Prisma™ Cloud Release Notes
    : Features Introduced in July 2023
    Focus
    Download PDF
    Focus
    1. Home
    2. Prisma
    3. Prisma Cloud
    4. Prisma™ Cloud Release Notes
    5. Prisma™ Cloud Release Information
    6. Features Introduced in 2023
    7. Features Introduced in July 2023
    Download PDF

    Prisma™ Cloud Release Notes

    Features Introduced in July 2023

    Table of Contents

    Features Introduced in July 2023

    Learn what’s new on Prisma™ Cloud in July 2023.

    New Features

    FEATURE
    DESCRIPTION
    Integrated View of Run and Build details for Alerts
    To help you as a Cloud Security Engineer investigate issues from code to cloud, the alert details now include information to trace and attribute which build-time resource has caused a policy violation for a runtime resource deployed in your cloud account. The alert details overview includes the IaC resource details and information on the build time resource. The new Traceability information helps you connect an alert from the production environment back to the origin templates in your upstream development environment.
    To view the build-time details in an alert:
    • You must enable a Configuration policy with the subtype Run, Build and attach it to an alert rule on Prisma Cloud.
    • Your IaC templates must be onboarded through a VCS integration.
    • Terraform resources must include the
      yor_trace
       tag so that your IaC resources are tagged with a unique UUID for tracing the relationship between the code resource and the runtime resource that is deployed from it. This is not necessary for CloudFormation.
    Prisma Cloud Data Security - Asset Level Scan
    There is usually several TB or PB of data stored in your organization’s S3 buckets. In order to reduce the cost associated with the scanning of a large volume of data and to provide you with more value, Prisma Cloud Data Security now provides you the option of
    Asset Level Scan
    . When you select this option (default) while configuring a scan, Prisma Cloud randomly scans 10% of objects or maximum of 1TB (whichever is lower) and sends the data for analysis. It stops the scan as soon as it detects an object with sensitive data and triggers a 'Storage Asset with sensitive data found' policy.
    Asset Level Scan only applies when you select the Backward Scan mode and does exposure analysis and data classification and not malware scanning. It is only available when you’re configuring a data security scan for your AWS cloud accounts.

    API Ingestions

    SERVICE
    API DETAILS
    Amazon Inspector
    aws-inspector-v2-coverage
    Additional permission required:
    • inspector2:ListCoverage
    The Security Audit role includes the permission.
    Amazon Inspector
    aws-inspector-v2-finding
    Additional permission required:
    • inspector2:ListFindings
    The Security Audit role includes the permission.
    Amazon Inspector
    aws-inspector-v2-filter
    Additional permission required:
    • inspector2:ListFilters
    The Security Audit role includes the permission.
    Amazon Inspector
    aws-inspector-v2-permission
    Additional permission required:
    • inspector2:ListAccountPermissions
    The Security Audit role includes the permission.
    Azure Virtual Network
    azure-bastion-diagnostic-settings
    Additional permissions required:
    • Microsoft.Network/bastionHosts/read
    • Microsoft.Insights/DiagnosticSettings/Read
    The Reader role includes the permissions.
    Google Deployment Manager
    gcloud-deployment-manager-deployment
    Additional permissions required:
    • deploymentmanager.deployments.list
    • deploymentmanager.deployments.getIamPolicy
    The Viewer role only includes the permission 
    deploymentmanager.deployments.list
    .
    You must manually add the permission or update the Terraform template to enable 
    deploymentmanager.deployments.getIamPolicy
    Google Deployment Manager
    gcloud-deployment-manager-deployment-manifest
    Additional permissions required:
    • deploymentmanager.deployments.list
    • deploymentmanager.manifests.list
    The Viewer role only includes the permissions.
    Google Stackdriver Monitoring
    gcloud-monitoring-group
    Additional permission required:
    • monitoring.groups.list
    The Viewer role only includes the permission.
    Google Stackdriver Monitoring
    gcloud-monitoring-snooze
    Additional permission required:
    • monitoring.snoozes.list
    The Viewer role only includes the permission.
    Google Cloud Translation
    gcloud-translation-model
    Additional permissions required:
    • cloudtranslate.locations.list
    • cloudtranslate.customModels.list
    The Viewer role includes the permissions.
    Google Cloud Translation
    gcloud-translation-native-dataset
    Additional permissions required:
    • cloudtranslate.locations.list
    • cloudtranslate.datasets.list
    The Viewer role includes the permissions.
    Legacy Datasets are not ingested as part of this API.

