Vulnerability Response Integration with Palo Alto Networks Prisma Cloud Compute integration

  • Release version: Australia
  • Updated April 1, 2026
  • 4 minutes to read
    • Summarize
    Summarized using AI
    This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete.

    Summary of Vulnerability Response Integration with Palo Alto Networks Prisma Cloud Compute integration

    The Vulnerability Response Integration with Palo Alto Networks Prisma Cloud Compute enables ServiceNow customers to scan container images and running hosts for vulnerabilities. It imports vulnerability data into the Container Vulnerability Response application, allowing you to view, prioritize, and remediate security risks in your container environments. The integration supports both SaaS and on-prem Prisma deployments and requires a MID Server for API communication when Prisma and ServiceNow are in different environments.

    Show full answer Show less

    Key Features

    • Multiple integrations: Includes scheduled and on-demand integrations for base image vulnerabilities, container vulnerabilities, container counts, and static image findings from Prisma registry scans.
    • Data granularity configuration: Allows customization of container vulnerable item (CVIT) granularity by image repository, image, vulnerability, cluster, and other components to suit your security analysis needs.
    • Comprehensive vulnerability data: Uses Prisma Host APIs to retrieve detailed vulnerability snapshots for hosts and container images, syncing regularly with your ServiceNow instance.
    • Updated data handling: Path tracking for container images is consolidated to improve accuracy, with a shift to storing path data in the Container Image Finding table starting with specific versions.
    • Flexible data sourcing: You can select data sources (Scanner or Discovery) to determine whether CVIT records display image or Kubernetes namespace and cluster information.
    • Integration with National Vulnerability Database (NVD): Checks and creates placeholder CVE records in the NVD table, with options to update these records based on Prisma data to enrich vulnerability details like exploit existence and remediation notes.

    Preparing and Using the Integration

    • Installation: The integration is available as a separate subscription and must be installed and configured before use.
    • Configuration: Setup tasks include configuring the integration application and importing vulnerability data from Prisma Cloud Compute.
    • Scheduling and monitoring: You can view and manage available integrations via the ServiceNow interface under Prisma Cloud Compute Integration.
    • Prioritization and remediation: Imported vulnerability information is accessible via Vulnerability Response dashboards, enabling effective risk prioritization and remediation for container images and hosts.

    The Prisma Cloud Compute integration enables you to scan container images to detect vulnerabilities.

    If you intend to upgrade to Unified Security Exposure Management (USEM), please select a version starting with 30.x when installing or upgrading.

    If you do not intend to upgrade to a version compatible with Unified Security Exposure Management (USEM), please select a version below 30.x when installing or upgrading.

    You can use the Vulnerability Response Integration with Palo Alto Networks Prisma Cloud Compute in the Container Vulnerability Response application to import vulnerabilities on the running hosts. The Prisma Host APIs enable retrieval of comprehensive vulnerability information for a specific host and also provides a snapshot of the host vulnerabilities at a specific time. This API enables regular synchronization between Prisma and your ServiceNow instance. As Prisma is offered both as software as a service (SaaS) and on-prem solution, using a MID Server is necessary to invoke Prisma APIs from the ServiceNow instance.

    You can use the Vulnerability Response Integration with Palo Alto Networks Prisma Cloud Compute in the Container Vulnerability Response application to import container image vulnerability data for deployed containers. You can then view reports on vulnerabilities and vulnerable items on the Vulnerability Response dashboards. These vulnerabilities can then be prioritized and remediated.

    If the Vulnerability Response Integration with Palo Alto Networks Prisma Cloud Compute product and your ServiceNow AI Platform instance aren’t in the same environment, you’re required to use a MID Server. For more information, see MID Server system requirements.

    Viewing the integrations

    You can view the integrations that are part of the Vulnerability Response Integration with Palo Alto Networks Prisma Cloud Compute. To view the integrations, navigate to All > Prisma Cloud Compute Integration > Integrations.

    The following integrations are available.

    Run Sequence Schedule Integration Description
    1 Daily Prisma Cloud Compute Base Images Integration Retrieves the vulnerabilities for base images from the Prisma API and reports the base images vulnerabilities separately. It also creates image findings and vulnerable items, which point to the base images.
    2 Daily Prisma Cloud Compute Vulnerabilities Integration Retrieves container vulnerabilities. Creates findings and container vulnerable items (CVITs) and discovered container images.
    3 On Demand Prisma Cloud Compute Container Counts Integration Retrieves container counts for each non base image.
    4 Daily Prisma Cloud Compute Registry Integration Retrieves static image findings obtained from the Prisma registry scan and ingests into Container Vulnerability Response.

    Starting with v30.2 (USEM) and 3.6 (Core), the Path Column in the Container Image Package [sn_vul_container_image_package] table for the Vulnerability Response Integration with Palo Alto Networks Prisma Cloud Compute third-party integration is deprecated.

    Path tracking has been moved to the Path Column on the Container Image Finding [sn_vul_container_image_findings] table to support accurate and consistent path and image association. If you use these integrations you must refer to the Path column available on the Container Image Finding [sn_vul_container_image_findings] table.

    Base image configuration in Prisma

    In the Prisma console, you can configure the registry and then configure the base images from those registries. If a vulnerability is present in the base image, then when you run the Prisma Cloud Compute Base Images Integration, the Base image check box is selected indicating the vulnerabilities are present in the base image.

    Configure CVR-based VI granularity

    To configure the granularity of CVITs, navigate to All > Prisma Cloud Compute Integration > Configure CVR based VI Granularity and specify the key combinations. By default, a CVIT is created for a combination of image repository, image, and vulnerability. You can add additional components to the key for further granularity. For example, you can create a CVIT for a combination of image repository, image, vulnerability, and cluster.

    Container Vulnerability Response, you can also configure the granularity of container vulnerable items (CVITs) using Registry information and data sources. The namespace and cluster information is received from both scanner and Discovery. If you want this information only from Discovery, you can select Discovery Information from the Data Source field. Configure CVIT granularity Depending on the chosen data source, you can view either image or Kubernetes information related to a CVIT record.

    If Scanner information is selected, the CVIT record shows Image clusters and Image namespace fields.

    If Discovery Information is selected, the CVIT record shows Kubernetes clusters and Kubernetes namespace fields.

    Prisma integration process

    When the Vulnerability Response Integration with Palo Alto Networks Prisma Cloud Compute is run, it checks if a Common Vulnerability and Exposure (CVE) exists in the National Vulnerability Database (NVD) table. If it’s already present, the existing information is used. However, if the CVE isn’t found, placeholder records are generated in the NVD table. When creating these placeholder NVD records, initially only the CVE and its name are populated. Other details aren’t populated with the assumption that the NVD integration fills in these details later. If the integration instance parameter update_nvd is set to true, it updates the placeholder NVD records. By default, the instance parameter is set to false. However, atleast until the NVD integration runs and populates these details, some understanding of the CVE, such as its severity or other details about the issue is needed. To meet this requirement, the fields Exploit exists and Remediation notes are populated with the details obtained from Prisma. Additionally, this configuration is made customizable, enabling you to specify any other fields you want to populate in the NVD entry based on the information provided by Prisma.