Prisma Cloud

---
name: prisma-cloud
description: "Expert agent for Palo Alto Prisma Cloud / Cortex Cloud CNAPP platform. Covers CSPM, CWPP Defender agents, CIEM, DSPM, code-to-cloud pipeline security, AppDNA, and Cortex XDR convergence. WHEN: \"Prisma Cloud\", \"Cortex Cloud\", \"Prisma Cloud Defender\", \"CWPP Defender\", \"AppDNA\", \"Prisma CSPM\", \"Prisma CIEM\", \"code-to-cloud\", \"Prisma IaC\", \"Prisma runtime\", \"Palo Alto cloud security\"."
license: MIT
---

# Prisma Cloud / Cortex Cloud

This skill covers Palo Alto Networks' Prisma Cloud platform — now rebranding as Cortex Cloud — a comprehensive CNAPP solution spanning CSPM, CWPP, CIEM, DSPM, and code-to-cloud pipeline security. It has deep knowledge of the platform architecture, Defender agent deployment, policy framework, compliance management, and integration patterns.

**Rebranding Note:** Palo Alto is converging Prisma Cloud with Cortex XDR into "Cortex Cloud" — a unified security platform. Functionality is the same; the product branding is evolving. Use either name contextually.

## How to Approach Tasks

When you receive a request:

1. **Classify** the request type:
   - **Deployment/Onboarding** -- Load `references/architecture.md`; cover account onboarding and Defender deployment
   - **CSPM / Compliance** -- Cover policies, RQL queries, compliance reports, custom frameworks
   - **CWPP / Runtime** -- Cover Defender agent deployment, vulnerability management, runtime defense
   - **CIEM / Identity** -- Cover IAM analysis, net-effective permissions, identity governance
   - **Code Security** -- Cover IaC scanning, secrets detection, SCA, CI/CD integration
   - **Alert Management** -- Cover triage, suppression, alert routing, SOAR integration
   - **Cortex XDR Integration** -- Cover convergence with XDR for unified SOC workflows

2. **Identify environment** -- Which cloud providers? What deployment model (cloud-delivered SaaS vs. self-hosted)? Defender agent types needed (container, host, serverless)? CI/CD platforms?

3. **Load context** -- Read `references/architecture.md` for deep architectural knowledge when needed.

4. **Analyze** -- Apply Prisma-specific reasoning. Prisma Cloud's differentiator is the combination of deep CWPP with agent-based runtime and strong code-to-cloud coverage — not just agentless posture.

5. **Recommend** -- Provide actionable configuration, tuning, and operational guidance specific to Prisma Cloud.

## Core Capabilities

### Platform Modules

Prisma Cloud is organized into distinct modules that can be licensed independently or as a bundle:

**Cloud Security (CSPM + CIEM):**
- Configuration assessment against security benchmarks
- Identity and access analysis
- Network exposure analysis
- Compliance reporting

**Workload Security (CWPP):**
- Defender agent-based protection for hosts, containers, and serverless
- Vulnerability management
- Runtime defense and behavioral protection
- Web Application and API Security (WAAS)

**Code Security (Shift-Left):**
- IaC scanning (Terraform, CloudFormation, ARM, Helm)
- Secrets scanning in code
- SCA (Software Composition Analysis)
- CI/CD pipeline security

**Data Security (DSPM):**
- Data discovery and classification across cloud storage
- Sensitive data exposure identification
- Data governance insights

**Application Security:**
- AppDNA for application-level context
- API security discovery

### CSPM and RQL

**Resource Query Language (RQL):**
Prisma Cloud uses RQL for custom policy authoring and ad-hoc investigation. RQL is a SQL-like language for querying cloud resource configurations:

**Configuration query (CSPM):**
```
config where cloud.type = 'aws'
  AND api.name = 'aws-ec2-describe-security-groups'
  AND json.rule = 'ipPermissions[*].ipRanges[*].cidrIp contains 0.0.0.0/0
    and ipPermissions[*].fromPort <= 22 and ipPermissions[*].toPort >= 22'
```

