Prisma Cloud Compute

Container Security

Overview

The Prisma Cloud Compute Connector fetches security and compliance data from the Prisma Cloud Compute platform. It connects to the Prisma Cloud Compute API to synchronize assets and findings, mapping them to the Brinqa Data Model.

Data retrieved from Prisma Cloud Compute

Connector Object	Required	Maps to Data Model
Cloud Resource	Yes	Cloud Resource
Code Repository	Yes	Code Repository
Container	Yes	Container
Container Image	Yes	Container Image
Host	Yes	Host
Serverless	Yes	Serverless
Package	Yes	Package
Installed Package	Yes	Installed Package
Violation	Yes	Violation
Violation Definition	Yes	Violation Definition
Vulnerability	Yes	Vulnerability
Vulnerability Definition	Yes	Vulnerability Definition

Model relationships

note

For detailed steps on how to view the data retrieved from Prisma Cloud Compute in the Brinqa Platform, see How to view your data.

Setup

Connection settings

When setting up a data integration, select Prisma Cloud Compute from the Connector dropdown and provide the following:

Setting	Required	Default	Description
Server URL	Yes	—	Prisma Cloud Compute console URL
API key	Yes	—	Prisma Compute API key
Secret key	Yes	—	Prisma Compute API secret key
Page size	No	100	Maximum number of records to get per API request
Parallel requests	No	min(4, cpu cores)	Maximum number of parallel API requests
Request timeout (secs)	No	120	Maximum seconds allotted before a request will time out. The request timeout cannot be more than 3600 seconds
SSL / TLS	No	—	Skip certificate verification

Authentication

Method

API access key + secret key exchanged for a short-lived bearer token via the /api/v1/authenticate endpoint. The token is then sent on every subsequent request via the standard Authorization: Bearer <token> header.

Endpoint

Method	URL
POST	{url}/api/v1/authenticate

Request Headers

Header	Value
Content-Type	application/json
Accept	application/json

Request Body

{
  "username": "<api-access-key>",
  "password": "<api-secret-key>"
}

Sample Response

{
  "token": "eyJhbGciOiJIUzI1NiJ9..."
}

Response Fields

Field	Type	Description
token	string	Bearer token used to authorize all subsequent API requests.

Usage

All subsequent API requests include the token as a standard bearer credential:

Authorization: Bearer <token>
Accept: application/json

Obtaining Credentials

In Prisma Cloud, generate an access key/secret key pair from Settings → Access Control → Access Keys → Add Access Key. The Compute API base URL is the Console address of your Prisma Cloud Compute tenant (Compute Edition console, or the Compute path of a Prisma Cloud SaaS tenant).

Sync Behavior

The connector supports incremental (delta) syncs. It maintains a sync token between runs and applies it as an incremental timestamp filter, so each run re-processes only the records that changed after the previous sync. The initial run retrieves the complete data set; later runs are incremental. The specific timestamp field applied to each object is documented under that object's Sync Duration Parameter.

How to obtain Prisma Cloud Compute credentials

Generate Prisma Cloud Compute access keys

For the cloud instance of the Prisma Cloud Compute connector to use the Prisma Cloud Compute API, you must provide the API credentials from Prisma Cloud Compute. To do so, follow these steps:

1. Log in to your organization's Prisma Cloud Compute server.

2. Navigate to Settings > Access Control > Access Keys.

3. Select Add > Access Key.

4. Enter a name for the key, enable key expiration, and set a expiry date and time.

5. Click Save to create the key.

   Your new access keys display. You cannot view the secret key after this, so copy the key and save it to a secure location.

Note: If you do not have the permissions to create access keys, contact your Prisma Cloud Compute administrator. For additional information, see Prisma Cloud Compute documentation.

