Unexpected change by user __cloud_services - Anyone else get this today?

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

Unexpected change by user __cloud_services - Anyone else get this today?

L1 Bithead

Screenshot 2024-01-09 at 19.36.01.png

 

We use Panorama to manage Prisma access and have alerts configured for config changes. Today got an alert of a commit from user __cloud_services, from the loop back IP 127.0.0.1  I assumed I would look up this user in google and see that it's a service account used by the prisma access plugin for when changes are deployed but didn't find anything. I then thought I would check email and see if I got some information of a change that Palo are rolling out to it's clients and also couldn't find anything in documentation. I've not committed the changes at the moment but as it's not something I've ever seen before it felt a bit disconcerting.  I've raised a support ticket, but I don't expect a fast response with the cert issues they are dealing with.  Can anyone verify the activity is normal ?

2 REPLIES 2

Cyber Elite
Cyber Elite

@jbusby,

The __cloud_services user is expected and would be able to make changes as you thought, and it is effectively a service account. I'm not sure why you would be seeing it make that change however, especially considering that the 1.1.1.1 address was released and is now actively being utilized by Cloudflare/WARP. 

Thanks a lot for getting back to me it's very much appreciated, so far PA support have told me "they checked internally and found that this is not a backend push. This has happened locally by using the admin roles" unfortunately they didn't offer any information about the specifics of this user.  I would be nice then to understand why this particular set command has been triggered and why now. I looked through the audit config logs and the __cloud_services  user has only made 2 other changes 2 years ago which was adding tags to our service connections. I also can't push other changes because a full commit is now required. I'm wondering if I just have to bite the bullet and push this unexplained change. Part of my concern is that we don't use the explicit proxy feature and don't want to inadvertently enable some services. 

  • 1445 Views
  • 2 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!