Palo Alto Networks Certified Cloud Security Engineer (PCCSE)Cloud Security Posture Management (CSPM)Medium
A security analyst receives a high volume of alerts from Prisma Cloud related to 'S3 bucket not encrypted' for development environments. The team acknowledges that these specific buckets, used for temporary, non-sensitive data, do not require encryption at rest, and the alerts are causing unnecessary noise. What is the most effective Prisma Cloud feature to reduce these specific alerts without disabling the policy for other critical environments?
- ACreate an alert rule to automatically close these alerts.
- BDisable the 'S3 bucket not encrypted' compliance policy globally.
- CModify the policy to exclude development environments.
- DApply an alert suppression rule based on specific resource tags or account IDs.
Show answer & explanationAnswer & explanation
Correct answer: D. Apply an alert suppression rule based on specific resource tags or account IDs.
Alert suppression rules allow organizations to filter out specific alerts based on criteria like resource tags, account IDs, or policy names, ensuring that legitimate alerts are still generated for other environments while reducing noise from known acceptable deviations.
Why the other options are wrong
- A. Automatically closing alerts still generates them, contributing to noise and potentially masking real issues if not configured carefully.
- B. Disabling the policy globally would prevent detection for all environments, including critical ones, which is not desired.
- C. Modifying the policy for specific environments is an alternative but 'alert suppression' is often more flexible for temporary or conditional exclusions without altering the core policy logic.
Prisma Cloud Alert Suppression
Alert suppression in Prisma Cloud allows users to define rules that prevent specific alerts from being generated or displayed based on criteria such as resource tags, account IDs, policy names, or alert severity, helping to reduce alert fatigue.
- Reduces alert noise and fatigue.
- Can be based on various criteria (tags, accounts, policies).
- Ensures focus on critical security issues.
Memory trick: To quiet repeated alerts, suppress them.