    New Policies

    No new policies for 23.7.2.

    Policy Updates

    POLICY UPDATES
    DESCRIPTION
    Policy Updates—RQL
    AWS Secret Manager Automatic Key Rotation is not enabled
    Changes—
     The policy description and RQL are updated. The policy RQL is updated to exclude the secrets managed by owning services.
    Updated Description—
     Identifies AWS Secret Manager that are not enabled with key rotation. As a security best practice, it is important to rotate the keys periodically so that if the keys are compromised, the data in the underlying service is still secure with the new keys.
    This policy does not include secret manager which are managed by some of the AWS services that store AWS Secrets Manager secrets on your behalf.
    Policy Severity—
     Low
    Policy Type—
     Config
    Current RQL—
    config from cloud.resource where cloud.type = 'aws' AND api.name = 'aws-secretsmanager-describe-secret' AND json.rule = rotationEnabled is false
    Updated RQL—
    config from cloud.resource where cloud.type = 'aws' AND api.name = 'aws-secretsmanager-describe-secret' AND json.rule = rotationEnabled is false and owningService is not member of (appflow, databrew, datasync, directconnect, events, opsworks-cm, rds, sqlworkbench)
    Impact—
     Low. Existing alerts are resolved as
    Policy_Updated
     for secrets managed by owning services such as appflow, databrew, datasync, directconnect, events, opsworks-cm, rds, and sqlworkbench.
    AWS Elastic Load Balancer v2 (ELBv2) with listener TLS/SSL is not configured
    Changes—
     The policy RQL is updated to exclude the NLBs which are forwarding to ALB using TCP as a listener as per the AWS limitation.
    Policy Severity—
     Low
    Policy Type—
     Config
    Current RQL—
    config from cloud.resource where cloud.type = 'aws' AND api.name = 'aws-elbv2-describe-load-balancers' AND json.rule = 'state.code contains active and ((listeners[*].protocol equals HTTPS or listeners[*].protocol equals TLS) and listeners[*].certificates[*].certificateArn does not exist) or listeners[*].protocol equals HTTP or listeners[*].protocol equals TCP or listeners[*].protocol equals UDP or listeners[*].protocol equals TCP_UDP'
    Updated RQL—
    config from cloud.resource where api.name = 'aws-elbv2-describe-load-balancers' AND json.rule = state.code contains active and listeners[?any( protocol equals HTTP or protocol equals TCP or protocol equals UDP or protocol equals TCP_UDP )] exists as X; config from cloud.resource where api.name = 'aws-elbv2-target-group' AND json.rule = targetType does not equal alb and protocol exists and protocol is not member of ('TLS', 'HTTPS') as Y; filter '$.X.listeners[?any( protocol equals HTTP or protocol equals UDP or protocol equals TCP_UDP )] exists or ( $.X.listeners[*].protocol equals TCP and $.X.listeners[*].defaultActions[*].targetGroupArn contains $.Y.targetGroupArn)'; show X;
    Impact—
     Low. Alerts that are generated for NLBs which are using ALB as listener via TCP will be resolved as
    Policy_Updated
    .
    OCI Block Storage Block Volume does not have backup enabled
    Changes—
     The policy description and RQL are updated. The RQL is updated to exclude the Block volumes which are attached to volume groups.
    Updated Description—
     Identifies the OCI Block Storage Volumes that do not have backup enabled. It is recommended to have block volume backup policies on each block volume so that the block volume can be restored during data loss events.
    Note: This Policy is not applicable for block volumes that are added to volume groups.
    Policy Severity—
     Low
    Policy Type—
     Config
    Current RQL—
    config from cloud.resource where cloud.type = 'oci' AND api.name = 'oci-block-storage-volume' AND json.rule = volumeBackupPolicyAssignment[*] size equals 0
    Updated RQL—
    config from cloud.resource where cloud.type = 'oci' AND api.name = 'oci-block-storage-volume' AND json.rule = volumeBackupPolicyAssignment[*] size equals 0 and volumeGroupId equal ignore case "null"
    Impact—
     Low. Alerts that are generated for block volumes added to volume groups will be resolved as
    Policy_Updated
    .
    Policy Updates—Metadata
    AWS Route53 Hosted Zone having dangling DNS record with subdomain takeover risk
    Changes—
     The policy name and description are updated to reflect the association of this risk with S3 Buckets, providing a more accurate representation of the associated service.
    Current Policy Name—
     AWS Route53 Hosted Zone having dangling DNS record with subdomain takeover risk
    Updated Policy Name—
     AWS Route53 Hosted Zone having dangling DNS record with subdomain takeover risk associated with AWS S3 Bucket
    Updated Description—
     Identifies AWS Route53 Hosted Zones which have dangling DNS records with subdomain takeover risk associated with AWS S3 Bucket. A Route53 Hosted Zone having a CNAME entry pointing to a non-existing S3 bucket will have a risk of these dangling domain entries being taken over by an attacker by creating a similar S3 bucket in any AWS account which the attacker owns / controls. Attackers can use this domain to do phishing attacks, spread malware and other illegal activities. As a best practice, it is recommended to delete dangling DNS records entry from your AWS Route 53 hosted zones.
    Policy Severity—
     High
    Policy Type—
     Config
    Impact—
     None.

