Using Prisma Cloud RT Ticket Information

Understanding Cloud Security Alerts

Starting Nov. 1st 2023, Information Security office will start sending out alerts for vulnerabilities, policy violations, and intrusion detection events in bCloud discovered using Prisma Cloud. Below is a discussion of the email contents.

The first part of the email will tell you if the issue is a vulnerability or a potential sign of a compromise/malicious activity. Because campus policies have been developed to address the potential for exploitation, they are included in the category of vulnerabilities.

After a discussion of the need to notify ISO in the case of an incident involving notice triggering information, the email will include a section containing one or more alerts about the issues discovered. Below you will three different example alerts that someone may receive in an RT ticket and descriptions/discussions for each one. Then there will steps security contacts can use to further investigate the alerts.

Potential Policy Alert:

The alert N-182602, is for an EC2 instance that does not restrict Internet access. This may or may not be a policy violation. By policy, access to systems should be limited to the fewest number of systems possible using network firewalls. In some cases, such as public websites, it is appropriate to allow unrestricted access to a specific port, however other ports, or entire systems should not be exposed. In this case there was neither any port scanning nor was were there vulnerabilities in the EC2 instance. As a result, this alert remained at the high severity level. In particular, this alert is a vulnerability, but it would also fall under the MSSEI restrictions if the host had P2 or above data.

Note that the alert has recommended actions for the cloud admin to take. These include:

• Reviewing how access is allowed from the internet
• Identifying where restrictions can be applied
• Restricting traffic or placing the system on a non public network

Vulnerability Alert:

Alert P-164 is one is another vulnerability message, however this time the issue is that a storage bucket has been made available to the internet. Unless there is a business need for the resource to be publicly available, the permissions should be changed to restrict access.

For alerts like this, if there is sensitive or notice triggering data in this environment, the Information Security office should be made aware of the situation immediately.

Besides the Recommendation section which has a step by step guide to changing the permissions, this alert also has a command line interface (CLI) option. To change the permissions without using the GCP portal, someone with the appropriate permissions can run `gsutil iam ch -d allUsers gs://${resourceName}`. Further, there is a description of what the CLI option does and it includes the permissions required to run the command. In this case the permissions are 'storage.buckets.getIamPolicy' and 'storage.buckets.setIamPolicy.'

Possible Compromise Alert:

Finally, alert A-20255, is for an IDS style alert for an Azure compute node. It is based of network activity that is seen targeting a server running in Azure. In this case what would normally be seen a low severity issue (the reconnaissance scanning) is escalated to critical, because a patch management tool on the host which feeds into Prisma had detected that it was running some out of date software, and the network restrictions did not prevent access to the VM.

This does not necessarily mean that the scanning was for the vulnerability or the vulnerability was exploited, but it should be reviewed for issues. The recommendations section for this alert, includes:

• Trying to restrict access to the compute node from the internet.
• Reviewing the exposure to see if it is necessary to the needs of the project.
• Reviewing the vulnerability to determine if there is a significant risk
• Applying any patches, workarounds, or mitigations necessary to deal with the vulnerability.

How to Further Investigate Alerts

In all of the alerts above there is a "Prisma URL" line. To get more information on what was detected and generated an alert, an admin with access can use that URL to see more information. After going to that URL, the steps are as follows:

1. Click on the Alert Count for that Alert ID.

   

2. On the Screen for that specific alert, you can then click on the Alert ID. (Note: this section also has a tab for recommendation which should contain the same information as was sent in the RT ticket).

   

3. This will open up a section specific to that alert. The overview section will show the severity, finding types, Alert ID, detection time, and status. Additionally, it has a link to see the resource in the native cloud environment.

   

4. Click on the Evidence tab. You can choose to see the evidence in either Graph or Table form.