1. Home
    2. Prisma
    3. Prisma Cloud
    4. Prisma Cloud Administrator’s Guide (Compute)
    5. Runtime defense
    6. Incident types
    7. Other incident types

    Other incident types

    • Hijacked Process:
       Indicates that an allowed process has been used in ways that are inconsistent with its expected behavior. This type of incident could be a sign that a process has been used to compromise a container.
    • Data exfiltration:
       Indicates the unauthorized transfer of data from one system to another. These incidents are triggered when a pattern of audits indicate attempts to move data to an external location. For example: High rate of DNS query events, reporting aggregation started in a container, DNS resolution of suspicious name (www.<WEBSITE_NAME>.com).
    • Cloud Provider:
       Indicates attempts to abuse a provider’s service to extract sensitive information. For example: Container A queried provider API at <IP_ADDRESS>.

    Recommended For You