Features Introduced in April 2022
Table of Contents
Features Introduced in April 2022
Learn what’s new on Prisma™ Cloud in April 2022.
New Features Introduced in 22.4.2
New Features
FEATURE | DESCRIPTION |
Prisma Cloud Data Security—Scan Resources By True File Type | When scanning files for data security, files are now identified based on the True File Type as determined by file metadata, regardless of the file extension for all supported file types. Alerts are generated whenever a file that is scanned based on the True File Type, violates a Prisma Cloud Data Security policy. Previously, the Data Security Settings page, displayed the aggregate file size for all files supported for Sensitive Data Scan and Malware Scan based on their file extensions under their respective columns. With True File Type, the page now displays the aggregate file size for all eligible files based on their True File Type, regardless of their file extensions. Prisma Cloud Data Security still only supports files up to 20MB. While adding a data policy, if you select the File Extension checkbox, Prisma Cloud Data Security will only scan files based on True File Type, regardless of their file extensions. |
Auto Completion Updates for Amazon VPC API RQL Query | On the Investigate page, the RQL config query for aws-describe-vpc-endpoints API displays the appropriate fields under policyDocument.Statement[] during auto-completion. For example, if you want to construct the following RQL query config from cloud.resource where api.name = 'aws-describe-vpc-endpoints' AND json.rule = serviceName ends with ".s3" and policyDocument.Statement[].Condition.StringEquals.aws:PrincipalOrgID[] is not member of (o-0hc9vcq8o1, o-slnhz39n91), you can see `policyDocument.Statement[].Condition.StringEquals.aws:PrincipalOrgID[]`options appear in the list automatically. |
Change in Existing Behavior Prisma Cloud Data Security—Object Scan for Glacier Deep Archive and Glacier Flexible Retrieval Storage Classes | The feature which shows the objects that belong to Glacier Deep Archive and Glacier Flexible Retrieval (formerly Glacier) as Un-supported storage class in Inventory is disabled and objects that belong to these two storage classes will display as Not Supported . |
Update Permissions in the GCP Terraform Template | The GCP Terraform template in Monitor & Protect mode, used for onboarding GCP accounts on Prisma Cloud, now includes the following permissions to support VM image scanning
|
Update AWS CFT Permissions and API Token Duration | If you are using the Code Security module on Prisma Cloud, the AWS CFTs for onboarding commercial, Gov and China accounts have been updated to include permissions for detecting when resources that are managed using IaC templates, like Terraform or CloudFormation, are modified manually using CLI or Console. The permission updates include the addition of:And the managed policy is added.
API token duration key is also added MaxSessionDuration : 43200 ; the default was 3600 seconds previously and was not included in the CFT. |
API Ingestions | Amazon Lex aws-lexv2-bot Additional permissions required:
|
Amazon Lex aws-lex-bot Additional permissions required:
| |
Amazon DocumentDB aws-docdb-db-cluster Additional permissions required:
| |
Azure App Service azure-app-service Additional permission required:
| |
Azure Virtual Network azure-vmss-instance-public-ips Additional permissions required:
| |
Azure Virtual Network azure-vmss-network-interface Additional permissions required:
| |
Azure Virtual Desktop azure-virtual-desktop-workspace Additional permissions required:
| |
Azure Virtual Desktop azure-virtual-desktop-session-host Additional permissions required:
| |
Google Cloud Recommendation gcloud-recommender-iam-service-account-insight Additional permission required:
| |
Google Organization Policy gcloud-organization-policy-organization-constraint Additional permissions required:
| |
Google Certificate Authority Service gcloud-certificate-authority-certificate Additional permissions required:
| |
OCI Data Catalog oci-datacatalog-catalogs Additional permissions required:
| |
OCI Containers And Artifacts oci-containers-artifacts-containerrepo Additional permissions required:
| |
OCI has a limit of 50 policy statements. With the addition of the following new APIs, Prisma Cloud will have 56 policy statements in the Terraform file. To successfully ingest these new OCI APIs, you will have to request a service limit increase on the policy statements. | |
OCI Functions oci-functions-applications Additional permissions required:
| |
OCI Service Connector Hub oci-serviceconnectorhub-serviceconnectors Additional permissions required:
| |
OCI Database oci-oracledatabase-databases Additional permissions required:
| |
Update API Ingestion—Amazon EC2 | Amazon EC2 aws-ec2-describe-instances This API is updated to include the following new fields in the resource JSON when ingestPublicOwnedAMIs is set to false for a tenant:
|
New Policies and Policy Updates
See the look ahead updates for planned features and policy updates for 22.5.1.
