Prisma Cloud Compute Connector Guide

Summary: How to set up and use the Prisma Cloud Compute connector in Ivanti Neurons RBVM/ASPM.

Overview

Prisma Cloud - Compute delivers cloud workload protection (CWPP) for modern enterprises, providing holistic protection across hosts, containers, and serverless deployments in any cloud, throughout the application lifecycle.

The Ivanti Neurons RBVM/ASPM platform provides an API-based connector that integrates with Prisma Cloud - Compute, enabling customers to bring in their findings. It allows customers to gain visibility into their overall risk due to vulnerabilities in their endpoint and a more straightforward, more efficient way to manage those vulnerabilities.

User Prerequisites/Prisma Cloud - Compute Setup

Ivanti Neurons requires a user account with the following access to communicate with and pull data from Prisma Cloud - Compute.

• Read access to the assets and their associated issues.

• API access.

• The Ivanti Neurons integration supports the Self-Hosted/SaaS version of Prisma Cloud – Compute.

Prisma Cloud - Compute Connector API Calls

The following API calls are performed during a connector run to pull security vulnerabilities from Prisma Cloud Compute into Ivanti Neurons.

API Type	Endpoint
Authentication	/api/v1/authenticate
Get All Hosts	/api/v1/hosts
Get All Images	/api/v1/images

Configuring the Prisma Cloud - Compute Connector

Navigate to the Automate > Integrations page.

Using the search bar in the upper-right corner of the Integrations page, type Compute to find the connector.

Locate the Prisma Cloud - Compute card on the page and click Configuration. The connector is available for both Network and Application data.

Complete the required fields in the new window under Connection, as described below.

• Name: The connector’s name.

• URL: The URL to access Prisma Compute.

  • Follow these steps to retrieve the URL for the SAAS version: https://prisma.pan.dev/docs/cloud/cwpp/access-api-saas#accessing-the-api-using-basic-authentication

  • Follow these steps to retrieve the URL for the hosted version: https://prisma.pan.dev/docs/cloud/cwpp/access-api-self-hosted

• Username: The username of the instance.

• Password: The password of the instance.

• SSL: Optional instance SSL certificate in base64 format.

Click the Test Credentials button to ensure the credentials are correct and have the necessary access to make Prisma Cloud - Compute API calls.

Under Schedule, configure the desired schedule for the connector to retrieve results from the Prisma Cloud - Compute instance.

Under Connector Specific options, Users can optionally turn on Enable auto URBA (Update Remediation by Assessment).

Suppose Enable auto URBA (Update Remediation by Assessment) is turned on. In that case, we have an optional sub configuration, where the user can configure URBA to close the findings associated with assets that are no longer available. This textbox allows only whole numbers and specifies the number of consecutive uploads Ivanti Neurons must wait until the asset is no longer available. If the assets are not coming in as part of the specified consecutive uploads, then Ivanti Neurons will close the associated findings of the asset.

On marking the Create Assets that do not have vulnerabilities options, Ivanti Neurons will create assets with zero findings. This option will be selected by default, and the user can opt to turn it off.

Users can specify the type of vulnerability information from Prisma Cloud - Compute into Ivanti Neurons. The default option is All Data.

If the user clicks on Select Data, they can choose the type of asset data that needs to be pulled into Ivanti Neurons.

• Host Security: Under this, we can pull Vulnerabilities/Compliance findings.

• Image Security: Under this, we can pull Vulnerabilities/Compliance findings.

Click the Save button to save the connector’s configuration and create the connector. Once saved, the connector is visible on the Integrations page under Currently Configured Integrations.

Clicking the History button displays the connector details for each pull. The Sync button allows users to perform on-demand sync. The Edit button allows the user to edit the connector configuration. The Delete button allows the user to delete the connector.

Once files process on the Uploads page, view the ingested data by navigating to the Hosts and Host Findings pages in case of Host Security. In the case of Image Security, the data will be available on the Applications and Application Findings pages.

Mapping Prisma Cloud - Compute Fields

This table showcases the high-level mapping of Prisma Cloud - Compute API fields in Ivanti Neurons.

Section	Ivanti Neurons Field	Prisma Cloud - Compute Field (Vulnerabilities)	Prisma Cloud - Compute Field (Compliance)
Applications	Name	instances -> image	instances -> image
	Address	id	id
	Scanner Name	Prisma Cloud Compute App	Prisma Cloud Compute App
Application Findings	Scanner Plugin	vulnerabilities -> cve	complianceIssues -> id
	Scanner Reported Severity	vulnerabilities -> severity	complianceIssues ->  severity
	Location	vulnerabilities -> packageName + vulnerabilities -> packageVersion	complianceIssues -> title
	Finding Type	IMAGE	PC
	Possible solution	vulnerabilities ->status   vulnerabilities ->link	complianceIssues -> status   complianceIssues -> link
Hosts	Host Name	hostname	hostname
	IP Address	hostDevices -> ip	hostDevices -> ip
	Scanner Name	Prisma Cloud Compute Net	Prisma Cloud Compute Net
Host Findings	Scanner plugin	vulnerabilities -> cve	complianceIssues -> id
	Scanner Reported Severity	vulnerabilities -> severity	complianceIssues ->  severity
	WebApplication	Asset name
	Title	vulnerabilities -> cve vulnerabilities -> title	complianceIssues -> cve complianceIssues -> title
	Possible solution	vulnerabilities ->status vulnerabilities ->link	complianceIssues -> status complianceIssues -> link

 

Ivanti Neurons Tags

The following fields from Prisma Cloud - Compute APIs are converted into Ivanti Neurons tags. Use these tags for searching, automating playbooks, and visualizing in dashboards. This information is available on both the Hosts and Application pages.

• tags

• repoTag

• collections

Common Fields in Ivanti Neurons

The following fields in Ivanti Neurons are defined for Prisma Cloud - Compute, along with their default values.

• For Hosts/Host Findings, the Scanner Name is Prisma Cloud Compute Net.

• For Applications/Application Findings, the Scanner Name is Prisma Cloud Compute App.