Data & mappings

Attribute mappings

Expand the sections below to view the mappings between the source and the Brinqa data model attributes:

Cloud Resource

Source Field Name	SDM Attribute
Entity.accountID	CLOUD_ACCOUNT_ID
Entity.activeServicesCount	ACTIVE_SERVICE_COUNT
Entity.arn	UID
Entity.arn	ARN
Entity.arn then Entity.name	NAME
Entity.containerGroup	CONTAINER_GROUP
Entity.createdAt	SOURCE_CREATED_DATE
Entity.defended	DEFENDED
Entity.endpoints	ENDPOINTS
Entity.image	IMAGE
Entity.lastModified	SOURCE_LAST_MODIFIED
Entity.nodesCount	NODES_COUNT
Entity.provider	CLOUD_PROVIDER
Entity.region	REGION
Entity.registry	REGISTRY
Entity.resourceGroup	RESOURCE_GROUP
Entity.runningTasksCount	RUNNING_TASKS_COUNT
Entity.runtime	RUNTIME
Entity.serviceType	SERVICE_TYPE
Entity.status	SOURCE_STATUS
Entity.version	REVISION
project	PROJECT

Code Repository

Source Field Name	SDM Attribute
!Repository.private	PUBLIC
Asset.collections	COLLECTIONS
Asset.creationTime	SOURCE_CREATED_DATE
Asset.firstScanTime	FIRST_SCANNED
Asset.firstScanTime or creationTime	FIRST_SEEN
Asset.labels, externalLabels	TAGS
Asset.riskFactors.keySet()	RISK_FACTORS
Asset.scanTime	LAST_SCANNED
Asset.scanTime	LAST_SEEN
Asset.type	CATEGORIES
CodeRepoAsset.ident	UID
CodeRepoAsset.ident	NAME
CodeRepoAsset.type	REPO_TYPE
CodeRepoAsset.updateTime	SOURCE_LAST_MODIFIED
Instant.now()	LAST_CAPTURED
project	PROJECT
Repository.defaultBranch	DEFAULT_BRANCH
Repository.fullName	PATH
Repository.fullName + project	DESCRIPTION
Repository.name	NAME
Repository.owner	OWNER

Container

Source Field Name	SDM Attribute
Asset.collections	COLLECTIONS
Asset.creationTime	SOURCE_CREATED_DATE
Asset.distro	DISTRO
Asset.firstScanTime	FIRST_SCANNED
Asset.firstScanTime or creationTime	FIRST_SEEN
Asset.labels, externalLabels, cloudMetadata.labels	TAGS
Asset.riskFactors.keySet()	RISK_FACTORS
Asset.scanTime	LAST_SCANNED
Asset.scanTime	LAST_SEEN
Asset.type	CATEGORIES
ContainerAsset.hostname	HOST
ContainerAsset.ident	UID
ContainerAsset.name	NAME
ContainerInfo.app	APP
ContainerInfo.cloudMetadata.accountID	CLOUD_ACCOUNT_ID
ContainerInfo.cluster	CLUSTER
ContainerInfo.clusterType	CLUSTER_TYPE
ContainerInfo.image	IMAGE_NAME
ContainerInfo.imageID	IMAGE
ContainerInfo.namespace	NAMESPACE
ContainerInfo.profileID	PROFILE_ID
Instant.now()	LAST_CAPTURED
name + namespace + app	DESCRIPTION
project	PROJECT

Container Image

Source Field Name	SDM Attribute
Asset.cloudMetadata.accountID	CLOUD_ACCOUNT_ID
Asset.collections	COLLECTIONS
Asset.creationTime	SOURCE_CREATED_DATE
Asset.distro	DISTRO
Asset.firstScanTime	FIRST_SCANNED
Asset.firstScanTime or creationTime	FIRST_SEEN
Asset.labels, externalLabels, cloudMetadata.labels	TAGS
Asset.repoTag.registry	REGISTRY
Asset.repoTag.repo	REPOSITORY
Asset.repoTag.tag	REPOSITORY_TAG
Asset.riskFactors.keySet()	RISK_FACTORS
Asset.scanTime	LAST_SCANNED
Asset.scanTime	LAST_SEEN
Asset.type	CATEGORIES
ImageAsset.clusters	CLUSTERS
ImageAsset.distro	OPERATING_SYSTEM
ImageAsset.hostnames	HOSTS
ImageAsset.ident	UID
ImageAsset.name + repoTag	NAME
ImageAsset.namespaces	NAMESPACES
ImageAsset.repoDigests	DIGEST
ImageAsset.scanVersion	SCAN_VERSION
ImageAsset.trustStatus	TRUST_STATUS
Instant.now()	LAST_CAPTURED
name + distro	DESCRIPTION
project	PROJECT