POLICY UPDATES | DESCRIPTION |
New Policies | Instance affected by OMIGOD vulnerability is exposed to network traffic from the internet Identifies VM instances installed with Open Management Infrastructure (OMI) version vulnerable for remote code execution (CVE-2021-38647) vulnerability, also known as OMIGOD Vulnerability and exposed to network traffic from the Internet. It is recommended to upgrade OMI to the latest version and limit exposure to the Internet.
|
Azure Service bus namespace configured with overly permissive network access Identifies Azure Service bus namespaces (premium tier) configured with overly permissive network access. By default, Service bus namespaces are accessible from the Internet as long as the request comes with valid authentication and authorization. With an IP firewall, you can further restrict it to only a set of IPv4 addresses or IPv4 address ranges. With virtual networks, the network traffic path is secured on both ends. It is recommended to configure the Service bus namespace with an IP firewall or by virtual network so that the Service bus namespace is accessible only to restricted entities.
| |
GCP VPC network not configured with DNS policy with logging enabled Identifies GCP VPC network that is not configured with logging enabled DNS policy. Monitoring of Cloud DNS logs provides visibility to DNS names requested by the clients within the VPC. These logs can be monitored for anomalous domain names and evaluated against threat intelligence. It is recommended to enable DNS logging for all the VPC networks.
| |
Policy Updates—Metadata | AWS API gateway request parameter is not validated Changes— The policy description has been improvised to be more precise.Current Description— This policy identifies the AWS API gateways for with the request parameters are not validated. It is recommended to validate the request parameters in the URI, query string, and headers of an incoming request to focus on the validation efforts specific to your application.Updated Description— This policy identifies the AWS API gateways for which the request parameters are not validated. When the validation fails, API Gateway fails the request, returns a 400 error response to the caller, and publishes the validation results in CloudWatch Logs. It is recommended to perform basic validation of an API request before proceeding with the integration request to block unvalidated calls to the backend.Impact— No impact on policy behavior or existing alerts. |
GCP Kubernetes engine clusters have client certificate disabled Changes— The cloud type for this policy was incorrect after converting the policy from run-build to build. It is now updated to GCP, which is the correct cloud type.Impact— No impact on policy behavior or existing alerts. | |
Policy Updates—RQL | GCP Kubernetes Engine Clusters have Master authorized networks disabled Changes— Auto-remediation CLI has been added to the policy. The RQL has been updated to check clusters with status 'RUNNING'. The recommendation steps have also been updated to match the latest UI changes.Permission required for CLI execution:
Current RQL—
Updated RQL—
Impact— If auto-remediation is enabled for the policy, the alerts will be resolved as ‘REMEDIATED’ or ‘Resource_Updated’. Previously generated alerts with cluster state other than ‘RUNNING’ will be resolved automatically. |
REST API Updates
CHANGE | DESCRIPTION |
List User Role Types API for Permission Groups Assignments | To view the list of roles associated with administrators/users who have access to Prisma Cloud, the following new API endpoint is available:
When called, it returns an array of all roles administrators/users can belong to. It includes the following role types:
|
New Features Introduced in 22.4.1
New Features
FEATURE | DESCRIPTION |
API Ingestions | Amazon Neptune aws-neptune-db-instance Additional permissions required:
|
Amazon Neptune aws-neptune-db-cluster Additional permissions required:
| |
AWS MediaStore *aws-mediastore-container*Additional permissions required:
| |
Google Access Approval gcloud-access-approval-project-approval-setting Additional permission required:
| |
Google Essential Contacts gcloud-essential-contacts-organization-contact Additional permission required:
| |
Google Service Directory gcloud-service-directory-namespace-service Additional permissions required:
| |
OCI Bastion oci-bastion Additional permissions required:
| |
Azure App Service azure-app-service Additional permission required:
|
New Policies and Policy Updates
See the look ahead updates for planned features and policy updates for 22.4.2.
