STIGQter: STIG Summary: Palo Alto Networks Prisma Cloud Compute Security Technical Implementation Guide Version: 2 Release: 3 Benchmark Date: 01 Apr 2026:

Prisma Cloud Compute Console must run as nonroot user (uid 2674).

DISA Rule

SV-253536r1051115_rule

Vulnerability Number

V-253536

Group Title

SRG-APP-000148-CTR-000345

Rule Version

CNTR-PC-000530

Severity

CAT II

CCI(s)

• CCI-000764 - Uniquely identify and authenticate organizational users and associate that unique identification with processes acting on behalf of those users.

Weight

10

Fix Recommendation

In the root directory of the extracted release tar file, modify the twistlock.cfg file's line:
RUN_CONSOLE_AS_ROOT=false

For Kubernetes deployment, perform these additional steps:

When generating the twistlock_console.yaml deployment file, supply the --run-as-user flag.

Linux/twistcli console export kubernetes --service-type ClusterIP --run-as-user 2674

Modify the resulting twistlock_console.yaml file to include fsGroup: 2674 within the Deployment pod specification's securityContext:
securityContext: fsGroup: 2674

Add runAsGroup: 2674 to the container specification's securityContext:
securityContext: runAsUser: 2674
runAsGroup: 2674

Check Contents

Locate the node in which the Prisma Cloud Compute Console container is running.

Determine the process owner for "app/server".

Execute: "ps -aux | grep "/app/server"

If the process is owned by root, this is a finding.

Vulnerability Number

V-253536

Documentable

False

Rule Version

CNTR-PC-000530

Severity Override Guidance

Locate the node in which the Prisma Cloud Compute Console container is running.

Determine the process owner for "app/server".

Execute: "ps -aux | grep "/app/server"

If the process is owned by root, this is a finding.

Check Content Reference

M

Target Key

5473