Configure Agentless Scanning for GCP

Log in to your Prisma Cloud Compute Console.
Go to
Manage > Cloud
Accounts.
Click
+Add account
.

Enter the following information for the hub account in the
Account config
page.

Select Cloud provider
: GCP
Account ID:
Enter your Google project ID for the hub account.
Description:
Provide an optional string.
Service account:
Paste the contents of the downloaded service account key file for the hub account.
API token:
Leave blank.
Click
Next
.
In the Agentless scanning page, complete the following steps.
Enable
Agentless scanning
.
Set the
Console URL
and
Port
to the address of your Prisma Cloud console that can be reached from the internet. To create an address or FQDN reachable from the internet, complete the Subject Alternative Names procedure.
Hub account
: Enable the toggle to configure this account as a hub account.
Expand the
Advanced settings
.

Select where to scan
: For GCP accounts, you can decide between two scanning modes.
Same Account
: Perform the agentless scanning process using this account.
Hub Account
: Perform the agentless scanning process using a centralized hub account. Select another account from the list to use as the centralized hub account to scan this account. on the target accounts. If you wish Prisma Cloud to scan encrypted volumes on the target accounts, follow the steps on encrypted volumes.
Auto-scale scanning
: Automatically create the required amount of scanners to scan all of the hosts within a region, up to a limit of 50 scanners. To use a different limit specify the
Max number of scanners
.
Max number of scanners
: Enter the upper limit of scanners that Prisma Cloud can automatically spin up within a region in your account for faster results.
Enforce permissions check
: In case of failure to validate the appropriate permissions, this account won’t be scanned. If this is a hub account, the associated target accounts won’t be scanned as well.
Enter a
Proxy
value if traffic leaving your GCP tenant uses a proxy.
Custom labels
: Apply custom labels to any resources Prisma Cloud creates during agentless scanning.
Under
Scan scope
you can refine the scope of the scanning by
Regions
or using labels.

All regions

: Scan in all GCP regions.

Custom regions

: Specify the GCP regions, which you want scanned.

Scan non running hosts

: Choose whether or not to scan hosts that aren’t running.

Exclude hosts by labels

: Select a subset of hosts which you want to exclude from the scan process

You can use wildcards to specify a range of labels in both keys and values following these examples:

"abcd*"
"*abcd"
"abcd"
"*"
"*abcd*"

Include hosts by labels

: Select a subset of hosts to scan

You can use wildcards to specify a range of labels in both keys and values following these examples:

"abcd*"
"*abcd"
"abcd"
"*"
"*abcd*"
Network resources
: Configure custom network resources for agentless scanning
Subnet
: If left blank, agentless scanning uses the default networking infrastructure and assigns scanners with a public IP. Specify a subnet name to use an existing subnet in your environment and to use a private IP. The subnet must be unique and identical across all regions. If you are configuring a hub account, this requirement only applies to the hub account and not for the targets.
Shared VPC
: If you are using a shared VPC, enter the shared VPC path in this field with the following convention. Replace {host_project_name} with the ID of the project that owns the shared VPC.
projects/{host_project_name}/regions/{region_name}/subnetworks/{subnet_name}
Using a shared VPC requires additional permissions on the shared VPC host project. Refer to the GCP documentation to learn more about shared VPCs.
Click Next.
Leave the
Server scan
toggle unchanged.
Click Next.
Leave the
Discovery features
toggle unchanged.
Click
Save
.

Start an Agentless Scan

Agentless scans start immediately after onboarding the cloud account. By default, agentless scans are performed every 24 hours, but you can change the interval on the

Manage > System > Scan

page under

Scheduling > Agentless

.

To manually start a scan, complete the following steps.

Go to

Manage > Cloud accounts

.

Click the scan icon on the top right corner of the accounts table.

Click

Start Agentless scan

.



Click the scan icon in the top right corner of the console to view the scan status.

View the results.

Go to

Monitor > Vulnerabilities > Hosts

or

Monitor > Vulnerabilities > Images

.

Click on the

Filter hosts

text bar.



Select the

Scanned by

filter.



Select the

Agentless

filter.