What is Included with Prisma Cloud Data Security?

Azure Blob Storage and AWS S3 support for Prisma Cloud tenants in the Canada, EMEA, Singapore, and USA regions.
If you are using the Prisma Cloud tenant in Canada, Prisma Cloud Data Security will be enabled and the Data Security, Enterprise DLP, and Wildfire services will run in North America. If you have concerns regarding data sovereignty, reach out to your Prisma Cloud customer support representative.
Freemium experience that offers 3 credits per tenant, before you are charged for using the Prisma Cloud Data Security module. When your data exceeds the freemium threshold, you use credits from the Prisma Cloud Enterprise Edition license. You can apply the free 3 credits to 600GB of exposure scanning or 100GB of sensitive and malware scanning, after which the cost will be adjusted based on scan capability. For full scan, all selected data will be scanned at
5 credits/TB
for exposure, while only classifiable data and malware will be charged at
30 credits/TB
for full scan (exposure, malware, and sensitivity analysis).
The actual volume of compressed files is determined at the time of scanning.
Ability to scan all or selected storage resources when you onboard your Azure subscription account(s) and AWS account(s) on Prisma Cloud. You can choose to enable a forward or backward scan when you add the cloud account.
The default scan quota for each tenant is 1500 credits; this quota allows you to control how much data is scanned so that you can align your organizational DLP budget with the amount of data that is scanned. This 1500 credits limit is adjustable and you can open a support ticket with Prisma Cloud Customer Success to increase it and balance your costs, while also ensuring that you’re using Prisma Cloud Data Security to scan the file types that you want to secure.
Prisma Cloud Data Security needs to read objects stored on your AWS S3 buckets for scanning them. The encryption types supported are—Amazon S3 created and managed keys (SSE-S3), and AMS KMS keys that are AWS Managed or Customer Managed.If you use the AWS Key Management Service with Customer Managed Keys (CMK), when you assign the correct permissions to the Prisma Cloud IAM role, Prisma Cloud can scan files in S3 buckets that are encrypted using customer managed encryption keys.
For AWS, Prisma Cloud provides visibility, exposure, and classification of S3 buckets and objects on the new Data Dashboard, Data Inventory, and Object Explorer.
S3 objects in standard storage class only are ingested for scanning.
For malware scanning:
The uncompressed file size must be less than 100MB. For example, if the file size is more than 100MB, but was compressed to under 100MB the file will not be successfully scanned.
For data classification scanning:
The size of .avro, .csv, .json, .ORC, .parquet, and .txt files must be less than 2.5GB.
For all other Supported File Sizes and Types—Prisma Cloud Data Security file types, the uncompressed file size must be less than 20MB. For example, if the file size is more than 20MB, but was compressed to under 20MB the file will not be successfully scanned.
For ML-based classification scanning, the file size must be less than 1MB.
Prisma Cloud Data Security uses Palo Alto Networks’ Enterprise DLP and WildFire services to process and scan S3 objects for sensitive data and malware. When S3 objects are sent to Enterprise DLP for analysis, these objects are stored temporarily in Prisma Cloud’s S3 buckets for less than 24 hours, and then deleted. Additionally, the files with .avro, .ORC, and .parquet extensions are stored up to 7 days. Enterprise DLP does not retain any data after it provides a data classification verdict on your files. Files processed by WildFire follow the standard retention policy for Wildfire.
For Azure, Prisma Cloud supports the following data types and sizes:
For data classification scanning, the file size must be less than 20MB.
For malware scanning, the file size must be less than 20MB.
Exposure Evaluation for all file types.
Prisma Cloud does not provide support for .avro, .csv, .json, .ORC, .parquet, and .txt file types in Azure.
Default Data policies to detect public exposure of sensitive information. The data policies generate alerts on Prisma Cloud and you can set up notification to external integration channels supported on Prisma Cloud. In addition, you can create custom data profiles and patterns and use them in policies to scan content for your security needs.
Integration with Config RQL to show all objects in a storage resource, including exposure, data profile and malware detection in the Resource Explorer.
Alerts for Data Security policy violations can be forwarded to your integrations with Amazon SQS, Webhook, Splunk, and Azure Service Bus only.