Can Prisma Cloud Defender attempt to connect to ports?

[S.Choi879310]

I understood that Prisma Cloud Defender does not directly attempt to connect to ports or perform scans,

but it seems to have executed the curl -X OPTIONS http://localhost:8355 command on the tomcat shutdown port.

Since such a command was executed, there are daily logs of it being blocked by the tomcat shutdown port.

Please tell me the reason why Prisma Cloud Defender performs such a command: curl -X OPTIONS http://localhost:8355 

[LMegrelis]

Hello! 

I don't think a defender can perform that command. 

Some defender logs would provide more clarity and additional details to troubleshoot the issue further.

I would recommend opening a support case for further assistance. 

[mailvk23]

I too observed this in my EKS setup where prisma defender is running as container  , where these calls and logs are through out . 

Upon checking with security team  some upgrades were performed, but none seem to have stopped it. 

I was thinking of blocking this via network or network policies ,rather than blocking at the application or mesh level. 

in my observation there is scan utility with in who is performing this . 

Any one attempted  ?