POLICY UPDATES | DESCRIPTION |
New Policies | Azure Microsoft Defender for Cloud set to Off for Containers Identifies Azure Microsoft Defender for Cloud that has defender setting for Containers set to Off. As a best practice, enable Azure Defender for Containers.
|
- | Instance affected by SpringShell vulnerability is exposed to network traffic from the internet Identifies instances installed with the Java Spring Framework version vulnerable to arbitrary code execution (CVE-2022-22963 or CVE-2022-22965) and are exposed to network traffic from the Internet. As a best practice, upgrade the Java Spring Framework version to the latest version to limit exposure to the Internet.
This policy is effective only when Prisma Compute is enabled in your environment. |
GCP Firewall rule exposes GKE clusters by allowing all traffic on read-only port (10255) Identifies GCP Firewall rule that allows all traffic on read-only port (10255), which exposes GKE clusters. In GKE, Kubelet exposes a read-only port 10255 which shows the configurations of all pods on the cluster at the /pods API endpoint. GKE itself does not expose this port to the Internet because the default project firewall configuration blocks external access. However, it is possible to inadvertently expose this port publicly on GKE clusters by creating a Google Compute Engine VPC firewall for GKE nodes that allows traffic from all source ranges on all the ports. This configuration publicly exposes all pod configurations, which might contain sensitive information.
| |
New Configuration Policies for Build-Time Checks | The following new policies are being available to scan your environments monitored by the Code Security module on Prisma Cloud.
|
New Configuration Policies for Run-Time and Build-Time Checks |
|
Policy Updates—RQL | The following policies have been deleted: Azure Microsoft Defender for Cloud is set to Off for Kubernetes Azure Microsoft Defender for Cloud is set to Off for Container Registries Changes— The two services Microsoft Defender for Kubernetes and container registries have been replaced with Microsoft Defender for Containers. The corresponding policies and compliance references have been deleted.Impact— Previously generated alerts will be resolved as Policy_Deleted. |
Azure Security Center Defender plans is set to Off Changes— The policy RQL has been updated to factor deprecated features in the query. The policy recommendation has also been updated.
Impact— Previously generated alerts will be resolved as Policy_Updated. | |
GCP VM instance with the external IP address Changes— The RQL has been updated.Current RQL—
Updated to—
Impact— No impact on existing alerts. | |
GCP GCR Container Vulnerability Scanning is disabled Changes— The RQL, recommendation steps, and API have been modified: The RQL has been updated to match the updated JSON response of the gcloud-services-list API. The recommendation steps have been updated to reflect the latest UI updates. In addition, the gcloud-services-list API has been modified and due to the ingestion change, the policy is updated to match the API change.Current RQL—
Updated to—
Impact— Previously generated alerts will be resolved as Policy_Updated. This has a low impact on alerts. | |
GCP BigQuery dataset is publicly accessible Changes— The gcloud-bigquery-dataset-list API is moved to Cloud Asset Inventory which changes the access control list to IAM binding in the JSON response. As a result of the ingestion change, the policy is modified to match the updated API response change. In addition, the recommendation steps have also been updated to reflect the latest UI updates.Current RQL—
Updated to—
Impact— No impact on existing alerts. | |
16 New Anomaly Policies that Map to MITRE ATT&CK v10.0 | There are 16 new UEBA Anomaly policies to detect user activity from the TOR anonymity network. Each policy corresponds to one of the different service groups available in AWS, Azure, and GCP—for example—analytics, containers, compute, security, storage, and web. All the policies are classified as high severity and identify defense evasion and impact attack tactics listed in the MITRE ATT&CK framework. The policies are disabled by default, but customers can manually enable them according to their security needs and the cloud services used in their environments. Here’s the list of UEBA policies:
|