    IAM Policy Updates

    Prisma Cloud has updated the following AWS IAM out-of-the-box (OOTB) policies as follows:
    POLICY NAME
    CURRENT RQL
    UPDATED RQL
    CURRENT SEVERITY
    UPDATED SEVERITY
    AWS IAM policy allows Privilege escalation via PassRole & CloudFormation stack permissions
    config from iam where action.name CONTAINS ALL ( ‘iam:PassRole', 'cloudformation:CreateStack', 'cloudformation:DescribeStacks') AND dest.cloud.resource.name ENDS WITH '*’ and grantedby.cloud.policy.condition ('iam:PassedToService') does not exist
    config from iam where action.name CONTAINS ALL ( 'iam:PassRole', 'cloudformation:CreateStack', 'cloudformation:DescribeStacks') AND dest.cloud.wildcardscope = true and grantedby.cloud.policy.condition ('iam:PassedToService') does not exist
    High
    Medium
    AWS IAM policy allows Privilege escalation via PassRole & Lambda create Function & Event source mapping permissions
    config from iam where action.name CONTAINS ALL ( 'iam:PassRole', 'lambda:CreateEventSourceMapping', 'lambda:CreateFunction') AND  dest.cloud.resource.name ENDS WITH '*’ and grantedby.cloud.policy.condition ('iam:PassedToService') does not exist
    config from iam where action.name CONTAINS ALL ( 'iam:PassRole', 'lambda:CreateEventSourceMapping', 'lambda:CreateFunction') AND dest.cloud.wildcardscope = true and grantedby.cloud.policy.condition ('iam:PassedToService') does not exist
    High
    Medium
    Medium AWS IAM policy allows Privilege escalation via PassRole & SageMaker create training job permissions
    config from iam where action.name CONTAINS ALL ( 'iam:PassRole', 'sagemaker:CreateTrainingJob' ) AND  dest.cloud.resource.name ENDS WITH '*’ and grantedby.cloud.policy.condition ('iam:PassedToService') does not exist
    config from iam where action.name CONTAINS ALL ( 'iam:PassRole', 'sagemaker:CreateTrainingJob' ) AND dest.cloud.wildcardscope = true and grantedby.cloud.policy.condition ('iam:PassedToService') does not exist
    High
    Medium
    AWS IAM policy allows Privilege escalation via PassRole & CodeStar project permissions
    config from iam where action.name CONTAINS ALL ( 'iam:PassRole', 'codestar:CreateProject' ) AND  dest.cloud.resource.name ENDS WITH '*’ and grantedby.cloud.policy.condition ('iam:PassedToService') does not exist
    config from iam where action.name CONTAINS ALL ( 'iam:PassRole', 'codestar:CreateProject' ) AND dest.cloud.wildcardscope = true and grantedby.cloud.policy.condition ('iam:PassedToService') does not exist
    High
    Medium
    AWS IAM policy allows Privilege escalation via PassRole & Lambda create Function & add permissions
    config from iam where action.name CONTAINS ALL ( 'iam:PassRole', 'lambda:AddPermission', 'lambda:CreateFunction') AND  dest.cloud.resource.name ENDS WITH '*’ and grantedby.cloud.policy.condition ('iam:PassedToService') does not exist
    config from iam where action.name CONTAINS ALL ( 'iam:PassRole', 'lambda:AddPermission', 'lambda:CreateFunction') AND dest.cloud.wildcardscope = true and grantedby.cloud.policy.condition ('iam:PassedToService') does not exist
    High
    Medium
    AWS IAM policy allows Privilege escalation via PassRole & CodeBuild permissions
    config from iam where action.name CONTAINS ALL ( 'iam:PassRole', 'codebuild:CreateProject', 'codebuild:StartBuild', 'codebuild:StartBuildBatch') AND  dest.cloud.resource.name ENDS WITH '*’ and grantedby.cloud.policy.condition ('iam:PassedToService') does not exist
    config from iam where action.name CONTAINS ALL ( 'iam:PassRole', 'codebuild:CreateProject', 'codebuild:StartBuild', 'codebuild:StartBuildBatch') AND dest.cloud.wildcardscope = true and grantedby.cloud.policy.condition ('iam:PassedToService') does not exist