Host

Source Field Name	SDM Attribute
Asset.cloudMetadata.accountID	CLOUD_ACCOUNT_ID
Asset.cloudMetadata.image	IMAGE
Asset.cloudMetadata.name	NAME
Asset.cloudMetadata.provider	CLOUD_PROVIDER
Asset.cloudMetadata.region	REGION
Asset.cloudMetadata.type	INSTANCE_TYPE
Asset.cloudMetadata.vmID or resourceID	INSTANCE_ID
Asset.collections	COLLECTIONS
Asset.creationTime	SOURCE_CREATED_DATE
Asset.distro	DISTRO
Asset.firstScanTime	FIRST_SCANNED
Asset.firstScanTime or creationTime	FIRST_SEEN
Asset.labels, externalLabels, cloudMetadata.labels	TAGS
Asset.osDistroRelease	OS_DISTRO_RELEASE
Asset.osDistroVersion	OS_DISTRO_VERSION
Asset.riskFactors.keySet()	RISK_FACTORS
Asset.scanTime	LAST_SCANNED
Asset.scanTime	LAST_SEEN
Asset.type	CATEGORIES
HostAsset.clusters	CLUSTERS
HostAsset.distro	OPERATING_SYSTEM
HostAsset.hostname	HOSTNAMES
HostAsset.hostname or ident	NAME
HostAsset.ident	UID
Instant.now()	LAST_CAPTURED
Operating System or Name	DESCRIPTION
project	PROJECT

Serverless

Source Field Name	SDM Attribute
Asset.collections	COLLECTIONS
Asset.creationTime	SOURCE_CREATED_DATE
Asset.firstScanTime	FIRST_SCANNED
Asset.firstScanTime or creationTime	FIRST_SEEN
Asset.labels, externalLabels	TAGS
Asset.riskFactors.keySet()	RISK_FACTORS
Asset.scanTime	LAST_SCANNED
Asset.scanTime	LAST_SEEN
Asset.type	CATEGORIES
Instant.now()	LAST_CAPTURED
project	PROJECT
ServerlessAsset.accountID	CLOUD_ACCOUNT_ID
ServerlessAsset.applicationName	APP_NAME
ServerlessAsset.defenderLayerARN	DEFENDER_LAYER_ARN
ServerlessAsset.description	DESCRIPTION
ServerlessAsset.envvars	ENV_VARS
ServerlessAsset.hash	HASH
ServerlessAsset.ident	UID
ServerlessAsset.is_protected	PROTECTED
ServerlessAsset.memory	MEMORY
ServerlessAsset.name	NAME
ServerlessAsset.provider	CLOUD_PROVIDER
ServerlessAsset.region	REGION
ServerlessAsset.role	ROLE
ServerlessAsset.runtime	RUNTIME

Package

Source Field Name	SDM Attribute
Instant.now()	LAST_CAPTURED
MD5(project, assetId, pkg.name, pkg.version)	UID
PackageResource.license	LICENSES
PackageResource.originPackageName	ORIGIN_PACKAGE_NAME
PackageResource.purl	PURL
PackageResource.version	VERSION
UID	NAME

Installed Package

Source Field Name	SDM Attribute
assetId	TARGETS
finding.packageName + - + finding.packageVersion	TYPE
Instant.now()	LAST_CAPTURED
MD5(assetId, finding.id, finding.packageName, finding.packageVersion)	UID
PackageResource.path (matched on the host's own package list; null for OS packages and orphan findings, which Prisma returns without a path)	PATH
UID	NAME

