Vulnerability Response Integration with Palo Alto Networks Prisma Cloud Compute integration

  • Release version: Xanadu
  • Updated August 1, 2024
  • 2 minutes to read
    • Summarize
    Summarized using AI
    This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete.

    Summary of Vulnerability Response Integration with Palo Alto Networks Prisma Cloud Compute

    The Vulnerability Response Integration with Palo Alto Networks Prisma Cloud Compute allows ServiceNow customers to scan hosts for vulnerabilities, import vulnerability data, and prioritize remediation. This integration requires version 24.02.0 or later of the Vulnerability Response and utilizes Prisma Host APIs for comprehensive vulnerability information and regular synchronization with the ServiceNow instance.

    Show full answer Show less

    Key Features

    • Vulnerability Scanning: Detect vulnerabilities on running hosts and import this data into ServiceNow.
    • Prisma Host APIs: Enable retrieval of detailed vulnerability information and host snapshots.
    • MID Server Requirement: Necessary for invoking Prisma APIs, especially if the ServiceNow AI Platform and Prisma integration are in different environments.
    • Integration Dashboards: View reports on vulnerabilities and prioritize remediation efforts.
    • Integration Viewing: Accessible through All > Prisma Cloud Compute Integration > Integrations to view available integrations.
    • Granularity Configuration: Customize the granularity of Vulnerability Import Tickets (VITs) by specifying key combinations.
    • Placeholder Records Management: Automatically generates placeholder records in the National Vulnerability Database (NVD) for new Common Vulnerability and Exposure (CVE) entries.

    Key Outcomes

    By implementing this integration, customers will enhance their ability to monitor and manage vulnerabilities efficiently, ensuring timely remediation. The integration allows for the customization of NVD records, enabling organizations to maintain a clear understanding of vulnerability severity and remediation steps. This improves security posture and compliance with organizational policies.

    The Prisma Cloud Compute integration enables you to scan hosts to detect vulnerabilities.

    Starting with version 24.02.0 of the Vulnerability Response, you can use the Prisma Cloud Compute Integration to import vulnerabilities on the running hosts. The Prisma Host APIs enable retrieval of comprehensive vulnerability information for a specific host and also provides a snapshot of the host vulnerabilities at a specific time. This API enables regular synchronization between Prisma and ServiceNow instance. As Prisma is offered both as software as a service (SaaS) and on-prem solution, using a MID Server is necessary to invoke Prisma APIs from the ServiceNow instance. In addition, you’re required to use a MID Server if the Vulnerability Response Integration with Palo Alto Networks Prisma Cloud Compute product and your ServiceNow AI Platform instance aren’t in the same environment. For more information, see MID Server system requirements.

    You can also view reports on vulnerabilities and vulnerable items on the Vulnerability Response dashboards. These vulnerabilities can then be prioritized and remediated.

    Viewing the integrations

    You can view the integrations that are part of the Vulnerability Response Integration with Palo Alto Networks Prisma Cloud Compute. To view the integrations, navigate to All > Prisma Cloud Compute Integration > Integrations.

    The following integrations are available.

    Run Sequence Schedule Integration Description
    1 Daily Prisma Cloud Compute Hosts Integration

    Retrieves hosts vulnerabilities and creates VITs, detections, and discovered items for hosts.
    Note:
    If Container Vulnerability Response plugin is installed, you can also view Container Vulnerability Response related integrations.

    Configure CVR based VI granularity

    To configure the granularity of VITs, navigate to All > Prisma Cloud Compute Integration > Configure VI Granularity and specify the key combinations. By default, a CVIT is created for a combination of image repository, image tag, and vulnerability. You can add additional components to the key for further granularity. For example, you can create a CVIT for a combination of image repository, image tag, vulnerability, and cluster.

    Prisma integration process

    When the Vulnerability Response Integration with Palo Alto Networks Prisma Cloud Compute is run, it checks if a Common Vulnerability and Exposure (CVE) exists in the National Vulnerability Database (NVD) table. If it’s already present, the existing information is used. However, if the CVE isn’t found, placeholder records are generated in the NVD table. When creating these placeholder NVD records, initially only the CVE and its name is populated. Other details aren’t populated with the assumption that the NVD integration fills in these details later. If the integration instance parameter update_nvd is set to true, it updates the placeholder NVD records. By default, the instance parameter is set to false. However, at least until the NVD integration runs and populates these details, some understanding of the CVE, such as its severity or some basic information about the issue is needed. To meet this requirement, the fields Exploit exists and Remediation notes are populated with the details obtained from Prisma. Additionally, this configuration is made customizable, enabling you to specify any other fields you want to populate in the NVD entry based on the information provided by Prisma.