Palo Alto Prisma Cloud

View as Markdown

Community Platform

runZero imports cloud asset and vulnerability data from Palo Alto Prisma Cloud through the Prisma API for better visibility of your cloud assets and security posture. The supported Prisma cloud sources are AWS, Azure, and GCP.

Getting started with Prisma

To set up an integration with Prisma, you’ll need to:

  1. Create a Palo Alto Prisma Cloud credential in runZero.
  2. Choose whether to run the integration as a scan probe or connector task.
  3. Activate the integration to pull your data into runZero.

Step 1: Obtain your Prisma API credentials

  1. Follow the Prisma documentation to create a Prisma cloud user role with sufficient permissions. See the user role descriptions for more information.
  2. Obtain your Prisma Cloud API access key and secret key, which authenticate against the Prisma Cloud API. Follow the Prisma documentation to configure them properly.
  3. Identify your API URL. Palo Alto sends it in your fulfillment email. See possible URL values.

Step 2: Add the Prisma credential to runZero

  1. Go to the Credentials page in runZero. Provide a name for the credentials, like Palo Alto Networks Prisma Cloud.
  2. Choose Prisma Client Secret from the list of credential types.
  3. Create your Prisma service account from the settings page in the Prisma portal, then fill in these fields:
    • Prisma Cloud Access Key - The access key you obtained in the steps above.
    • Prisma Cloud Secret Key - The secret key you obtained in the steps above.
    • Prisma API URL - The API Endpoint URL for reaching the Prisma API.
  4. To let other organizations use this credential, select the Make this a global credential option. Otherwise, you can grant access per organization.
  5. Save the credential.

Step 3: Choose how to configure the Prisma integration

You can run the Prisma integration as either a scan probe or a connector task. A scan probe gathers integration data during scan tasks. A connector task runs on its own, from the cloud or from one of your Explorers, and performs only the integration sync.

Step 4: Set up and activate the integration to sync data

After you add your Prisma credential, sync your data from Prisma with a connector task or a scan probe.

Step 4a: Configure the Prisma integration as a connector task

A connection needs a schedule and a site. The schedule sets when the sync runs, and the site is where runZero creates any new Prisma-only assets.

  1. Activate a connection to Prisma. You can reach every available third-party connection from the integrations page, your inventory, or the tasks page.
  2. Choose the credentials you added earlier. If they are not listed, check that the credentials have access to the organization you are in.
  3. Set the Exclude importing vulnerabilities toggle to control whether vulnerability records are saved.
  4. Set the Exclude importing software toggle to control whether software records are saved.
  5. Set the Exclude assets that can not be merged into an existing asset toggle to enrich existing assets only, with no new asset records created.
  6. Set the severity and risk levels you want to import.
  7. Enter a name for the task, like Prisma Sync (optional).
  8. In the Run task with section, choose the Explorer or Explorer Group to run this connector task from (optional).
  9. Choose the site to add your assets to. runZero stores all newly discovered assets in this site.
  10. Enter a description for the task (optional).
  11. Schedule the sync to run once or on a recurring schedule. The schedule starts on the date and time you set.
  12. Activate the connection when you are done. The sync runs on the defined schedule, and the Scheduled tasks page shows when the next sync will occur.

Step 4b: Configure the Prisma integration as a scan probe

Run the Prisma integration as a scan probe to have the runZero Explorer pull your Prisma assets into the runZero Console.

In a new or existing scan configuration:

  • Set the Prisma option to Yes in the Probes and SNMP tab and change any default options as needed.
  • Set the severity and risk levels for ingested vulnerability results (optional).
  • Set the correct Prisma credential to Yes in the Credentials tab.

Step 5: View Prisma assets and vulnerabilities

After a successful sync, go to your inventory to view your Prisma assets. They show a Prisma icon in the Source column.

The integration also gathers the vulnerabilities Prisma detected. Go to Inventory > Vulnerabilities to view the vulnerability data from Prisma. To search and filter those results, use the vulnerability instance inventory keywords.

To filter to Prisma assets, run this query:

Click an asset to see its attributes. runZero shows the attributes gathered from Prisma Cloud.

Troubleshooting

If you see authentication or access errors when the integration runs, the API URL on your credential is likely incorrect. Check the fulfillment email you received from Palo Alto. It contains the correct API URL.

Updated