Violation

Source Field Name	SDM Attribute
"active"	STATUS
active	SOURCE_STATUS
Asset.ident, ContainerInfo.imageID, , MD5(assetId, finding.id, finding.packageName, finding.packageVersion) (host-specific Installed Package, when the finding references a package)	TARGETS
Asset.project	PROJECT
Asset.scanTime	LAST_FOUND
Asset.type	CATEGORIES
Asset.type	ASSET_TYPE
CodeRepoAsset.name	CODE_REPO_NAME
ContainerAsset.name	CONTAINER_NAME
ContainerInfo.cloudMetadata.accountID	CLOUD_ACCOUNT_ID
ContainerInfo.cluster	CLUSTER
ContainerInfo.clusterType	CLUSTER_TYPE
ContainerInfo.namespace	NAMESPACE
ContainerInfo.profileID	PROFILE_ID
Finding.cause	RESULTS
Finding.fixLink	FIX_LINK
Finding.id	TYPE
Finding.status	PROVIDER_STATUS
Finding.title	NAME
ImageAsset.name	IMAGE_NAME
Instant.now()	LAST_CAPTURED
Mapped(active)	STATUS_CATEGORY
MD5(registry, repo, tag, assetId, hostname, null, finding.id, null)	UID
Repository.repo	REPOSITORY
RepoTag.registry	REGISTRY
RepoTag.tag	REPOSITORY_TAG
ServerlessAsset.name	SERVERLESS_NAME

Violation Definition

Source Field Name	SDM Attribute
Calculated	SEVERITY_SCORE
Finding.description	DESCRIPTION
Finding.fixDate	FIX_DATE
Finding.fixLink	FIX_LINK
Finding.id	UID
Finding.severity	SOURCE_SEVERITY
Finding.severity (Normalized)	SEVERITY
Finding.status	VENDOR_STATUS
Finding.title	NAME
Finding.type	VULN_TYPE
Instant.now()	LAST_CAPTURED

Vulnerability

Source Field Name	SDM Attribute
"active"	STATUS
active	SOURCE_STATUS
Asset.ident, ContainerInfo.imageID, MD5(assetId, finding.id, finding.packageName, finding.packageVersion) (host-specific Installed Package, when the finding references a package)	TARGETS
Asset.project	PROJECT
Asset.scanTime	LAST_FOUND
Asset.type	CATEGORIES
Asset.type	ASSET_TYPE
CodeRepoAsset.name	CODE_REPO_NAME
ContainerAsset.name	CONTAINER_NAME
Finding.applicableRules	APPLICABLE_RULES
Finding.binaryPkgs	BINARY_PACKAGES
Finding.cause	RESULTS
Finding.cve	TYPE
Finding.discovered	FIRST_FOUND
Finding.fixLink	FIX_LINK
Finding.id	COMPLIANCE_ID
Finding.impactedPackages	IMPACTED_PKG
Finding.packageName	PKG_NAME
Finding.packageType	PKG_TYPE
Finding.packageVersion	PKG_VERSION
Finding.status	PROVIDER_STATUS
Finding.title	NAME
ImageAsset.name	IMAGE_NAME
Instant.now()	LAST_CAPTURED
Mapped(active)	STATUS_CATEGORY
MD5(registry, repo, tag, assetId, hostname, finding.cve, finding.id, impactedPackage)	UID
Repository.repo	REPOSITORY
RepoTag.registry	REGISTRY
RepoTag.tag	REPOSITORY_TAG
ServerlessAsset.name	SERVERLESS_NAME

Vulnerability Definition

Source Field Name	SDM Attribute
Calculated	SEVERITY_SCORE
Finding.cve	UID
Finding.cve	CVE_IDS
Finding.cve	CVE_RECORDS
Finding.description	DESCRIPTION
Finding.exploit	EXPLOITS
Finding.fixDate	FIX_DATE
Finding.fixLink	FIX_LINK
Finding.link	REFERENCES
Finding.published	PUBLISHED_DATE
Finding.severity	SOURCE_SEVERITY
Finding.severity (Normalized)	SEVERITY
Finding.status	VENDOR_STATUS
Finding.title or cve	NAME
Finding.type	VULN_TYPE
Finding.vecStr	CVSS Metrics
Instant.now()	LAST_CAPTURED

Operations & API

Operations & API

Expand each connector object to see its operation options, delta-sync behavior, and the API it uses. See connector operation options for how to apply operation options (keys and values are case-sensitive).

Cloud Resource

Operation options

This object does not support any operation options.

Delta sync

Supported.

