01-09-2024 11:55 AM
We use Panorama to manage Prisma access and have alerts configured for config changes. Today got an alert of a commit from user __cloud_services, from the loop back IP 127.0.0.1 I assumed I would look up this user in google and see that it's a service account used by the prisma access plugin for when changes are deployed but didn't find anything. I then thought I would check email and see if I got some information of a change that Palo are rolling out to it's clients and also couldn't find anything in documentation. I've not committed the changes at the moment but as it's not something I've ever seen before it felt a bit disconcerting. I've raised a support ticket, but I don't expect a fast response with the cert issues they are dealing with. Can anyone verify the activity is normal ?