    High
    Medium
    AWS IAM policy allows Privilege escalation via PassRole & SageMaker create notebook permissions
    config from iam where action.name CONTAINS ALL ( 'iam:PassRole', 'sagemaker:CreateNotebookInstance', 'sagemaker:CreatePresignedNotebookInstanceUrl' ) AND  dest.cloud.resource.name ENDS WITH '*’ and grantedby.cloud.policy.condition ('iam:PassedToService') does not exist
    config from iam where action.name CONTAINS ALL ( 'iam:PassRole', 'sagemaker:CreateNotebookInstance', 'sagemaker:CreatePresignedNotebookInstanceUrl' ) AND dest.cloud.wildcardscope = true and grantedby.cloud.policy.condition ('iam:PassedToService') does not exist
    High
    Medium
    AWS IAM policy allows Privilege escalation via PassRole & SageMaker create processing job permissions
    config from iam where action.name CONTAINS ALL ( 'iam:PassRole', 'sagemaker:CreateProcessingJob' ) AND  dest.cloud.resource.name ENDS WITH '*’ and grantedby.cloud.policy.condition ('iam:PassedToService') does not exist
    config from iam where action.name CONTAINS ALL ( 'iam:PassRole', 'sagemaker:CreateProcessingJob' ) AND dest.cloud.wildcardscope = true and grantedby.cloud.policy.condition ('iam:PassedToService') does not exist
    High
    Medium
    AWS IAM policy allows Privilege escalation via EC2 Instance Connect permissions
    config from iam where action.name CONTAINS ALL ( 'ec2:DescribeInstances', 'ec2-instance-connect:SendSSHPublicKey', 'ec2-instance-connect:SendSerialConsoleSSHPublicKey' ) AND  dest.cloud.resource.name ENDS WITH '*’
    config from iam where action.name CONTAINS ALL ( 'ec2:DescribeInstances', 'ec2-instance-connect:SendSSHPublicKey', 'ec2-instance-connect:SendSerialConsoleSSHPublicKey' ) AND dest.cloud.wildcardscope = true
    High
    Medium
    AWS IAM policy allows Privilege escalation via PassRole & EC2 permissions
    config from iam where action.name CONTAINS ALL ( 'iam:PassRole', 'ec2:RunInstances' ) AND  dest.cloud.resource.name ENDS WITH '*’ and grantedby.cloud.policy.condition ('iam:PassedToService') does not exist
    config from iam where action.name CONTAINS ALL ( 'iam:PassRole', 'ec2:RunInstances' ) AND dest.cloud.wildcardscope = true and grantedby.cloud.policy.condition ('iam:PassedToService') does not exist
    High
    Medium
    AWS IAM policy allows Privilege escalation via PassRole & Data Pipeline permissions
    config from iam where action.name CONTAINS ALL ( 'iam:PassRole', 'datapipeline:ActivatePipeline', 'datapipeline:CreatePipeline', 'datapipeline:PutPipelineDefinition') AND  dest.cloud.resource.name ENDS WITH '*’ and grantedby.cloud.policy.condition ('iam:PassedToService') does not exist
    config from iam where action.name CONTAINS ALL ( 'iam:PassRole', 'datapipeline:ActivatePipeline', 'datapipeline:CreatePipeline', 'datapipeline:PutPipelineDefinition') AND dest.cloud.wildcardscope = true and grantedby.cloud.policy.condition ('iam:PassedToService') does not exist
    High
    Medium
    AWS IAM policy allows Privilege escalation via PassRole & Glue development endpoint permissions
    config from iam where action.name CONTAINS ALL ( 'iam:PassRole', 'glue:CreateDevEndpoint', 'glue:GetDevEndpoint') AND  dest.cloud.resource.name ENDS WITH '*’ and grantedby.cloud.policy.condition ('iam:PassedToService') does not exist
    config from iam where action.name CONTAINS ALL ( 'iam:PassRole', 'glue:CreateDevEndpoint', 'glue:GetDevEndpoint') AND dest.cloud.wildcardscope = true and grantedby.cloud.policy.condition ('iam:PassedToService') does not exist
