Add Azure Commercial Subscription to Prisma Cloud

Access Prisma Cloud and select

Settings

Cloud Accounts

Add New

.

Select

Azure

as the

Cloud to Protect

.

Enter a

Cloud Account Name

.

A cloud account name is auto-populated for you. You can replace it with it a cloud account name that uniquely identifies your Azure subscription on Prisma Cloud.



Select the

Mode

.

Decide whether to enable permissions to only monitor (read-only access) or to monitor and protect (read-write access) the resources in your cloud account. Your selection determines which Terraform template is used to automate the process of creating the custom role required for Prisma Cloud.

Register Prisma Cloud as an application on your Azure Active Directory.

Prisma Cloud requires your Azure

Subscription ID

so that it can identify your Azure cloud account and retrieve the storage account and key vault information. Prisma Cloud also needs the

Directory (Tenant) ID

,

Application (Client) ID

,

Application Client Secret

, and

Enterprise Application Object ID

to establish the connection between Prisma Cloud and Azure Active Directory so that it can access the resources in your subscription.

Fill out the details to set up Prisma Cloud on your Azure subscription and click

Next

.

From the Azure portal, get your Azure Active Directory ID, that is referred to as Tenant ID on Prisma Cloud, and your Azure Subscription ID.

The Terraform template uses the value you enter as inputs to automate the process of setting up the custom role with the associated permissions for the

Monitor

or

Monitor & Protect

mode you selected earlier. It also automatically generates a Service principal password.



Download the Terraform template.

Prisma Cloud recommends that you create a directory to store the Terraform template you download. This allows you to manage the templates when you add a different Azure subscription to Prisma Cloud. Give the directory a name that uniquely identifies the subscription for which you're using it (for example, onboard-<subscription-name>).

Login to the Azure portal Cloud Shell (Bash).

Upload the template to the Cloud Shell.



Run the following Terraform commands.

terraform init
terraform apply

Copy the details after applying the Terraform template.

Get the Application Client Secret, Application (Client) ID and the Enterprise Application Object ID from the output file.



Select

Ingest & Monitor Network Security Group flow logs

and click

Next

.

Network security group (NSG) flow logs are a feature of Network Watcher that allows you to view information about ingress and egress IP traffic through an NSG. You must first configure

Network Security Groups

on Azure and assign a storage account to enable Flow log ingestion on Prisma Cloud. Make sure that Azure Flow logs are stored within a storage account in the same region as the NSG. If you want to enable flow log ingestion, you must complete the tasks outlined in Steps 6 to Step 10 in Set Up Your Azure Subscription for Prisma Cloud. If you enable this option without setting it up on the Azure portal, Prisma Cloud will not be able to retrieve any Flow logs.

Select the

Account Groups

you want to add and click

Next

.

You must assign each cloud account to an account group, and Create an Alert Rule for Run-Time Checks to associate the account group with it to generate alerts when a policy violation occurs.

Verify the

Status

and click

Done

.

If Prisma Cloud is able to successfully connect to your Azure subscription and retrieve information, the status is displayed with a green check mark. If Prisma Cloud is unable to retrieve the logs, the error message indicates what failed. See Troubleshoot Azure Account Onboarding for help.



Verify that you can view the information on your Azure resources on Prisma Cloud.

Wait for approximately 10-24 hours after you onboard the Azure subscription to Prisma Cloud, to review the data that was collected about your Azure resources. After Prisma Cloud ingests data, the information is available for compliance checks, configuration review, audit history, and network visualization.

It takes about four to six hours before you can view flow logs in Prisma Cloud. Prisma Cloud ingests flow logs from the previous seven days from when you onboard the account.

Log in to Prisma Cloud.

Select

Investigate

and enter the following RQL query.

This query allows you to list all network traffic from the Internet or from Suspicious IP addresses with over 0 bytes of data transferred to a network interface on any resource on any cloud environment.

network where cloud.account = ‘{{cloud account name}}’ AND source.publicnetwork IN (‘Internet IPs’, ‘Suspicious IPs’) AND bytes > 0