You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: README.md
+3-1Lines changed: 3 additions & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -78,10 +78,11 @@ endif::prisma_cloud[]
78
78
79
79
# Building the site locally
80
80
81
-
The site uses a [RedHat fork of Asciidoctor](https://github.com/redhataccess/ascii_binder) in conjunction with our own package `ascii_binder_pan-0.0.00.1.gem`, located at the root of this repo.
81
+
The site uses a Red Hat project called [AsciiBinder](https://github.com/redhataccess/ascii_binder) in conjunction with our own package `ascii_binder_pan-0.0.00.1.gem`, located at the root of this repo.
82
82
83
83
As you create and edit content, we recommend making a local build to check the rendering.
84
84
To do so, complete the following steps.
85
+
Instructions are geared for macOS.
85
86
86
87
1. Ensure that Ruby is installed.
87
88
@@ -124,6 +125,7 @@ To do so, complete the following steps.
124
125
1. Navigate into the `_build` directory and use the following command to install our custom `ascii_binder` package.
Copy file name to clipboardExpand all lines: admin_guide/alerts/jira.adoc
+2Lines changed: 2 additions & 0 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -79,6 +79,8 @@ Configure the channel.
79
79
.. Select *Basic authentication*.
80
80
81
81
.. Enter a username and password.
82
+
+
83
+
NOTE: If you are using Jira Cloud, this will be an email address and API token respectively. You can generate your API token https://id.atlassian.com/manage-profile/security/api-tokens[here].
Copy file name to clipboardExpand all lines: admin_guide/technology_overviews/defender_architecture.adoc
+14-3Lines changed: 14 additions & 3 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -2,7 +2,6 @@
2
2
3
3
Customers often ask how Prisma Cloud Defender really works under the covers. Prisma Cloud leverages Docker's ability to grant advanced kernel capabilities to enable Defender to protect your whole stack, while being completely containerized and utilizing a least privilege security design.
4
4
5
-
6
5
=== Defender design
7
6
8
7
Because we’ve built Prisma Cloud expressly for cloud native stacks, the architecture of our agent (what we call Defender) is quite different. Rather than having to install a kernel module, or modify the host OS at all, Defender instead runs as a Docker container and takes only those specific system privileges required for it to perform its job. It does not run as --privileged and instead takes the specific system capabilities of net_admin, sys_admin, sys_ptrace, audit_control, mknod, and setfcap that it needs to run in the host namespace and interact with both it and other containers running on the system. You can see this clearly by inspecting the Defender container:
@@ -36,7 +35,6 @@ Critically, though, Defender runs as a user mode process. If Defender were to f
36
35
37
36
In the event of a communications failure with Console, Defender continues running and enforcing the active policy that was last pushed by the management point. Events that would be pushed back to Console are cached locally until it is once again reachable.
38
37
39
-
40
38
=== Why not a kernel module?
41
39
42
40
Given the broad range of security protection Prisma Cloud provides, not just for containers, but also for the hosts they run on, you might assume that we use a kernel module - with all the associated baggage that goes along with that. However, that’s not actually how Prisma Cloud works.
@@ -45,6 +43,20 @@ Kernel modules are compiled software components that can be inserted into the ke
45
43
46
44
Because kernel modules have unrestricted system access, a security flaw in them is a system wide exposure. A single unchecked buffer or other error in such a low level component can lead to the complete compromise of an otherwise well designed and hardened system. Further, kernel modules can introduce significant stability risks to a system. Again, because of their wide access, a poorly performing kernel module that’s frequently called can drag down performance of the entire host, consume excessive resources, and lead to kernel panics. For these reasons, many modern operating systems designed for cloud native apps, like Google Container-Optimized OS, explicitly prevent the usage of kernel modules.
47
45
46
+
=== Defender-Console communication
47
+
48
+
By default, Defender establishes a connection to Console on TCP port 8084, although the port number can be customized to meet the needs of your environment.
49
+
All traffic between Defender and Console is TLS encrypted.
50
+
51
+
Defender has no privileged access to Console or the underlying host where Console is installed.
52
+
By design, Console and Defender don't trust each other and Defender mutual certificate-based authentication is required to connect.
53
+
Pre-auth, connections are blocked
54
+
Post-auth, Defender's capabilities are limited to getting policies from Console and sending event data to Console.
55
+
56
+
If Defender were to be compromised, the risk would be local to the system where it is deployed, the privilege it has on the local system, and the possibility of it sending garbage data to Console.
57
+
Console communication channels are separated, with no ability to jump channels.
58
+
Defender has no ability to interact with Console beyond port 8084.
59
+
Both Console's API and web interfaces, served on port 8083 (HTTPS), require authentication via different channels (such as user name and password, access key, etc.), none of which Defender holds.
48
60
49
61
[#_blocking_rules]
50
62
=== Blocking rules
@@ -70,7 +82,6 @@ When starting a container in a Prisma Cloud-protected environment:
70
82
The last step guarantees that Defender always fails open, which is important for the resiliency of your environment.
71
83
Even if the Defender process terminates, becomes unresponsive, or cannot be restarted, a failed Defender will not hinder deployments or the normal operation of a node.
Copy file name to clipboardExpand all lines: admin_guide/upgrade/upgrade.adoc
+4-3Lines changed: 4 additions & 3 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -3,10 +3,11 @@
3
3
ifdef::compute_edition[]
4
4
Console notifies you when new versions of Prisma Cloud are available.
5
5
You can upgrade Prisma Cloud without losing any of your data or configurations.
6
-
After upgrading Console, all your deployed Defenders will automatically upgrade themselves.
6
+
After upgrading Console, all your deployed Defenders will automatically upgrade themselves if you have auto-upgrade turned ON.
7
+
Learn more about the upgrade process here: xref:../upgrade_process.adoc
7
8
endif::compute_edition[]
8
9
9
10
ifdef::prisma_cloud[]
10
-
Palo Alto Networks periodically upgrades your Prisma Cloud Console.
11
-
After a Console upgrade, all your deployed Defenders will automatically upgrade themselves.
11
+
Palo Alto Networks manages and maintains your Prisma Cloud Console.
12
+
For email notifications about Prisma Cloud Compute's maintenance schedules and upgrade notifications, subscribe to the Prisma Cloud service on the https://status.paloaltonetworks.com/[Palo Alto Networks status page].
0 commit comments