    High
    Medium
    AWS IAM policy allows Privilege escalation via PassRole & Glue create job permissions
    config from iam where action.name CONTAINS ALL ( 'iam:PassRole', 'glue:CreateJob' ) AND  dest.cloud.resource.name ENDS WITH '*’ and grantedby.cloud.policy.condition ('iam:PassedToService') does not exist
    config from iam where action.name CONTAINS ALL ( 'iam:PassRole', 'glue:CreateJob' ) AND dest.cloud.wildcardscope = true and grantedby.cloud.policy.condition ('iam:PassedToService') does not exist
    High
    Medium
    AWS IAM policy allows Privilege escalation via PassRole & Glue update job permissions
    config from iam where action.name CONTAINS ALL ( 'iam:PassRole', 'glue:UpdateJob' ) AND  dest.cloud.resource.name ENDS WITH '*’ and grantedby.cloud.policy.condition ('iam:PassedToService') does not exist
    config from iam where action.name CONTAINS ALL ( 'iam:PassRole', 'glue:UpdateJob' ) AND dest.cloud.wildcardscope = true and grantedby.cloud.policy.condition ('iam:PassedToService') does not exist
    High
    Medium
    AWS IAM policy allows Privilege escalation via Glue Dev Endpoint permissions
    config from iam where action.name CONTAINS ALL ( 'glue:UpdateDevEndpoint', 'glue:GetDevEndpoint' ) AND  dest.cloud.resource.name ENDS WITH '*’
    config from iam where action.name CONTAINS ALL ( 'glue:UpdateDevEndpoint', 'glue:GetDevEndpoint' ) AND dest.cloud.wildcardscope = true
    High
    Medium
    AWS IAM policy allows Privilege escalation via Codestar create project and associate team member permissions
    config from iam where action.name CONTAINS ALL ( 'codestar:CreateProject', 'codestar:AssociateTeamMember' ) AND  dest.cloud.resource.name ENDS WITH '*’
    config from iam where action.name CONTAINS ALL ( 'codestar:CreateProject', 'codestar:AssociateTeamMember' ) AND dest.cloud.wildcardscope = true
    High
    Medium
    AWS IAM policy allows Privilege escalation via EC2 describe and SSM list and send command permissions
    config from iam where action.name CONTAINS ALL ( 'ec2:DescribeInstances', 'ssm:listCommands', 'ssm:listCommandInvocations', 'ssm:sendCommand') AND  dest.cloud.resource.name ENDS WITH '*’
    config from iam where action.name CONTAINS ALL ( 'ec2:DescribeInstances', 'ssm:listCommands', 'ssm:listCommandInvocations', 'ssm:sendCommand') AND dest.cloud.wildcardscope = true
    High
    Medium
    AWS IAM policy allows Privilege escalation via EC2 describe and SSM session permissions
    config from iam where action.name CONTAINS ALL ( 'ec2:DescribeInstances', 'ssm:StartSession', 'ssm:DescribeSessions', 'ssm:GetConnectionStatus', 'ssm:DescribeInstanceProperties', 'ssm:TerminateSession', 'ssm:ResumeSession' ) AND  dest.cloud.resource.name ENDS WITH '*’
    config from iam where action.name CONTAINS ALL ( 'ec2:DescribeInstances', 'ssm:StartSession', 'ssm:DescribeSessions', 'ssm:GetConnectionStatus', 'ssm:DescribeInstanceProperties', 'ssm:TerminateSession', 'ssm:ResumeSession' ) AND dest.cloud.wildcardscope = true
    High
    Medium
    AWS IAM policy allows Privilege escalation via PassRole & Lambda create & invoke Function permissions
    config from iam where action.name CONTAINS ALL ( 'iam:PassRole', 'lambda:InvokeFunction', 'lambda:CreateFunction') AND  dest.cloud.resource.name ENDS WITH '*’ and grantedby.cloud.policy.condition ('iam:PassedToService') does not exist
    config from iam where action.name CONTAINS ALL ( 'iam:PassRole', 'lambda:InvokeFunction', 'lambda:CreateFunction') AND dest.cloud.wildcardscope = true and grantedby.cloud.policy.condition ('iam:PassedToService') does not exist
    High
    Medium

