Vulnerability Response Integration with Palo Alto Networks Prisma Cloud Compute integration
Summarize
Summary of Vulnerability Response Integration with Palo Alto Networks Prisma Cloud Compute Integration
The Vulnerability Response Integration with Palo Alto Networks Prisma Cloud Compute enables ServiceNow customers to import and manage vulnerability data from container images and running hosts scanned by Prisma Cloud Compute. This integration supports both SaaS and on-premises Prisma deployments and requires a MID Server when the ServiceNow instance and Prisma environment are not co-located. It helps customers detect, prioritize, and remediate vulnerabilities within their container environments through the Container Vulnerability Response application.
Show less
Key Features
- Container and Host Vulnerability Import: Starting with Vulnerability Response versions 16.1 and 23.0, the integration imports container image vulnerabilities and running host vulnerabilities respectively, enabling comprehensive vulnerability tracking.
- Scheduled Integrations: Multiple integrations run daily or on-demand to retrieve base image vulnerabilities, container vulnerabilities, container counts, and registry scan findings.
- Base Image Configuration: Customers can configure base images within Prisma registries; vulnerabilities in these base images are tracked distinctly to highlight inherited risks.
- Granularity Configuration: The integration allows customization of vulnerability item granularity by combining keys such as image repository, image, vulnerability, cluster, namespace, and data source (scanner or Discovery). This enables tailored vulnerability tracking aligned with organizational needs.
- NVD Synchronization and Customization: The integration checks for existing CVEs in the National Vulnerability Database (NVD) and creates placeholder records when missing. Customers can configure the system to update these placeholders and specify additional Prisma-derived fields to populate in the NVD entries, supporting enhanced vulnerability context.
Practical Considerations for ServiceNow Customers
- Installation and Configuration: The integration requires installation as a separate subscription application and proper configuration to connect Prisma Cloud Compute with Vulnerability Response.
- MID Server Requirement: When Prisma Cloud Compute and the ServiceNow AI Platform instance operate in different environments, a MID Server is mandatory to enable API communication.
- Data Utilization: Imported vulnerability data can be viewed and managed on Vulnerability Response dashboards, facilitating prioritization and remediation workflows for Docker images and hosts.
- Integration Visibility: Customers can review and manage the various scheduled and on-demand integrations through the Prisma Cloud Compute Integration module in ServiceNow.
Expected Outcomes
By implementing this integration, ServiceNow customers gain automated, continuous synchronization of container and host vulnerability data from Prisma Cloud Compute. This enables improved visibility into security risks, streamlined vulnerability management processes, and more effective prioritization and remediation of vulnerabilities in containerized environments.
The Prisma Cloud Compute integration enables you to scan container images to detect vulnerabilities.
Starting with version 23.0 of the Vulnerability Response, you can use the Vulnerability Response Integration with Palo Alto Networks Prisma Cloud Compute in the Container Vulnerability Response application to import vulnerabilities on the running hosts. The Prisma Host APIs enable retrieval of comprehensive vulnerability information for a specific host and also provides a snapshot of the host vulnerabilities at a specific time. This API enables regular synchronization between Prisma and ServiceNow instance. As Prisma is offered both as software as a service (SaaS) and on-prem solution, using a MID Server is necessary to invoke Prisma APIs from the ServiceNow instance.
Starting with version 16.1 of the Vulnerability Response, you can use the Vulnerability Response Integration with Palo Alto Networks Prisma Cloud Compute in the Container Vulnerability Response application to import container image vulnerability data for deployed containers. You can then view reports on vulnerabilities and vulnerable items on the Vulnerability Response dashboards. These vulnerabilities can then be prioritized and remediated.
If the Vulnerability Response Integration with Palo Alto Networks Prisma Cloud Compute product and your ServiceNow AI Platform instance aren’t in the same environment, you’re required to use a MID Server. For more information, see MID Server system requirements.
Viewing the integrations
You can view the integrations that are part of the Vulnerability Response Integration with Palo Alto Networks Prisma Cloud Compute. To view the integrations, navigate to .
The following integrations are available.
| Run Sequence | Schedule | Integration | Description |
|---|---|---|---|
| 1 | Daily | Prisma Cloud Compute Base Images Integration | Retrieves the vulnerabilities for base images from the Prisma API and reports the base images vulnerabilities separately. It also creates image findings and vulnerable items, which point to the base images. |
| 2 | Daily | Prisma Cloud Compute Vulnerabilities Integration | Retrieves container vulnerabilities. Creates findings and container vulnerable items (CVITs) and discovered container images. |
| 3 | On Demand | Prisma Cloud Compute Container Counts Integration | Retrieves container counts for each non base image. |
| 4 | Daily | Prisma Cloud Compute Registry Integration | Retrieves static image findings obtained from the Prisma registry scan and ingests into Container Vulnerability Response. |
Base image configuration in Prisma
In the Prisma console, you can configure the registry and then configure the base images from those registries. If a vulnerability is present in the base image, then when you run the Prisma Cloud Compute Base Images Integration, the Base image check box is selected indicating the vulnerabilities are present in the base image.
Configure CVR-based VI granularity
To configure the granularity of CVITs, navigate to and specify the key combinations. By default, a CVIT is created for a combination of image repository, image, and vulnerability. You can add additional components to the key for further granularity. For example, you can create a CVIT for a combination of image repository, image, vulnerability, and cluster.
Starting with v2.12.1 of Container Vulnerability Response, you can also configure the granularity of container vulnerable items (CVITs) using Registry information and data sources. The namespace and cluster information is received from both scanner
and Discovery. If you want this information only from Discovery, you can select Discovery Information from the Data Source field. Depending on the chosen data source, you can view either image or Kubernetes information related to a CVIT record.
If Scanner information is selected, the CVIT record shows Image clusters and Image namespace fields.
If Discovery Information is selected, the CVIT record shows Kubernetes clusters and Kubernetes namespace fields.
Prisma integration process
When the Vulnerability Response Integration with Palo Alto Networks Prisma Cloud Compute is run, it checks if a Common Vulnerability and Exposure (CVE) exists in the National Vulnerability Database (NVD) table. If it’s already present, the existing information is used. However, if the CVE isn’t found, placeholder records are generated in the NVD table. When creating these placeholder NVD records, initially only the CVE and its name are populated. Other details aren’t populated with the assumption that the NVD integration fills in these details later. If the integration instance parameter update_nvd is set to true, it updates the placeholder NVD records. By default, the instance parameter is set to false. However, atleast until the NVD integration runs and populates these details, some understanding of the CVE, such as its severity or other details about the issue is needed. To meet this requirement, the fields Exploit exists and Remediation notes are populated with the details obtained from Prisma. Additionally, this configuration is made customizable, enabling you to specify any other fields you want to populate in the NVD entry based on the information provided by Prisma.