PSE-Prisma CloudDemo

Cloud Code Security supports infrastructure-as-code scanning for both Azure Resource Manager (ARM) templates and Terraform configurations. HTML is markup rather than an infrastructure template, while GitHub is a version-control platform, not a template format.

Prisma Cloud configures trusted-image policy rules at Defend > Compliance > Trusted Images > Policy. The Monitor area provides a trusted-image status view, whereas policy rules are managed under Defend.

CIS Benchmarks are consensus-based secure-configuration recommendations that provide a general security best-practices baseline. PCI DSS, HIPAA, and GDPR instead address specific payment-card, healthcare, and privacy compliance requirements.

An Elastic IP address (EIP) is a static public IPv4 address allocated to an AWS account until it is released, and it can be reassociated with another resource.

Prisma Cloud Compute can be deployed as a self-hosted Compute Edition, where the customer operates the Compute Console in its own environment, or accessed as Compute within the Palo Alto Networks-hosted Prisma Cloud Enterprise Edition SaaS tenant. Compute Console is delivered as a container image for the self-hosted model, not as a hardware appliance or standalone Windows application.

Cloud Workload Protection (CWP) secures cloud workloads across public and private cloud environments. It combines agentless scanning for visibility and assessment with agent-based protection for runtime defense and preventive controls.

For untrusted or explicitly denied images, Alert generates an audit and raises an alert, while Block prevents the container from running. Deny is used to classify trust groups, not as the enforcement effect.

Infrastructure as code (IaC) defines and manages cloud infrastructure through machine-readable configuration and automated processes, making service creation and changes repeatable and predictable.

Prisma Cloud Asset Inventory uses Low, Medium, and High severity levels to categorize assets according to their associated policy-violation severity. Critical and Informational apply to the broader policy-severity model rather than this asset-inventory severity grouping.

Infrastructure as Code uses declarative, human-readable configuration files to describe the intended infrastructure and deploy or manage it automatically. Those representations can be versioned, reused, and consistently applied. HashiCorp Terraform documentation

The General Data Protection Regulation (GDPR) is the European Union’s data privacy regulation, and Prisma Cloud includes a GDPR compliance standard for assessing relevant cloud controls.

Prisma Cloud Compute uses twistcli images scan to scan a container image for vulnerabilities and compliance issues.

Version-pattern matching is a registry-scan scalability optimization intended for exceptionally large registries, such as those containing tens of thousands of repositories and millions of images. It is not specific to Linux or Windows images and is not necessarily beneficial for every registry size.

Auto-remediation is supported for remediable cloud-resource configuration violations, which are generated by Config policies. Prisma Cloud identifies Config as the policy type for misconfiguration checks, and its auto-remediation capability requires cloud-provider permissions that can modify the affected resource configuration.

Event queries analyze cloud audit logs and can filter operations and other activity fields, making them the appropriate RQL query type for monitoring administrator actions.

Prisma Cloud network-flow RQL uses dest.publicnetwork IN ('Internet IPs', 'Suspicious IPs') to filter traffic whose destination is one of those predefined public-network groups. Combining it with bytes > 1000000000 returns only flows exceeding 1 GB.

Prisma Cloud Compute deploys Container Defenders to Kubernetes environments such as Google Kubernetes Engine (GKE). In Kubernetes clusters, Container Defenders use a DaemonSet to ensure that a Defender runs on every node.

The Conservative Alert Disposition minimizes false positives by applying the strictest alerting threshold, so fewer lower-confidence anomalous events generate alerts.

Prisma Cloud ingests and monitors metadata for GCP cloud resources, including Cloud Storage buckets and Compute Engine instances. These resource types are therefore available for operational visibility in Asset Inventory.

Vulnerability-policy rules declare the actions to take when vulnerabilities are discovered in resources in the customer environment. Container, host, and serverless-function vulnerability policies are separate; container rules support blocking; and rules are evaluated from top to bottom until a match is found.

The --address option supplies the complete Prisma Cloud Console URL, including protocol and port. For an image scan, it is the setting that tells twistcli where to send scan data; otherwise it defaults to https://127.0.0.1:8083.

The azure-vm-list API identifies Azure virtual machines, and powerState does not contain "running" filters out all VMs in a running power state while retaining all other power states. Prisma Cloud documents does not contain as a supported RQL operator and shows it used with azure-vm-list power-state fields.

CVEs that affect the current OS release but have no vendor fix are reported as affected vulnerabilities. Prisma Cloud only suppresses such findings when a vulnerability policy explicitly enables “Apply rule only when vendor fixes are available.” CI build failure and deployed-image blocking are separate policy actions that require configured failure or block thresholds; they are not automatic consequences of medium severity. Therefore, the image is deployed successfully and its vulnerabilities are reported.

For twistcli images scan, the image or tarball must be the last parameter. Options specified after the image or tarball are ignored.