field.
Until now, collections of Fargate tasks were specified using the
Hosts
field in vulnerability, compliance, and incidents pages.
After upgrading to 22.06, update your existing collections to use the
App IDs
field rather than the
Hosts
field to maintain the correct grouping of resources for filtering, assigning permissions, and scoping vulnerability and compliance policies.
Also, the CSV file export for vulnerability scan results, compliance scan results, and incidents has changed. Fargate tasks protected by App-Embedded Defender will be reported under the
Apps
column instead of the
Hosts
column.

Known Issues

When Defender is installed on Windows hosts in AWS, and Prisma Cloud Compute Cloud Discovery is configured to scan your environment for protected hosts, the Windows hosts running Defender are reported as unprotected.

For custom compliance checks for Kubernetes and OpenShift on CRIO, when
Reported results
is configured to show both passed and failed checks, if a check doesn’t run, Prisma Cloud still reports it as
passed
.

If you have the same custom compliance rule in use in a host policy (effect: alert) and a container policy (effect: block), the rules will enforce your policy (as expected), but the audit message for a blocked container will incorrectly refer to the host policy and host rule name.

On the Radar > Containers, K3s clusters are not displayed. You can view the containers within these clusters under
Non-cluster containers
.

Upcoming Deprecation Notifications

Support for Openshift 3.11 will be removed in the next release, Lagrange.

Support for Windows Server 2022 will be added with or before the next release, Lagrange. With support for Windows Server 2022, Windows Server 2016 will no longer be supported. Microsoft has announced the EOL for Windows Server 2016 as of January,2022.

Support for Docker Access Control is being deprecated along with the Access User role.
Support will be removed in the Newton release.

Support for scanning your code repositories and CI pipelines from the Prisma Cloud Compute console (
Monitor > Vulnerabilities > Code repositories
) and twistcli is being deprecated. You can use the Code Security module on Prisma Cloud to scan code repositories amd CI pipelines for misconfigurations and vulnerabilities.
Support for code repo scanning and CI pipelines using Prisma Cloud Compute will be removed in the Newton release.

Backward Compatibility for New Features