STIGQter: STIG Summary: Palo Alto Networks Prisma Cloud Compute Security Technical Implementation Guide Version: 2 Release: 3 Benchmark Date: 01 Apr 2026:

The configuration integrity of the container platform must be ensured and runtime policies must be configured.

DISA Rule

SV-253529r960909_rule

Vulnerability Number

V-253529

Group Title

SRG-APP-000101-CTR-000205

Rule Version

CNTR-PC-000290

Severity

CAT I

CCI(s)

• CCI-000135 - Generate audit records containing the organization-defined additional information that is to be included in the audit records.
• CCI-000172 - Generate audit records for the event types defined in AU-2 c that include the audit record content defined in AU-3.
• CCI-001764 - Prevent program execution in accordance with organization-defined policies, rules of behavior, and/or access agreements regarding software program usage and restrictions; rules authorizing the terms and conditions of software program usage.
• CCI-002754 - Verify that the system behaves in a predictable and documented manner that reflects organizational and system objectives when invalid inputs are received.
• CCI-002824 - Implement organization-defined controls to protect its memory from unauthorized code execution.

Weight

10

Fix Recommendation

Enable runtime policies.

Navigate to Prisma Cloud Compute Console's Defend >> Runtime.

Click the tab to be edited.

To add policy (for Host or App-Embedded policy):
- Click "Add rule".
- Enter rule name.
Scope = All
- Accept the defaults and click "Save".

To enable policy:
- Click the rule's three-dot menu.
- Set to "Enable".

To change scope, click the rule row:
- Change the policy scope to "All".
- Click "Save".

To add container policy:
- Select the "Container policy" tab.
- Set "Enable automatic runtime learning" to "On".

To create a new runtime rule:
- Click "Add rule".
- Configure the following settings:
Enter rule name
Scope = All

Select the "Anti-malware" tab.
Set the following:
- Prisma Cloud advanced threat protection = on
- Kubernetes attacks = on
- Suspicious queries to cloud provider APIs = on

Select the "Process" tab.
Set the following:
Process monitoring = enabled

Select the "Network" tab.
Set the following:
IP connectivity = enabled

Select the "File system" tab.
Set the following:
- File system monitoring = enabled
- Accept the defaults and click "Save".

Select the "App-Embedded policy" tab.
- Click the rule's three-dot menu. Set to "Enable".
- Click the rule name row.
- Change the scope to "All".
- Click "Save".

Create a new runtime rule:
- Click "add rule."
- Enter rule name.
- Scope = All
- Accept the defaults and click "Save".

Select the "Host policy" tab.
- Click the rule's three-dot menu. Set to "Enable".
- Click the rule name row.
- Change the scope to "All".
- Click "Save".

- Click "Add rule".
- Enter rule name.
- Scope = All
- Select the "Activities" tab.
- Set the following:
Host activity monitoring ="Enabled"
Docker commands = "On"
New sessions spawned by sshd = "On"
Commands run with sudo or su = "On"
Log activity from background apps = "On"
Track SSH events = "On"
- Accept the defaults and click "Save".

Check Contents

Verify runtime policies are enabled.

Navigate to Prisma Cloud Compute Console's Defend >> Runtime.

Select "Container policy".
- If a rule does not exist, this is a finding.
- If "Enable automatic runtime learning" is set to "off", this is a finding.
- Click the three dots in the "Actions" column for the rule.
- If the policy is disabled, this is a finding.
- Click the Container runtime policy.
- If the policy is not scoped to "All", this is a finding.

Select the "App-Embedded policy" tab.
- If a rule does not exist, this is a finding.
- Click the three dots in the "Actions" column for rule "Default - alert on suspicious runtime behavior".
- If the policy is disabled, this is a finding.
- Click the "Default - alert on suspicious runtime behavior" policy row.
- If the "Default - alert on suspicious runtime behavior" policy is not scoped to "All", this is a finding.

Select the "Host policy" tab.
- If a rule does not exist, this is a finding.
- Click the three dots in the "Actions" column for the rule.
- If the policy is disabled, this is a finding.
- Click the Host runtime policy.
- If the policy is not scoped to "All", this is a finding.

Vulnerability Number

V-253529

Documentable

False

Rule Version

CNTR-PC-000290

Severity Override Guidance

Verify runtime policies are enabled.

Navigate to Prisma Cloud Compute Console's Defend >> Runtime.

Select "Container policy".
- If a rule does not exist, this is a finding.
- If "Enable automatic runtime learning" is set to "off", this is a finding.
- Click the three dots in the "Actions" column for the rule.
- If the policy is disabled, this is a finding.
- Click the Container runtime policy.
- If the policy is not scoped to "All", this is a finding.

Select the "App-Embedded policy" tab.
- If a rule does not exist, this is a finding.
- Click the three dots in the "Actions" column for rule "Default - alert on suspicious runtime behavior".
- If the policy is disabled, this is a finding.
- Click the "Default - alert on suspicious runtime behavior" policy row.
- If the "Default - alert on suspicious runtime behavior" policy is not scoped to "All", this is a finding.

Select the "Host policy" tab.
- If a rule does not exist, this is a finding.
- Click the three dots in the "Actions" column for the rule.
- If the policy is disabled, this is a finding.
- Click the Host runtime policy.
- If the policy is not scoped to "All", this is a finding.

Check Content Reference

M

Target Key

5473