**Network query:**
```
network where source.publicnetwork IN ( 'Internet IPs', 'Suspicious IPs' )
  AND dest.resource IN ( resource where role NOT IN ( 'AWS NAT Gateway', 'AWS ELB' ))
  AND protocol = 'TCP'
  AND dest.port IN ( 22, 3389 )
```

**Event query (audit logs):**
```
event where cloud.type = 'aws'
  AND operation IN ( 'ConsoleLogin' )
  AND json.rule = 'errorMessage exists AND errorMessage = "Failed authentication"'
```

**IAM query (CIEM):**
```
config where api.name = 'aws-iam-list-roles'
  AND json.rule = 'assumeRolePolicyDocument.Statement[*].Principal contains "*"
    and assumeRolePolicyDocument.Statement[*].Effect equals Allow'
```

**RQL operators:** `contains`, `exists`, `equals`, `is member of`, `intersects`, array access `[*]`, JSON path

### Policies and Alerts

**Policy types:**
- **Config:** Static configuration analysis (CSPM) — runs against cloud APIs
- **Network:** Network exposure and traffic analysis
- **Audit Event:** Detects activity in cloud audit logs (CloudTrail, Activity Logs)
- **Anomaly:** Machine learning-based anomaly detection (UEBA for cloud)
- **IAM:** Identity and access configuration analysis (CIEM)
- **Data:** Sensitive data exposure (DSPM)
- **Workload Vulnerability:** CVEs in running workloads (from Defender data)
- **Workload Incident:** Runtime behavioral detections (from Defender data)

**Policy severity:** Critical, High, Medium, Low, Informational

**Built-in policies:** 2,000+ built-in detection rules across all policy types

**Compliance frameworks built-in:** CIS AWS/Azure/GCP, NIST 800-53, PCI DSS, HIPAA, SOC 2, ISO 27001, GDPR, FedRAMP, CMMC, Australian IRAP, and many more

**Custom policies:** Author custom RQL queries as policies; assign to custom compliance frameworks

### Alert Workflow

**Alert lifecycle:**
1. Policy violation detected → Alert created (Open)
2. Alert triaged → Assigned to owner
3. Remediation applied in cloud → Alert auto-resolved (if enabled)
4. Manual close with reason code (false positive, risk accepted, etc.)

**Alert channels:**
- Email, Slack, PagerDuty
- Jira, ServiceNow, Webhook
- SQS, SNS for custom processing
- Microsoft Teams

**Alert filters:**
- Filter by cloud account, region, resource type, policy, severity, compliance framework
- Saved filters for team-specific views

**Suppression rules:**
- Suppress alerts for specific resources (by resource ID, tag, account)
- Time-limited suppressions with expiry
- Justification required (audit trail)
- Bulk suppression for planned exemptions

### CIEM and Identity Analysis

**Permissions analysis:**
- Calculates net-effective permissions for all IAM entities
- Evaluates: identity policies, resource policies, SCPs, permission boundaries, trust policies, conditions
- Displays: what an identity can actually do (not just what policies say)

**CIEM findings:**
- Over-privileged identities (more permissions than used in last 90 days)
- Stale credentials (access keys not used in 90+ days)
- Cross-account trust misconfigurations
- Privilege escalation paths
- Resource-based policy misconfigurations (S3 bucket policies, KMS key policies)
- Missing MFA on privileged accounts

**Identity governance:**
- Access certification workflows — periodic review of access rights
- JIT access recommendations — suggest least privilege replacement policies
- Identity timeline — audit trail of permission changes

### CWPP: Prisma Cloud Defender

The Defender is the CWPP runtime agent. Multiple Defender types exist for different workload contexts:

**Container Defender:**
- Deployed as a DaemonSet in Kubernetes
- One Defender per node
- Capabilities: vulnerability scanning of running images, runtime behavioral protection, compliance checking, access control, WAAS (WAF for containers)

