Prisma Cloud CSPM Integration

Palo Alto Networks Prisma Cloud is a cloud-native security platform that provides Cloud Security Posture Management (CSPM) by continuously monitoring cloud environments for misconfigurations, compliance violations, and security threats. Invicti AppSec integrates with Prisma Cloud as a connection-based CSPM scanner, pulling cloud security findings and policy alerts directly into the platform.

Prerequisites

Get an Access Key (on Prisma Cloud Side)

Prisma Cloud uses access key pairs (Access Key ID + Secret Key) for API authentication rather than personal credentials.

1. Log in to the Prisma Cloud console at your regional URL (e.g., https://app.prismacloud.io for US, https://app.eu.prismacloud.io for EU).
2. In the upper right corner, click your profile icon, then select My Profile.
3. Navigate to the Access Keys tab.
4. Click Add to create a new access key.
5. Enter a descriptive name (e.g., invicti-integration) and optionally set an expiration date.
6. Click Create.
7. Copy the Access Key ID and Secret Key immediately — the Secret Key is shown only once and cannot be retrieved again.

📘

To find your regional API URL, log in to the Prisma Cloud console and navigate to Settings → Profile. Your API URL is displayed under API Endpoint (e.g., https://api2.prismacloud.io). Use this exact URL — no trailing slash or path.

Best practice: Create a dedicated access key for the Invicti AppSec integration using a service account with read-only access to cloud accounts and alerts. This isolates the integration from personal credentials and simplifies key rotation.

Step 1: Navigate to Integrations

From the left sidebar menu, click on Integrations.

Step 2: Select the CSPM Tab

On the Integrations page, click on the CSPM tab to view the Cloud Security Posture Management scanners.

Step 3: Find and Activate Prisma Cloud CSPM

Locate the Prisma Cloud CSPM card in the CSPM scanners list and click the Activate button to open the configuration drawer.

If the integration is already active, click the gear icon (⚙️) to open the settings drawer and update the configuration.

Step 4: Configure Connection Settings

Fill in the following fields in the Prisma Cloud CSPM settings drawer:

📘

The URL must be the API base URL — not the console login URL. For example, use https://api.prismacloud.io, not https://app.prismacloud.io. You can find your API URL in Prisma Cloud → Settings → Profile → API Endpoint.

Step 5: Test the Connection

After entering all required fields, click Test Connection.

• If the credentials and URL are correct, a green "Connection successful" message will appear.
• If the connection fails, verify your Access Key ID, Secret Key, and API URL. See the Troubleshooting section below.

Step 6: Save Settings

After a successful test connection, click Save to activate the integration.

The Prisma Cloud CSPM card on the CSPM integrations page will display an active status, confirming the integration is running.

Summary

Create a Scan

Once the Prisma Cloud CSPM integration is active, you can bind it to a project to run scans.

Navigate to Project Scanners

1. Open the project you want to configure.
2. Go to Settings → Scanners within the project.
3. Click Add Scanner.
4. Select CSPM as the scanner type.
5. Select Prisma Cloud CSPM from the scanner list.
6. Click Add to open the scan configuration drawer.

Scan Configuration Fields

KDT Command

Once the scan is configured, you can also trigger it via the KDT CLI:

kdt scan -p <project_name> -t prismacloudcspm -b <branch_name>

Troubleshooting

Connection Fails

Scan Issues

Best Practices

1. Use a dedicated service account: Create a Prisma Cloud service account specifically for the Invicti AppSec integration with the minimum required permissions (Account Group Read Only). Avoid using personal admin credentials.

2. Rotate access keys regularly: Set an expiration date on the access key (e.g., 90 or 180 days) when creating it in Prisma Cloud. Update the key in Invicti AppSec settings before it expires to avoid scan interruptions.

3. Match API URL to your tenant region: Always use the exact API URL shown in Prisma Cloud → Settings → Profile → API Endpoint. Using the wrong regional URL will result in authentication failures even with valid credentials.

4. Use HTTPS: Ensure the Prisma Cloud API URL uses HTTPS. Avoid enabling the Insecure option in production environments.

5. Bind one cloud account per project: Configure each Invicti AppSec project to scan a specific Prisma Cloud cloud account. Scanning multiple accounts under a single project makes it harder to triage and prioritize findings.

Limitations

1. Cloud account access is determined by Prisma Cloud roles: The set of cloud accounts available for scanning depends on the account groups assigned to the access key's role in Prisma Cloud. Accounts not visible to the role will not appear in the dropdown.

2. Alert-based findings only: Invicti AppSec pulls data from the Prisma Cloud /v2/alert endpoint with alert.status=open. Only alerts that are currently open in Prisma Cloud are imported — suppressed, resolved, or dismissed alerts are excluded.

3. Pagination limit of 5,000 alerts per scan: Each scan retrieves up to 5,000 open alerts per page and paginates automatically. Very large cloud environments with tens of thousands of alerts may take longer to process.

4. Prisma Cloud SaaS only: This integration connects to the Prisma Cloud SaaS platform via its public API. Self-hosted or air-gapped Prisma Cloud deployments are not supported unless the API endpoint is network-accessible from Invicti AppSec.