Overview
Prisma Cloud is an integrated security platform designed to manage the complexity and unique risks associated with cloud-native applications and infrastructure. It functions as a Cloud-Native Application Protection Platform (CNAPP) by unifying four key security domains—Cloud Security Posture Management (CSPM), Cloud Workload Protection (CWPP), Cloud Infrastructure Entitlement Management (CIEM), and Network Security—under a single management plane. The platform is architected to provide security governance across the entire application lifecycle, from the initial code development to the live runtime environment, regardless of the underlying public cloud (AWS, Azure, GCP, OCI, Alibaba Cloud) or hybrid environment.
At its core, Prisma Cloud uses a combination of agentless (API-based) and agent-based (daemon/container) security controls. The CSPM and CIEM modules rely on API polling to establish continuous visibility and governance over cloud resource configurations and identity entitlements, focusing on preventing misconfigurations and permission sprawl. In contrast, the CWPP module utilizes lightweight defenders deployed within hosts, containers, and serverless functions to provide deep protection against vulnerabilities, malware, and runtime threats. By combining these methodologies and leveraging graph-based analysis for Attack Path Modeling, Prisma Cloud aggregates and correlates security findings across the entire development-to-deployment pipeline, enabling security teams to prioritize risk based on exploitability and business impact rather than simple alert volume.
Integration Summary
Integration Type | Fetch: An inbound API integration that ingests cloud IT infrastructure assets and associated vulnerabilities from Prisma Cloud. |
Types of Assets Fetched | AWS: IAM policies, roles, SAML providers, Organizations, Secrets Manager secrets, CloudFormation stacks, CloudTrail trails, EKS clusters, Lambda functions, S3 buckets, EC2 instances, CloudFront distributions, Route53 hosted zones, DynamoDB tables. Azure: App Service, AKS clusters, Cosmos DB, Virtual Machines and Scale Sets, Key Vault, MySQL servers and Flexible Servers, Storage accounts, Service Bus queues, SQL Databases, Subscriptions. GCP: Storage buckets, IAM members and service accounts, Compute Engine instances, Cloud Functions (v1/v2), KMS crypto keys, GKE clusters, Pub/Sub topics, Secret Manager, Cloud SQL instances. |
Types of Data Fetched | Asset metadata such as asset ID, name, account or project, region, cloud type, and asset type; configuration details, tags, and console URLs. Vulnerability information including CVE ID, severity, CVSS score, description, discovery date, fix status, and risk factors. |
Prerequisites
1. Obtain Access Key ID & Secret Key
From the “Create and Manage Access Keys” documentation:
In the Prisma Cloud console, go to Settings → Access Control → Access Keys.
Click Add / Add New.
Provide a descriptive Name for the key. Optionally set an Expiry date.
After you create it, the system displays the Access Key ID and the Secret Key.
Important: you must copy/store the Secret Key immediately because it may not be displayed again.
2. Determine the Base API URL
From the “API URLs / Base API URLs” documentation:
The correct Base API URL depends on which cluster/region your tenant is deployed in. Your order-fulfilment email from Palo Alto will include the Admin Console URL for your tenant.
There’s a mapping table. Example:
Admin Console URL:
https://app.prismacloud.io
→ API URL:https://api.prismacloud.ioAdmin Console URL:
https://app.sg.prismacloud.io
→ API URL:https://api.sg.prismacloud.io
Connector Setup
Follow these steps to configure the connector:
Field Mapping
Fields from API | Balbix Fields |
Cloud Asset (GCP) | |
Get Asset API > data > externalAssetId | Asset ID (GCP Resource ID) |
Get Asset API (/uai/v1/asset) > data > name | Host Name |
Get Asset API > data > location | GCP Region |
Get Asset API > data > locationType | GCP LocationType |
Get Asset API > data >projectNumber | GCP Project ID |
Get Asset API > data > assetType | GCP Cloud Asset Type/ Native Asset Type AND Tags |
Cloud Asset (AWS) | |
Get Asset API > data > externalAssetId | Asset ID (AWS ARN) |
Get Asset API (/uai/v1/asset) > data > name | Host Name |
Get Asset API > regionId | AWS Region |
Get Asset API > accountId | AWS AccountId |
Get Asset API > assetType | AWS Cloud Asset Type/ Native Asset Type AND Tags |
CVEs: | |
finding > vulnerability > cveId | CVE ID |
finding > vulnerability > severity | CVE Severity |
finding > vulnerability > description | CVE Descriptions |
finding > vulnerability > sourceData > discovered | CVE First Observed At |
Misconfigurations& Vulnerabilities: | |
finding > vulnerability > sourceData > cve | Custom Vulnerability Name |
finding > vulnerability > severity | Custom Vulnerability Severity |
finding > vulnerability > description | Custom Vulnerability Descriptions |
finding > vulnerability > sourceData > discovered | Custom Vulnerability First Observed At |
API Documentation
https://docs.prismacloud.io/en/enterprise-edition
https://pan.dev/prisma-cloud/api/cspm/get-resource-scan-info/