STIGQter: STIG Summary: Palo Alto Networks Prisma Cloud Compute Security Technical Implementation Guide Version: 2 Release: 3 Benchmark Date: 01 Apr 2026:

Prisma Cloud Compute Console must use TLS 1.2 for user interface and API access. Communication TCP ports must adhere to the Ports, Protocols, and Services Management Category Assurance Levels (PSSM CAL).

DISA Rule

SV-253522r960759_rule

Vulnerability Number

V-253522

Group Title

SRG-APP-000014-CTR-000040

Rule Version

CNTR-PC-000020

Severity

CAT I

CCI(s)

• CCI-000068 - Implement cryptographic mechanisms to protect the confidentiality of remote access sessions.
• CCI-000382 - Configure the system to prohibit or restrict the use of organization-defined prohibited or restricted functions, system ports, protocols, software, and/or services.
• CCI-000877 - Employ strong authentication in the establishment of nonlocal maintenance and diagnostic sessions.

Weight

10

Fix Recommendation

For Kubernetes deployment:

Edit the deployment.apps/twistlock-console.

Find the - name: MANAGEMENT_PORT_HTTP setting

Remove the value assignment (e.g., 8081):
- name: MANAGEMENT_PORT_HTTP
value: "8081"

Save and exit the editing session. The Console will restart automatically.

For Docker deployment:

Modify the twistlock.cfg located in the extracted release tar directory.

Remove the value assignment for the MANAGEMENT_PORT_HTTP= variable.

Redeploy the Console using the twistlock.sh script located in the extracted release tar directory.

$ sudo ./twisltock.sh -sy onebox

Check Contents

For Kubernetes deployment:

Query the ports used by the twistlock-console service:
$ kubectl describe svc twistlock-console -n twistlock

If the TargetPort management-port-http exists and has a port assignment, this is a finding.
Port: management-port-http 8081/TCP
TargetPort: 8081/TCP

For Docker deployment:

Determine the name of the Console container:
docker ps|grep console

For example, the Console container is: ad8b41a2fec9
twistlock/private:console_22_01_840

Inspect the container's PortBindings:
docker inspect ad8b41a2fec9|grep PortBindings -A 20

If port 8081 is listed, this is a finding.

Vulnerability Number

V-253522

Documentable

False

Rule Version

CNTR-PC-000020

Severity Override Guidance

For Kubernetes deployment:

Query the ports used by the twistlock-console service:
$ kubectl describe svc twistlock-console -n twistlock

If the TargetPort management-port-http exists and has a port assignment, this is a finding.
Port: management-port-http 8081/TCP
TargetPort: 8081/TCP

For Docker deployment:

Determine the name of the Console container:
docker ps|grep console

For example, the Console container is: ad8b41a2fec9
twistlock/private:console_22_01_840

Inspect the container's PortBindings:
docker inspect ad8b41a2fec9|grep PortBindings -A 20

If port 8081 is listed, this is a finding.

Check Content Reference

M

Target Key

5473