topic Compute/Monitor/Runtime/App-embedded details missing? in Prisma Cloud Discussions

Compute/Monitor/Runtime/App-embedded details missing?

TommyHunt — Mon, 05 Dec 2022 20:00:41 GMT

I deployed an App-embedded container to an EKS Cluster on Fargate.
I found the defended container in the console, Compute/Monitor/Runtime/App-embedded details.

1) Why can't Users with any role but System Administrator, see the events in that table? The user-roles are associated with an AccountGroup that the defended-container is a member of.
2) Why does the environment tab render "Found no additional metadata for the App-Embedded resource." ? Shouldn't there be metadata? Don’t we need this metadata to tune our Runtime policies?

Re: Compute/Monitor/Runtime/App-embedded details missing?

musiddiqui — Mon, 05 Dec 2022 23:09:20 GMT

Hi Tommy,

Thank you for reaching out.

1) You need to create a Resource list on the CSPM side for the cloud account where the fargate defender is deployed and use that resource list as a collection to view the runtime alerts.

https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-admin/manage-prisma-cloud-administrators/add-a-resource-list-on-prisma-cloud

Please review the following document for the permissions

https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-admin/manage-prisma-cloud-administrators/prisma-cloud-admin-permissions

2) Currently, metadata information is not displayed for the fargate defender. Can you please create a feature request for it?

https://prismacloud.ideas.aha.io/ideas

Please let me know if you have any other questions.

Regards,

Re: Compute/Monitor/Runtime/App-embedded details missing?

TommyHunt — Mon, 12 Dec 2022 15:27:29 GMT

@musiddiqui, Thanks for your suggestion.

Soon, I can take some time to learn about resource lists.

Due to the recently released fine-grained specification of RBAC, PermissionGroups, issue #1 is no longer an issue.

Now, I can simply tailor a custom PermissionGroup.

Issue #2 is a serious shortcoming in the product's capabilities. Defenders and observations render in the console but we users have no information to trace runtime, app-embedded observations back to the EKS Fargate cluster.pod where this telemetry is coming from.

See the new idea here... https://prismacloud.ideas.aha.io/ideas/PANW-I-4415