Threat Detection in CSPM

Anomaly policies
:
User Entity and Behavior Analytics (UEBA)
—A set of anomaly policies for identifying deviant user activity such as a user logging on from an unknown location, successive log in attempts from distant geographical locations, or an abnormally large number of compute resources being created. You can view all the UEBA policies by applying a
Policy Type
filter for
Anomaly
in
Policies
, and typing
ueba
in the search field to view results which displays the
Policy Subtype
of
UEBA
.
Network anomaly policies
—A set of anomaly policies that continuously monitors network logs for malicious network traffic using machine learning as well as matching IPs against AutoFocus. There are network anomaly policies for detecting various threats such as Botnet, Ransomware, and Worm attacks. Prisma Cloud currently supports over forty network policies—you can view all of them by applying a
Policy Type
filter for
Anomaly
in
Policies
, and typing
network
in the search field to view the results which displays the
Policy Subtype
of
Network
.
Anomaly settings customization
—You can use the anomaly settings to control the criterion in which alerts are generated for anomaly policies. You can modify the anomaly settings to change the model training threshold, customize alert disposition, and add anomaly trusted lists to suppress alerts from trusted resources.
Alert disposition
—A method of specifying your preference for when you want to be notified of an alert—
Conservative
,
Moderate
, or
Aggressive
; these preferences are based on the severity of the issues:
Low
,
Medium
,
High
.
Conservative
generates high severity alerts,
Moderate
generates high and medium severity alerts, and
Aggressive
generates high, medium, and low severity alerts.
The criteria for determining the severity is different for each of the policies.
Anomaly training model thresholds
—A method for defining different thresholds for training the models for anomaly detection for UEBA and network anomalies. You can set the
Training Model Threshold
to
Low
,
Medium
, or
High
. These thresholds are used to determine the volume—for example, a minimum of 100 user events—and duration of data—for example, 30 days—used for training the models. Refer to Set Up Anomaly Policy Thresholds for more details on customizing your anomaly policy thresholds.
The thresholds are different for each of the policies.
Anomaly trusted list
—A method of suppressing specific resources that you do not want to generate alerts for. For example, if there are IP addresses that you are using to perform penetration testing, then you can add those IPs to a trusted list to suppress their alerts. Refer to Suppress Alerts for Prisma Cloud Anomaly Policies for details on creating an Anomaly Trusted List.

Resource Query Language (RQL) policies
:
Audit Event
—A set of RQL based policies that monitors audit events in your environment for potential policy violations. You create audit policies to flag sensitive events such as root activities or configuration changes that may potentially put your cloud environment at risk. To view all of the audit event policies available, apply a filter for
Policy Type
and select
Audit Event
. Refer to Create a Network or Audit Event Policy to learn how to create custom audit event policies.
Network Event
—A set of RQL based policies that monitor network activities in your environment. To view all of the Network policies available, apply a filter for
Policy Type
and select
Network
. Refer to Create a Network or Audit Event Policy to learn how to create custom network event policies.
Custom policies that work with 3rd party integrations
—A custom RQL based policy can be created that integrates with 3rd party services like Amazon GuardDuty or AWS Inspector for enhanced threat detection functionality. In addition, you also have the ability to clone existing RQL based policies and make modifications to them to fit your specific cloud security needs. Refer to Create a Custom Policy on Prisma Cloud for details on creating custom policies.
Prisma Cloud mapping to the MITRE ATT&CK® Enterprise IaaS Matrix
—The MITRE ATT&CK Matrix is a knowledge base of tactics, techniques, and procedures (TTPs) that bad actors could utilize in their attacks. A subset of this—the IaaS Matrix—covers cloud based tactics and techniques. Prisma Cloud has config and anomaly policies that map to the IaaS Matrix so that you can continuously monitor the security of your cloud for discovery and initial access, to impact and exfiltration objectives; this enables security teams to automatically detect various attack threats across their cloud environments. View the anomaly policies that map to these objectives of the IaaS Matrix by applying a
Policy Type
filter of
Anomaly
, and a
Compliance Standard
filter with the version of the IaaS Matrix you want to view results for like
MITRE ATT&CK v8.2
; then, in the Prisma Cloud search box enter the objectives that you want to view anomaly policies for like
discovery
or
impact
.