Set Up Global Settings for Policy and Alerts

Auto enable new default policies of the type
.
Select
Settings
Enterprise Settings
.
Granularly enable new
Default
policies of severity
Critical
,
High
,
Medium
,
Low
or
Informational
.

Enable
Make Alert Dismissal Note Mandatory
, to mandate the users to dismiss alerts only after specifying a reason.
Enable
Populate User Attribution in Alerts Notifications
.
User attribution data provides you with context on who created or modified the resource that triggered the alert. Select this option to make sure that the alerts include user attribution data in the alert payload, so that it is sent as part of the JSON data to notification channels such as SQS or Splunk. Enabling this option can result in a delay of up to two hours in the generation of alerts because the relevant user information may not be instantly available from the cloud provider.
The policies that support user attribution in alert payload are:
AWS Security Group allows all traffic on RDP port (3389)
AWS EBS snapshots are accessible to public
AWS RDS snapshots are accessible to public
AWS RDS instance is not encrypted
AWS Security Group allows all traffic on SSH port (22)
AWS Security Group overly permissive to all traffic
AWS Amazon Machine Image (AMI) is publicly accessible

Enable Alarms

Select
Settings
Enterprise Settings
.
You must have the System Administrator role on Prisma Cloud to view, enable, and disable Alarms.
Enable
Alarms Configuration
.
Later if you disable Alarms Configuration, all the alarms that were generated previously are deleted.

Save
.

Set up Access Key Settings

Email notifications for named user Access Keys
Alarm Center notifications for Service Account Access Keys

Enable Audit Log Forwarding

Unsubscribe from Prisma Cloud Chronicles

Select
Settings
Enterprise Settings
.
Select
Opt out of receiving the Prisma Cloud Chronicles newsletter for all Prisma Cloud System Administrators
.
An email is sent to all administrators notifying them that a System Administrator has opted them out. Each administrator can edit their profile settings on Prisma Cloud to opt in and receive the newsletter, if they want to stay informed of the latest updates.

Set Up Anomaly Policy Thresholds

For UEBA policies:
Select
Settings
Anomaly Settings
Alerts and Thresholds
.

Select a policy.
Define the
Training Model Threshold
.
The Training Model Threshold informs Prisma Cloud on the values to use for setting the baseline for the machine learning (ML) models.
For production environments, set the
Training Model Threshold
to
High
so that you allow for more time and have more data to analyze for determining the baseline.
For account hijacking attempts:
Low: The behavioral models are based on observing at least 10 events over 7 days.
Medium: The behavioral models are based on observing at least 25 events over 15 days.
High: The behavioral models are based on observing at least 50 events over 30 days.
For anomalous compute provisioning activity:
None.
For unusual user activity:
Low: The behavioral models are based on observing at least 25 events over 7 days.
Medium: The behavioral models are based on observing at least 100 events over 30 days.
High: The behavioral models are based on observing at least 300 events over 90 days.
Define your
Alert Disposition
.
Alert Disposition is your preference on when you want to be notified of an alert, based on the severity of the issue —low, medium, high. The alert severity is based on the severity associated with the policy that triggers an alert.
You can profile every activity by location or user activity. The activity-based anomalies identify any activities which have not been consistently performed in the past. The location based anomalies identify locations from which activities have not been performed in the past.
Choose the disposition (in some cases you may only have two to choose from):
Conservative:
For unusual user activity—Reports on unknown location and service to classify an anomaly.
For account hijacking—Reports on location and activity to login under travel conditions that are not possible, such as logging in from India and US within 8 hours.
For anomalous compute provisioning activity—Reports on high severity alerts only when an unusual number of instances are created within a short time interval, impossible time travel, and belonging to a TOR anonymity network.
Moderate:
For unusual user activity—Report on unknown location, or both unknown location and service to classify an anomaly.
For anomalous compute provisioning activity—Reports on medium and higher severity alerts.
Aggressive:
For unusual user activity—Reports on either unknown location or service, or both to classify an anomaly.
For account hijacking—Reports on unknown browser and Operating System, impossible time travel, or both.
For anomalous compute provisioning activity—Reports on low and higher severity alerts.
Set the
Alert Disposition
to
Conservative
to reduce false positives.
When a Prisma Cloud administrator modifies the
Alert Disposition
or
Training Model Thresholds
for detecting anomalies that relate to UEBA, existing alerts associated with UEBA policies will no longer be resolved, but instead, remain as-is. Additionally, an audit log is generated to record who made the configuration change and when, to help you track and monitor changes.
For unusual network activity.
For anomalies policies that help you detect network incidents, such as unusual protocols or port used to access a server on your network, you can customize the following for each policy.
Select
Settings
Anomaly Settings
Alerts and Thresholds
.
Select a policy.

Define the
Training Model Threshold
.
The Training Model Threshold informs Prisma Cloud on the values to use for various parameters such as number of days and packets for creating the ML models. These thresholds are available only for the policies that require model building such as Unusual server port activity and Spambot activity.
Low: The behavioral models are based on observing at least 10K packets over 7 days.
Medium: The behavioral models are based on observing at least 100k packets over 14 days.
High: The behavioral models are based on observing at least 1M packets over 28 days.
Define your
Alert Disposition
.
Alert Disposition is your preference on when you want to be notified of an alert, based on the severity of the issue —low, medium, high. The alert severity is based on the severity associated with the policy that triggers an alert. You can choose from three dispositions based on the number of ports, hosts or the volume of traffic generated to a port or host on a resource:
Aggressive: Reports High, Medium, and Low severity alerts.
For example, a Spambot policy that sees 250MB traffic to a resource, or a port sweep policy that scans 10 hosts.
Moderate: Reports High and Medium severity alerts.
For example, a Spambot policy that sees 500MB traffic to a resource, or a port sweep policy that scans 25 hosts.
Conservative: Reports on High severity alerts only.
For example, a Spambot policy that sees 1GB traffic to a resource, or a port sweep policy that scans 40 hosts.
For unusual usage of workload credentials.
For anomalies policies that help you detect when a credential that has been assigned to a compute resource, such as an EC2 instance, is used from inside the cloud service provider.
Select
Settings
Anomaly Settings
Alerts and Thresholds
Identity
.
Select a policy.

Define your
Alert Disposition
.
Alert Disposition is your preference on when you want to be notified of an alert. For unusual usage of workload credentials policies, this only applies when the suspicious IPs are inside the cloud because the policy is more prone to false positives when the suspicious IPs are inside the cloud provider’s IP space. When the suspicious IPs are outside the cloud provider’s IP space, alerts are always generated irrespective of the alert disposition setting.
Aggressive: Alerts are generated only when the suspicious IP is inside the cloud and it resides within or outside the monitored cloud accounts.
Moderate: Alerts are generated only when the suspicious IP is inside the cloud and it is a private IPv4 or it is outside the monitored cloud accounts.
Conservative: Alerts are generated only when the suspicious IP is inside the cloud but outside of the monitored cloud accounts.