    New Compliance Benchmarks and Updates

    COMPLIANCE BENCHMARK
    DESCRIPTION
    MLPS Level 3 Controls
    Prisma Cloud now supports Multi-Level Protection Scheme (MLPS) Level 3 controls. Access control, data encryption, network segmentation, intrusion detection, and incident response are among the security measures outlined in the MLPS framework. Based on the MLPS classifications, you can assess the security risks associated with your information systems and implement the appropriate controls.
    You can review this compliance standard and its associated policies on the
    Compliance > Standard
     page.

    Changes in Existing Behavior

    No changes in existing behavior for 23.7.2.

    REST API Updates

    CHANGE
    DESCRIPTION
    New API to Get Resource Snapshot
    The following new endpoint is added to get the latest resource snapshot by using the Restricted Resource Name(rrn).

    New Features

    FEATURE
    DESCRIPTION
    Support for New Regions on AWS
    Prisma Cloud now ingests data for resources deployed in the Zurich and Melbourne regions on AWS.
    To review a list of supported regions, select
    Inventory
    Assets
    , and choose Cloud Region from the filter drop-down.
    Prisma Cloud Data Security
    Support for Singapore
    Prisma Cloud Data Security is now available on the
    app.sg
     stack for all Prisma Cloud customers in Singapore. The data scans and data will remain within Singapore.
    Least Privilege Access Enforcement
    Streamline access management and promote secure and efficient permissions configuration with the least privilege access suggestions. Solve for over-privileged access issues that arise when you manage Identity Access through Groups or/and Roles rather than individual identities. You can now remediate over-permissive permissions effectively at the Group/Role level by creating new policies containing only the permissions applicable to all members. Alternatively, you can leverage existing policies by retaining only the permissions applicable to the entire Group/Role and removing any excessive permissions.

    API Ingestions

    SERVICE
    API DETAILS
    AWS CloudHSM
    aws-cloudhsm-cluster
    Additional permission required:
    • cloudhsm:DescribeClusters
    You must manually add the permission or update the CFT template to enable it.
    Amazon VPC
    aws-ec2-vpc-endpoint-service-permission
    Additional permission required:
    • ec2:DescribeVpcEndpointServicePermissions
    The Security Audit role includes the permission.
    Google Cloud Translation
    gcloud-translation-glossary
    Additional permissions required:
    • cloudtranslate.locations.list
    • cloudtranslate.glossaries.list
    The Viewer role includes the permissions.
    OCI Compute
    oci-compute-image
    Additional permissions required:
    • INSTANCE_IMAGE_INSPECT
    • INSTANCE_IMAGE_READ
    You must update the Terraform template to enable the permissions.
    Update
    OCI Compute Instance
    oci-compute-instance
    The resource JSON for this API has been updated to include a new field
    vnicIds
    .
    Additional permission required:
    • VNIC_ATTACHMENT_READ
    You must update the Terraform template to enable the permission.

