Prisma Cloud Compute Defender containers must run as root.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-253546	CNTR-PC-001350	SV-253546r1050656_rule	CCI-001067	medium
Description
In certain situations, the nature of the vulnerability scanning may be more intrusive, or the container platform component that is the subject of the scanning may contain highly sensitive information. To protect the sensitive nature of such scanning, Prisma Cloud Compute Defenders perform the vulnerability scanning function. The Defender container must run as root and not privileged.
STIG			Date
Palo Alto Networks Prisma Cloud Compute Security Technical Implementation Guide			2026-02-13

Related Frameworks

1 mapping across 4 frameworks

SCF0 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (1) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

VPM-06.3Privileged Access

1.00

DISA STIG Benchmark (XCCDF)V2R3intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)
SCF Secure Traceability Relationship Mapping (STRM)2026.2equal to

NIST 800-530 mappings

No source states a mapping between these directly.

Also reachable in 2 hops (3) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

CM-6Configuration Settings

1.00

DISA STIG Benchmark (XCCDF)V2R3intersects(normalised)
DISA STIG Benchmark (XCCDF)V2R1our copyintersects(normalised)
DISA STIG Benchmark (XCCDF)V2R1intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)

RA-5(5)Privileged Access

1.00

DISA STIG Benchmark (XCCDF)V2R3intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)

SI-2Flaw Remediation

1.00

DISA STIG Benchmark (XCCDF)V2R3intersects(normalised)
DISA STIG Benchmark (XCCDF)V2R1our copyintersects(normalised)
DISA STIG Benchmark (XCCDF)V2R1intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)

NIST 800-1710 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (1) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

3.11.2

1.00

DISA STIG Benchmark (XCCDF)V2R3intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)
NIST SP 800-171 Rev 2, Appendix DRev 2 (Feb 2020, errata Jan 2021)equal to(normalised)

CCI1 mapping

CCI-001067

1.00

DISA STIG Benchmark (XCCDF)V2R3intersects(normalised)

Details

Check Text (C-253546r1050656_chk)

Verify that when deploying the Defender via daemonSet, "Run Defenders as privileged" is set to "On". Verify the Defender containers were deployed using the daemonSet.yaml in which the securityContext is privileged (privileged = "on"). If "Run Defenders as privileged" is not set to "On" or the Defender containers were not deployed using the daemonSet.yaml in which the securityContext - privileged = "on", this is a finding.

Fix Text (F-56949r1050655_fix)

Redeploy the Defender with appropriate rights by setting "Run Defenders as privileged" to "On". Delete the old twistlock-defender-ds daemonSet and redeploy daemonSet with the new yaml in which the securityContext - privileged = "on".