API

• Type: REST endpoint · Endpoint: GET /api/v1/cloud/discovery/entities

Code Repository

Operation options

This object does not support any operation options.

Delta sync

Supported.

API

• Type: REST endpoint · Endpoint: GET /api/v1/coderepos

Container

Operation options

This object does not support any operation options.

Delta sync

Supported.

API

• Type: REST endpoint · Endpoint: GET /api/v1/containers

Container Image

Operation options

This object does not support any operation options.

Delta sync

Supported.

API

• Type: REST endpoint

Host

Operation options

This object does not support any operation options.

Delta sync

Supported.

API

• Type: REST endpoint · Endpoint: GET /api/v1/hosts

Serverless

Operation options

This object does not support any operation options.

Delta sync

Supported.

API

• Type: REST endpoint · Endpoint: GET /api/v1/serverless

Package

Operation options

This object does not support any operation options.

Delta sync

Supported.

API

• Type: REST endpoint (derived — packages are extracted while iterating the parent asset scans)

Installed Package

Operation options

This object does not support any operation options.

Delta sync

Supported.

API

• Type: REST endpoint (derived — one record per vulnerability finding, extracted while iterating the parent asset scans)

Violation

Operation options

This object does not support any operation options.

Delta sync

Supported.

API

• Type: REST endpoint (derived — compliance findings extracted from each asset's scan payload)

Violation Definition

Operation options

This object does not support any operation options.

Delta sync

Supported.

API

• Type: REST endpoint (derived — one Violation Definition per compliance finding id, extracted from each asset's scan payload)

Vulnerability

Operation options

This object does not support any operation options.

Delta sync

Supported.

API

• Type: REST endpoint (derived — vulnerability (CVE) findings extracted from each asset's scan payload)

Vulnerability Definition

Operation options

This object does not support any operation options.

Delta sync

Supported.

API

• Type: REST endpoint (derived — one Vulnerability Definition per CVE, extracted from each asset's scan payload)

Changelog

Changelog

The Prisma Cloud Compute connector has undergone the following changes:

Version	Description	Migration Steps
3.4.3	Enhancements - Host: Added an Is Stopped attribute, sourced from the Cloud Compute Hosts API stopped flag, and set the normalized host Status (inactive for stopped hosts, active for running hosts) accordingly. This makes it possible to identify stopped cloud instances (such as EC2 hosts). Hosts whose API response omits the stopped field — for example running or non-cloud hosts — are left without an Is Stopped or Status value rather than having one defaulted, preserving fidelity with the source.	N/A
3.4.2	Improvements - Upgraded Prisma Cloud Compute connector to the latest platform standards for improved reliability and consistency - Updated connector to align with model SDK changes to use the latest storage and schema registration across all models - Added a Last Captured timestamp to all synced data types, making it easier to track when data was last refreshed - Standardized attribute naming and definitions across all data types to align with other Brinqa connectors - Refreshed connector documentation to reflect all current capabilities and configuration options	N/A
3.4.1	Bug Fixes - Installed Package: The Installed Package UID is now derived from the host/asset identity and the finding id together with the package name and version, and installed packages are derived from each host's vulnerability findings. Each vulnerability now links to its own host-specific Installed Package record carrying that host's own file path. Previously the package UID excluded host identity, so a package installed on different hosts at different paths was consolidated into a single record and every host's vulnerability showed the same, sometimes incorrect, path.	On the next sync, Installed Package UIDs change and records are emitted per vulnerability finding, so previously consolidated package records are replaced and the vulnerability-to-package relationships are repointed accordingly.
3.4.0	No changes in this release.	N/A
3.3.5	Enhancements - Container: Added Cluster, Cluster Type, Profile ID, and Cloud Account ID attributes with mapping logic from the ContainerInfo block. - Container Image: Added Cloud Account ID attribute to schema registration. - Serverless: Added Cloud Account ID attribute to schema registration. - Violation: Added Namespace, Cluster, Cluster Type, Profile ID, and Cloud Account ID attributes with container-specific enrichment mapping. - ContainerInfo API: Exposed cluster, clusterType, and cloudMetadata fields from the API response.	N/A
3.3.4	Bug Fixes - Container Image: Restored the Namespaces attribute. This field had been inadvertently removed and is required by downstream asset correlation workflows that rely on Kubernetes/orchestrator namespace context.	N/A
3.3.3	Improvements - Installed Package synchronization now reuses the shared asset store populated by other models, avoiding redundant fetches and speeding up syncs when packages and vulnerabilities are collected together.	N/A
3.3.2	Improvements - Finding status is now reported through the standard Source status and Provider status attributes, replacing the prior single Vendor status attribute for clearer, normalized status reporting.	• Violation, Vulnerability: Status reporting moved from the Vendor status attribute to the standardized Source status and Provider status attributes — Action: re-sync the Prisma Cloud Compute connector so existing findings repopulate the new status attributes.
3.3.1	Improvements - Added a Source ID attribute to findings and standardized how the finding-definition identifier is derived, improving correlation between findings and their definitions.	• Violation Definition, Vulnerability Definition: The definition identifier derivation changed — Action: re-sync the Prisma Cloud Compute connector so finding definitions are re-keyed consistently.
3.3.0	New Features - Added the Package and Installed Package models, surfacing software packages discovered on Compute assets and the package inventory installed on each asset. Improvements - The Compute model layer was reorganized into per-asset model classes (containers, images, hosts, serverless, code repositories), improving consistency of attribute population across asset types.	N/A
3.2.4	Improvements - Vulnerability findings now include Package name, Package type, and Package version, identifying the specific software package affected by each finding.	N/A
3.2.3	No changes in this release.	N/A
3.2.2	No changes in this release.	N/A
3.2.1	No changes in this release.	N/A
3.2.0	No changes in this release.	N/A
3.1.3	Improvements - Container Image now consistently populates Repository, Registry, and Repository tag from the image's repository tag data.	N/A
3.1.2	Improvements - Container Image now includes the Kubernetes/orchestrator Namespaces the image is deployed in, improving asset correlation.	N/A
3.1.1	Improvements - Container Image risk-factor reporting was corrected so risk factors are populated reliably.	N/A
3.1.0	Improvements Dependency Upgrades - Internal refactoring of authentication, request handling, and the model class hierarchy. No customer-facing behavior or schema changes.	N/A
3.0.13	Improvements - Vulnerability and Violation finding status is now derived dynamically from the Prisma status rather than fixed values, and the Last found timestamp is populated from the discovery date, improving the accuracy of finding lifecycle reporting.	N/A
3.0.12	Improvements - Host now includes a Resource ID attribute sourced from cloud metadata, improving asset identification and correlation.	N/A
3.0.11	New Features - Added the Cloud Resource model, populated from Prisma's cloud discovery data, so cloud service resources are synchronized alongside Compute assets.	N/A
3.0.10	No changes in this release.	N/A
3.0.9	Improvements - Resource-not-found responses from Prisma are now treated as non-retryable, so syncs no longer waste time retrying requests for resources that no longer exist.	N/A
3.0.8	No changes in this release.	N/A
3.0.7	No changes in this release.	N/A
3.0.6	Bug Fixes - Corrected the closed-finding status category from fixed to closed, so resolved violations and vulnerabilities report the correct lifecycle state.	N/A
3.0.5	Improvements - Container Image Name, Registry, Repository, and Current version mappings were refined for more accurate and complete image identification.	N/A
3.0.4	Bug Fixes - The Project attribute on vulnerability and violation findings is now only set when Prisma provides a project, avoiding empty or placeholder values.	N/A
3.0.3	No changes in this release.	N/A
3.0.2	No changes in this release.	N/A
3.0.1	Improvements - Finding severity is now reported as a normalized Severity score, replacing the prior raw severity number, for consistent severity comparison across sources.	• Violation, Vulnerability: The severity attribute changed from a raw severity number to a normalized severity score — Action: re-sync the Prisma Cloud Compute connector so existing findings are repopulated with the rescaled severity values.
3.0.0	Overview The Prisma Cloud Compute connector integrates with Palo Alto Networks Prisma Cloud Compute (formerly Twistlock) to synchronize container, host, image, serverless, and code-repository assets along with their vulnerabilities and policy violations. Category: Container Security Models	N/A