    New Policies

    NEW POLICIES
    DESCRIPTION
    Azure SQL on Virtual Machine (Linux) with basic authentication
    Identifies Azure Virtual Machines that are hosted with SQL on them and have basic authentication.
    Azure Virtual Machines with basic authentication could allow attackers to brute force and gain access to SQL database hosted on it, which might lead to sensitive information leakage. It is recommended to use SSH keys for authentication to avoid brute force attacks on SQL database hosted virtual machines.
    config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-vm-list' AND json.rule = powerState equal ignore case "PowerState/running" and ['properties.storageProfile'].['imageReference'].['publisher'] equal ignore case microsoftsqlserver and (['properties.osProfile'].['linuxConfiguration'] exists and ['properties.osProfile'].['linuxConfiguration'].['disablePasswordAuthentication'] is false)
    Policy Type—
     Config
    Severity—
     Low
    AWS Route53 Hosted Zone having dangling DNS record with subdomain takeover risk
    Identifies AWS Route53 Hosted Zones which have dangling DNS records with subdomain takeover risk. A Route53 Hosted Zone having a CNAME entry pointing to a non-existing S3 bucket will have a risk of these dangling domain entries being taken over by an attacker by creating a similar S3 bucket in any AWS account which the attacker owns / controls. Attackers can use this domain to do phishing attacks, spread malware and other illegal activities. As a best practice, it is recommended to delete dangling DNS records entry from your AWS Route 53 hosted zones.
    config from cloud.resource where api.name = 'aws-route53-list-hosted-zones' AND json.rule = hostedZone.config.privateZone is false and resourceRecordSet[?any( type equals CNAME and resourceRecords[*].value contains s3-website )] exists as X; config from cloud.resource where api.name = 'aws-s3api-get-bucket-acl' as Y; filter 'not ($.X.resourceRecordSet[*].name intersects $.Y.bucketName)'; show X;
    Policy Type—
     Config
    Severity—
     High

