Prisma Cloud models the runtime behavior with a machine learning model to scale runtime defense in large and complex environments. Runtime defense provides both Predictive and threat-based active protection for running containers. Predictive protection capabilities include determining when a container runs a process that is not included in the original image or when it creates an unexpected network socket. Threat-based protection capabilities include detecting when malware is added to a container or when a container connects to a botnet.   Here, Custom rules provide an additional mechanism to protect running software. Custom rules are expressions which can be created based on your specific use-case and are stored in a central library, where they can be reused and can be added to your runtime policies at any time.