topic Unexpected change by user __cloud_services - Anyone else get this today? in General Topics

Unexpected change by user __cloud_services - Anyone else get this today?

jbusby — Tue, 09 Jan 2024 19:55:35 GMT

We use Panorama to manage Prisma access and have alerts configured for config changes. Today got an alert of a commit from user __cloud_services, from the loop back IP 127.0.0.1 I assumed I would look up this user in google and see that it's a service account used by the prisma access plugin for when changes are deployed but didn't find anything. I then thought I would check email and see if I got some information of a change that Palo are rolling out to it's clients and also couldn't find anything in documentation. I've not committed the changes at the moment but as it's not something I've ever seen before it felt a bit disconcerting. I've raised a support ticket, but I don't expect a fast response with the cert issues they are dealing with. Can anyone verify the activity is normal ?

Re: Unexpected change by user __cloud_services - Anyone else get this today?

BPry — Tue, 09 Jan 2024 22:10:08 GMT

@jbusby,

The __cloud_services user is expected and would be able to make changes as you thought, and it is effectively a service account. I'm not sure why you would be seeing it make that change however, especially considering that the 1.1.1.1 address was released and is now actively being utilized by Cloudflare/WARP.

Re: Unexpected change by user __cloud_services - Anyone else get this today?

jbusby — Wed, 10 Jan 2024 00:46:33 GMT

Thanks a lot for getting back to me it's very much appreciated, so far PA support have told me "they checked internally and found that this is not a backend push. This has happened locally by using the admin roles" unfortunately they didn't offer any information about the specifics of this user. I would be nice then to understand why this particular set command has been triggered and why now. I looked through the audit config logs and the __cloud_services user has only made 2 other changes 2 years ago which was adding tags to our service connections. I also can't push other changes because a full commit is now required. I'm wondering if I just have to bite the bullet and push this unexplained change. Part of my concern is that we don't use the explicit proxy feature and don't want to inadvertently enable some services.