**Host Defender:**
- Deployed on standalone VMs/EC2/Azure VMs
- Capabilities: vulnerability scanning (OS + packages), runtime protection, log inspection, compliance checking, file integrity monitoring

**Serverless Defender:**
- Lambda function (AWS) or Azure Function layer
- Auto-protect mode: automatically instruments functions without code changes
- Capabilities: vulnerability scanning, runtime behavioral protection for functions

**App-Embedded Defender:**
- Embedded directly in a container image via `twistcli embed`
- For environments where DaemonSet deployment is not possible (e.g., Fargate, AWS App Runner)
- Provides container-level protection without host access

**Defender communication:**
- Defenders communicate with the Prisma Cloud SaaS console over HTTPS (WebSocket + REST)
- Certificate-pinned TLS
- Defenders authenticate with one-time install token + generated client certificate
- No inbound ports required on workloads

### Vulnerability Management (CWPP)

**Scanning coverage:**
- OS packages (DEB, RPM, APK, Alpine, Windows)
- Language packages (npm, pip, gem, Maven, NuGet, Go, Rust)
- Container base images + application layers
- Binary analysis (detect libraries even without package manager metadata)

**Risk scoring:**
- CVE severity (CVSS v3)
- CISA KEV (Known Exploited Vulnerabilities) membership
- Exploit availability
- Reachability (is the vulnerable function called?) — via code analysis in CI/CD

**Vulnerability policies:**
- Define thresholds for blocking CI/CD builds (e.g., block on Critical CVEs in base image)
- Define alert and block thresholds for runtime (e.g., alert on High, block deployment of Critical)
- Grace periods: allow time to remediate before policy enforces

**Registry scanning:**
- Scan container registries on a schedule
- Supported: ECR, ACR, GCR, Docker Hub, JFrog Artifactory, Nexus, Harbor, GitLab registry

### Runtime Defense (CWPP)

Defender's runtime protection uses behavioral modeling:

**Process modeling:**
- During a "learning period" Defender observes normal process behavior
- After learning, Defender detects deviations from the learned model
- Alert or block on unknown processes spawned in a container

**Runtime rules:**
- **Processes:** Allow/deny list for processes; prevent shells in containers
- **Network:** Allow/deny outbound connections by IP/FQDN/port
- **File system:** Protect sensitive directories; detect unauthorized writes to binaries
- **System calls:** Block dangerous syscalls (e.g., ptrace) in containers

**Incident types detected:**
- Shell spawned in container
- Crypto mining (process pattern + network)
- Reverse shell (network + process)
- Port scanning from within container
- Lateral movement via SSH
- Malware binary hash matches
- Container escape attempts

**WAAS (Web Application and API Security):**
- In-line WAF capability within the Defender
- Protects HTTP/HTTPS traffic to containerized apps
- Detection: SQLi, XSS, CSRF, LFI, CMDi, OWASP Top 10
- API security: OpenAPI/Swagger spec import for API schema validation and enforcement

### Code Security (Shift-Left)

**IaC Scanning:**
- Terraform (all cloud providers), CloudFormation, ARM/Bicep, Helm charts, Kubernetes YAML, Dockerfile
- 700+ IaC security checks
- Prisma Cloud Supply Chain Graph: visualizes resource dependencies in IaC
- Drift detection: compare IaC definition with deployed infrastructure

**Secrets Scanning:**
- Detects 100+ secret types in source code (API keys, passwords, tokens, certificates)
- Entropy-based detection + pattern matching
- Supported: Python, JavaScript, TypeScript, Java, Go, Ruby, PHP, shell scripts, config files

**SCA (Software Composition Analysis):**
- Vulnerable open-source dependencies
- License compliance (GPL, LGPL, Apache, MIT, etc.)
- Reachability analysis: detect if vulnerable function is actually called in the application code

**VCS Integration:**
- GitHub, GitLab, Bitbucket, Azure DevOps
- Pull request comments with findings
- PR blocking on policy violations
- Repository scanning (full history scan)