    Policy Updates

    POLICY UPDATES
    DESCRIPTION
    Policy Updates—RQL
    AWS Application Load Balancer (ALB) is not using the latest predefined security policy
    Changes—
     The policy description and recommendation steps have been updated. The policy RQL has been updated to check for the latest security policy
    ELBSecurityPolicy-TLS13-1-2-2021-06
    Updated Description—
     Identifies Application Load Balancers (ALBs) are not using the latest predefined security policy. A security policy is a combination of protocols and ciphers. The protocol establishes a secure connection between a client and a server and ensures that all data passed between the client and your load balancer is private. A cipher is an encryption algorithm that uses encryption keys to create a coded message. So it is recommended to use the latest predefined security policy which uses only secured protocol and ciphers.
    We recommend using ELBSecurityPolicy-TLS13-1-2-2021-06 policy to meet compliance and security standards that require disabling certain TLS protocol versions or to support legacy clients that require deprecated ciphers.
    Severity—
     Low
    Policy Type—
     Config
    Current RQL—
    config from cloud.resource where cloud.type = 'aws' AND api.name = 'aws-elbv2-describe-load-balancers' AND json.rule = type equals application and listeners[?any(protocol equals HTTPS and sslPolicy exists and (sslPolicy does not contain ELBSecurityPolicy-FS-1-2-Res-2020-10 and sslPolicy does not contain ELBSecurityPolicy-TLS-1-2-Ext-2018-06))] exists
    Updated RQL—
    config from cloud.resource where cloud.type = 'aws' AND api.name = 'aws-elbv2-describe-load-balancers' AND json.rule = type equals application and listeners[?any(protocol equals HTTPS and sslPolicy exists and (sslPolicy does not contain ELBSecurityPolicy-TLS13-1-2-2021-06))] exists
    Impact—
     Medium. New alerts will be generated in case ALB is not configured to use the latest security policy. Existing alerts for resources that are already using the latest security policy are resolved as
    Policy_updated
    .
    AWS EC2 instance that is reachable from untrust internet source to ports with high risk
    Changes—
     Policy RQL is updated to check and report EC2 instance which are in active state.
    Severity—
     High
    Policy Type—
     Config
    Current RQL—
    config from network where source.network = UNTRUST_INTERNET and dest.resource.type = 'Instance' and dest.cloud.type = 'AWS' and protocol.ports in ( 'tcp/20:21', 'tcp/23', 'tcp/25', 'tcp/110', 'tcp/135', 'tcp/143', 'tcp/445', 'tcp/1433:1434', 'tcp/3000', 'tcp/3306', 'tcp/4333', 'tcp/5000', 'tcp/5432', 'tcp/5500', 'tcp/5601', 'tcp/8080', 'tcp/8088', 'tcp/8888', 'tcp/9200', 'tcp/9300' )
    Updated RQL—
    config from network where source.network = UNTRUST_INTERNET and dest.resource.type = 'Instance' and dest.cloud.type = 'AWS' and dest.resource.state = 'Active' and protocol.ports in ( 'tcp/20:21', 'tcp/23', 'tcp/25', 'tcp/110', 'tcp/135', 'tcp/143', 'tcp/445', 'tcp/1433:1434', 'tcp/3000', 'tcp/3306', 'tcp/4333', 'tcp/5000', 'tcp/5432', 'tcp/5500', 'tcp/5601', 'tcp/8080', 'tcp/8088', 'tcp/8888', 'tcp/9200', 'tcp/9300' )
    Impact—
     Low. Alerts will be resolved for EC2 instances which are in inactive state.
    Azure SQL Server ADS Vulnerability Assessment is disabled
    Changes—
     The policy description and recommendation steps have been updated. The policy RQL has been updated according to new express configuration to check if ADS vulnerability assessment is disabled.
    Updated Decsription—
     Identifies Azure SQL Server which has ADS Vulnerability Assessment setting disabled. Advanced Data Security - Vulnerability Assessment service scans SQL databases for known security vulnerabilities and highlight deviations from best practices, such as misconfigurations, excessive permissions, and unprotected sensitive data. It is recommended to enable ADS - VA service.
    Severity—
     Medium
    Policy Type—
     Config
    Current RQL—
    config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-sql-server-list' AND json.rule = vulnerabilityAssessments[*].properties.storageContainerPath does not exist
    Updated RQL—
    config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-sql-server-list' AND json.rule = vulnerabilityAssessments[*].type does not exist
    Impact—
     Medium. New alerts will be generated if vulnerability assessment is disabled. Existing alerts will be resolved are resolved as
    Policy_updated
     when
    vulnerabilityAssessments[*].properties.storageContainerPath
     does not exist.

    New Compliance Benchmarks and Updates

    COMPLIANCE BENCHMARK
    DESCRIPTION
    Otoritas Jasa Keuangan (OJK) 38/POJK.03/2016
    Prisma Cloud now supports Otoritas Jasa Keuangan (OJK) 38/POJK.03/20 regulations. The regulation provides specific guidance on the contents of the outsourcing agreement, due diligence, monitoring performance, contingency planning, audit, and information access rights.
    You can review this compliance standard and its associated policies on Prisma Cloud’s
    Compliance > Standard
     page.

    Changes in Existing Behavior

    FEATURE
    DESCRIPTION
    Access to Alerts for Deleted Assets
    This change was first announced in the Look Ahead that was published with the 23.5.2 release
    The ability to view resolved alerts for assets that have been deleted in cloud accounts onboarded to Prisma Cloud will be available for up to 90 days after asset deletion. After 90 days, these alerts will be permanently deleted from Prisma Cloud.
    This change will be in effect starting July 1, 2023. Before July 1, if you want to export all resolved alerts older than 90 days for assets that have been deleted on the cloud account, use this API endpoint https://pan.dev/prisma-cloud/api/cspm/get-alerts-v-2/ .

    REST API Updates

    No REST API updates for 23.7.1.

    Recommended For You

    © 2023 Palo Alto Networks, Inc. All rights reserved.