Skip to content

Commit 90f4604

Browse files
authored
Updates (#635)
Update manage_compliance.adoc * Address customer feedback Update scan_ibm_cloud_container_registry.adoc * Add the correct path and followed up with the PM on some other 404s and syntax updates required for the registry and namespace Update runtime_defense_containers.adoc * Fix typos
1 parent 492707d commit 90f4604

File tree

3 files changed

+13
-16
lines changed

3 files changed

+13
-16
lines changed

admin_guide/compliance/manage_compliance.adoc

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
== Manage compliance
1+
== Enforce compliance checks
22

33
Prisma Cloud can monitor and enforce compliance settings across your environment.
44
Out of the box, Prisma Cloud supports hundreds of discrete checks that cover images, containers, hosts, clusters, and clouds.

admin_guide/runtime_defense/runtime_defense_containers.adoc

Lines changed: 11 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -1,28 +1,25 @@
11
== Runtime defense for containers
22

3-
Runtime defense is the set of features that provide both predictive and threat based active protection for running containers.
3+
Runtime defense is the set of features that provide both predictive and threat-based active protection for running containers.
44
For example, predictive protection includes capabilities like determining when a container runs a process not included in the origin image or creates an unexpected network socket.
5-
Threat based protection includes capabilities like detecting when malware is added to a container or when a container connects to a botnet.
5+
Threat-based protection includes capabilities like detecting when malware is added to a container or when a container connects to a botnet.
66

7-
Prisma Cloud introduced runtime defense all the way back in our 1.1 release.
8-
In releases since then, we’ve continuously added to the feature set.
9-
This article describes the current architecture.
107

11-
Prisma Cloud has distinct sensors for file system, network, and process activity.
8+
Prisma Cloud Compute has distinct sensors for file system, network, and process activity.
129
Each sensor is implemented individually, with its own set of rules and alerting.
13-
The runtime defense architecture is unified to both simplify the admin experience and to show more detail about what Prisma Cloud automatically learns from each image.
10+
The runtime defense architecture is unified to both simplify the administrator experience and to show more detail about what Prisma Cloud automatically learns from each image.
1411
Runtime defense has two principle object types: models and rules.
1512

1613

1714
=== Container Models
1815

1916
Models are the results of the autonomous learning that Prisma Cloud performs every time we see a new image in an environment.
20-
A model is the ‘allow list’ for what a given image should be doing, across all runtime sensors.
17+
A model is the ‘allow list’ for what a given container image should be doing, across all runtime sensors.
2118
Models are automatically created and maintained by Prisma Cloud and provide an easy way for administrators to view and understand what Prisma Cloud has learned about their images.
2219
For example, a model for an Apache image would detail the specific processes that should run within containers derived from the image and what network sockets should be exposed.
2320

2421
Navigate to *Monitor > Runtime > Container Models*.
25-
Click on the image to view it’s model.
22+
Click on the image to view the model.
2623

2724
There is a 1:1 relationship between models and images; every image has a model and every model applies to a single unique image.
2825
For each image, a unique model is created and mapped to the image digest.
@@ -96,9 +93,9 @@ This automatic switching only happens during the first 24 hours of model initiat
9693

9794
=== Archived mode
9895

99-
Archived mode is a phase that models are transitioned into after no containers are actively running them.
100-
Models persist in archived mode for 24 hours after being archived, after which point they’re automatically removed by an internally managed garbage collection process.
101-
Archived mode essentially acts a 'recycle bin' for models, ensuring that a given image does not need go through learning mode again if it frequently starts and stops while also ensuring that the list of models does not continuously grow over time.
96+
Archived mode is a phase that models are transitioned into when a container is no longer actively running them.
97+
Models persist in archived mode for 24 hours after being archived, after which point they’re automatically removed.
98+
Archived mode serves as a 'recycle bin' for models, ensuring that a given image does not need go through learning mode again if it frequently starts and stops while also ensuring that the list of models does not continuously grow over time.
10299

103100
Models display all the learned data across each of the runtime sensors to make it easy to understand exactly what Prisma Cloud has learned about an image and how it will protect it.
104101
However, what if you need to customize the protection for a given image, set of images, or containers?
@@ -131,8 +128,8 @@ By default, Prisma Cloud has a single rule that says 'use the models'.
131128
As with every other subsystem in Prisma Cloud, you can customize how it works by creating rules, scoping the rules to the desired objects with filtering and pattern matching, and then xref:../configure/rule_ordering_pattern_matching.adoc[properly ordering the rules] in the policy.
132129
Rules are evaluated sequentially from top to bottom.
133130
Once a match is found for the scope, the actions in the rule are executed and enforced.
134-
Only a single rule is ever enforced for a given event
135-
While rules are combined with models as described above, rules themselves are never combined.
131+
Only a single rule is ever enforced for a given event.
132+
While rules work in conjunction with models as described above, rules themselves are never combined.
136133

137134
Prisma Cloud ships with a rule named *Default - alert on suspicious runtime behavior* that enables runtime protection for containers by default.
138135
You can further refine your policy by creating additional custom rules that target specific resources, enable or disable protection features, and define exceptions to the automatically generated allow-list models.

admin_guide/vulnerability_management/registry_scanning/scan_ibm_cloud_container_registry.adoc

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -31,7 +31,7 @@ See the IBM Cloud Docs to learn how to create a service ID for Prisma Cloud, and
3131

3232
.. Click *Save*.
3333

34-
. Go to *Defend > Vulnerabilities > Registry*.
34+
. Go to *Defend > Vulnerabilities > Images > Registry settings*.
3535

3636
. Click *Add registry*.
3737

0 commit comments

Comments
 (0)