PCCSE key terms

Palo Alto Networks' cloud security platform that unifies posture management for cloud accounts, runtime protection for workloads, and scanning of code and pipelines inside a single console.

The posture-management module that continuously inventories cloud resources, evaluates them against configuration policies and compliance frameworks, and reports misconfigurations, drift, and risky entitlements.

The workload-protection module, originally Twistlock, that uses agents called Defenders to scan images and hosts, detect runtime threats, and enforce container admission rules.

The browser interface for a customer's dedicated tenant, where administrators onboard accounts, write policies, investigate alerts, and configure users and integrations.

A REST interface that exposes console functions such as onboarding, policy management, and alert retrieval so teams can automate them; calls authenticate with access keys.

Connecting a cloud subscription or project to Prisma Cloud by granting read-only access through a role, service principal, or service account, after which its resources are inventoried.

A unique string that Prisma Cloud generates and the customer places in the AWS role trust policy, ensuring only the intended tenant can assume that role.

An AWS role in the customer's account that trusts Prisma Cloud's account and grants read permissions, letting the platform collect configuration without long-lived access keys.

An Azure AD application registration, identified by a client ID plus secret or certificate, that Prisma Cloud uses to read subscription configuration and resource metadata.

A Google Cloud identity whose JSON key and granted IAM roles let Prisma Cloud enumerate projects, folders, and resources under a project, folder, or organization.

Prisma Cloud's SQL-like query language for selecting cloud resources by attribute, used both for ad hoc investigation and to define the match conditions of config policies.

A cloud posture rule whose RQL condition identifies non-compliant resources, such as a public bucket or unencrypted volume; it is evaluated in audit or enforce mode.

A policy setting in which Prisma Cloud only records and reports violations, generating alerts without blocking the resource or pipeline; new policies usually start here.

A policy setting in which Prisma Cloud actively prevents the non-compliant action, for example denying a pod at admission or failing a CI build.

A named collection of policies mapped to a framework such as CIS, PCI DSS, or SOC 2, producing per-requirement pass and fail reporting for audits.

A scoped allowance that stops a policy from generating findings for named accounts, resources, or tags, typically for a defined period and with a documented reason.

A Compute policy that learns normal behavior for users, hosts, or containers and alerts when activity deviates, such as a first-seen process or unusual login.

A record created when a resource, workload, image, or code artifact violates a policy or triggers a runtime event, carrying severity, context, and a history timeline.

A configuration that selects which alerts are sent to which notification integration, filtered by policy type, severity, cloud account, or resource tags.

An outbound delivery channel such as email, Slack, Teams, Amazon SNS, a generic webhook, or ServiceNow that Prisma Cloud uses to push alerts and reports.

The investigation workflow of opening an alert, reviewing the resource's configuration and related findings, then dismissing, snoozing, or fixing it and recording the outcome.

The queryable catalog of cloud resources, images, hosts, and functions that Prisma Cloud discovers, backing search, alert context, and RQL-based investigation.

The Prisma Cloud Compute agent that runs on hosts, in containers, or inside serverless functions to scan for vulnerabilities and compliance issues and report runtime events.

A Defender deployed as a container, usually a DaemonSet on every Kubernetes node, that scans images and enforces runtime policies for pods on that node.

A Defender installed on a virtual machine or bare-metal operating system that scans installed packages, checks host benchmarks, and monitors processes and network connections.

A small Defender packaged with a serverless function that inspects invocations and can block malicious behavior without a separate long-running agent.

A Kubernetes validating webhook through which Prisma Cloud inspects pod creation requests and denies those whose images breach trust, vulnerability, or compliance policy.

A rule that declares which registries, repositories, or image patterns may run in protected clusters; anything untrusted is rejected by admission control.

A Compute rule evaluated as workloads execute, covering process, networking, and file behavior such as a shell spawned in a container or an unexpected outbound connection.

Scheduled or continuous scanning of images held in registries such as Docker Hub, ECR, ACR, and GCR so vulnerabilities surface before an image is deployed.

Static analysis of infrastructure templates such as Terraform, CloudFormation, ARM, and Kubernetes YAML, flagging insecure settings before the infrastructure is created.

Detection of hard-coded credentials, API keys, and tokens in repository files and commit history so leaked secrets can be revoked before attackers use them.

A policy evaluated during CI/CD that fails or warns on the pipeline, for example when an image has critical vulnerabilities or a template breaks a compliance rule.

The Prisma Cloud Compute command-line scanner used in scripts and pipelines to scan images, serverless packages, and IaC files, returning exit codes that can fail a build.

Prisma Cloud's role-based access control: permissions are bundled into roles, roles are assigned to users or groups, and account groups limit which data each principal sees.

A logical container of cloud accounts, often organized by business unit or environment, used to scope policies, roles, and reports to many accounts at once.

A set of users, defined locally or synced from an identity provider, that receives roles and account-group access together rather than one user at a time.

Single sign-on configuration in which Prisma Cloud delegates authentication to the customer's SAML identity provider and maps identity-provider groups to Prisma Cloud roles.

A generated key pair used to authenticate programmatic calls to the Prisma Cloud API for a user or service account instead of interactive console login.