**CI/CD Tools:**
- Jenkins, GitHub Actions, GitLab CI, CircleCI, Azure Pipelines, Bitbucket Pipelines
- `twistcli` and `checkov` (Prisma Cloud's open-source IaC scanner) for local/pipeline use
- SARIF output format for GitHub Code Scanning integration

### AppDNA

AppDNA is Prisma Cloud's application-level security context feature:
- Correlates vulnerability and runtime data with the application layer
- Identifies which application (microservice, deployment) owns a vulnerability or alert
- Provides application-level risk scores (not just resource-level)
- Enables application owners to view and own their security posture
- Groups alerts by application for efficient triage and ownership assignment

### Compliance Management

**Framework support:** 30+ built-in compliance frameworks

**Compliance reports:**
- Per-framework compliance score (percentage of controls passing)
- Per-account, per-region breakdown
- Trend over time
- Evidence export for auditors (PDF, CSV)
- Scheduled report delivery to stakeholders

**Custom frameworks:**
- Build custom compliance frameworks by mapping existing Prisma policies to controls
- Import controls from custom spreadsheets or frameworks not yet built-in
- Label existing policies with custom control IDs

**Continuous compliance monitoring:**
- Real-time compliance score updates as resources change
- SLA tracking per compliance control

### Cortex Cloud Convergence

**XDR integration:**
Prisma Cloud's CWPP runtime incidents now integrate with Cortex XDR:
- Unified incident timeline across cloud workload and endpoint
- Alert correlation between container runtime alerts and endpoint detections
- Shared threat intelligence and detections between cloud and endpoint contexts

**XSOAR integration:**
- Prisma Cloud alerts flow to Cortex XSOAR for automated playbook response
- Pre-built XSOAR content packs for Prisma Cloud alert types
- Auto-remediation playbooks for common CSPM findings

## Common Operational Tasks

### Onboarding a New Cloud Account

**AWS:**
1. Create IAM role with Prisma Cloud-required permissions (managed policy provided)
2. In Prisma Cloud console: Settings → Providers → Connect Provider → AWS
3. Enter role ARN and external ID
4. Select which modules to enable (CSPM, CWPP, DSPM)
5. Prisma Cloud validates connection and starts scanning

**Azure:**
1. Run Prisma Cloud onboarding script (PowerShell) to create App Registration + role assignments
2. In Prisma Cloud console: Connect Provider → Azure
3. Enter tenant ID, client ID, client secret
4. Select subscriptions to monitor

**Permissions required (AWS minimum for CSPM):**
- `SecurityAudit` AWS managed policy
- Additional permissions for specific services (Prisma Cloud provides exact policy document)

### Deploying Container Defender (Kubernetes)

```bash
# Download the Defender deployment YAML from Prisma Cloud console
# (Settings > Defenders > Deploy > Orchestrator: Kubernetes)

# Or use twistcli to generate
twistcli defender export kubernetes \
  --address https://us-east1.cloud.twistlock.com \
  --cluster my-cluster \
  --namespace twistlock

# Apply the DaemonSet
kubectl apply -f defender-ds.yaml

# Verify Defenders are running
kubectl get pods -n twistlock
```

### Writing an RQL Policy

```
# Step 1: Test query in Investigate tab
config where cloud.type = 'aws'
  AND api.name = 'aws-s3api-get-bucket-acl'
  AND json.rule = 'grants[*].grantee.URI contains AllUsers'

# Step 2: Create policy from query
# Policies > Add New Policy > Config
# Paste RQL query, set severity, map to compliance framework
# Save and enable
```

## Reference Files

Load these when you need deep architectural knowledge:

- `references/architecture.md` -- Prisma Cloud / Cortex Cloud architecture: CSPM data collection, CWPP Defender agent architecture, CIEM analysis engine, code-to-cloud pipeline, AppDNA, Cortex XDR convergence.
- `references/vulnerability-management.md` -- Vulnerability-management-specific angle: RQL/API examples for vuln prioritization, Bridgecrew/Checkov code security detail. Read when the user's intent is vuln scanning/prioritization rather than CSPM/CNAPP posture.