Add Azure Commercial Subscription on Prisma Cloud

Access Prisma Cloud and select

Settings

Cloud Accounts

Add New

.

Select

Azure

as the

Cloud to Protect

.

Enter a

Cloud Account Name

.

A cloud account name is auto-populated for you. You can replace it with it a cloud account name that uniquely identifies your Azure subscription on Prisma Cloud.



Select the

Mode

.

Decide whether to enable permissions to only

monitor

(read-only access) or to

monitor and protect

(read-write access) the resources in your cloud account. Your selection determines which Terraform template is used to automate the process of creating the custom role required for Prisma Cloud.

Enter your Directory (Tenant) ID and Subscription ID.

Prisma Cloud requires your Azure

Subscription ID

so that it can identify your Azure cloud account and retrieve the storage account and key vault information. Prisma Cloud also needs the

Directory (Tenant) ID

which identifies your tenant.

Get the directory tenant id

—In Azure portal, click

Properties

and copy the

Tenant ID

.

Get the subscription id

—In Azure portal, select

All resources

(Your Azure subscription)

, and then copy

Subscription ID

.



Download the Terraform template.

Prisma Cloud recommends that you create a directory to store the Terraform template you download. This allows you to manage the templates when you add a different Azure subscription to Prisma Cloud. Give the directory a name that uniquely identifies the subscription for which you're using it (for example, onboard-<subscription-name>).

Log in to the Azure portal Cloud Shell (Bash).

Upload the template to the Cloud Shell.
Run the following Terraform commands.
terraform init
terraform apply
After you enter
terraform apply
the CLI will ask:
Do you want to perform these actions?
. Type
yes
and hit enter.
Get the
Application Client Secret
,
Application (Client) ID
, and the
Enterprise Application Object ID
from the CLI and enter it into the Prisma Cloud UI.

Select
Ingest & Monitor Network Security Group flow logs
and click
Next
.
Network security group (NSG) flow logs are a feature of Network Watcher that allows you to view information about ingress and egress IP traffic through an NSG. You must first configure Network Security Groups on Azure and assign a storage account to enable Flow log ingestion on Prisma Cloud. Make sure that Azure Flow logs are stored within a storage account in the same region as the NSG. If you want to enable flow log ingestion, you must complete the tasks outlined in Step 9 in Register an App on Azure Active Directory. If you enable this option without setting it up on the Azure portal, Prisma Cloud will not be able to retrieve any Flow logs.

Select the

Account Groups

you want to add and click

Next

.



You must assign each cloud account to an account group, and Create an Alert Rule for Run-Time Checks to associate the account group with it to generate alerts when a policy violation occurs.

Verify the

Status

and click

Done

.

If Prisma Cloud is able to successfully connect to your Azure subscription and retrieve information, the status is displayed with a green check mark. If Prisma Cloud is unable to retrieve the logs, the error message indicates what failed. See Troubleshoot Azure Account Onboarding for help.



Verify that you can view the information on your Azure resources on Prisma Cloud.

Depending on the number of resources in the accounts onboarded the data that was collected about your Azure resources can take up until a hour to display. After Prisma Cloud ingests data, the information is available for compliance checks, configuration review, audit history, and network visualization.

It takes about four to six hours before you can view flow logs in Prisma Cloud. Prisma Cloud ingests flow logs from the previous seven days from when you onboard the account.

Log in to Prisma Cloud.

Select

Investigate

and enter the following RQL query.

This query allows you to list all network traffic from the Internet or from Suspicious IP addresses with over 0 bytes of data transferred to a network interface on any resource on any cloud environment. Replace

‘<cloud account name>’

with the name of your actual cloud account.

									
network from vpc.flow_record where cloud.account = '<cloud account name>' AND source.publicnetwork IN ( 'Internet IPs', 'Suspicious IPs' ) AND bytes > 0