A customer wants to be notified about port scanning network activities in their environment. Which policy type detects this behavior?

Prisma Cloud uses anomaly detection policies to identify suspicious or unusual behavior that deviates from a learned baseline of normal activity. Port scanning is a classic example of such anomalous network behavior. The platform's machine learning algorithms detect these patterns, such as a single source connecting to multiple ports on a destination, and trigger an alert under the 'Anomaly' policy type.

A. Network: Network policies are used to define and enforce rules about allowed traffic paths, not to detect behavioral patterns like scanning.
B. Port Scan: "Port Scan" is a specific type of detected behavior, but it falls under the broader policy category of 'Anomaly', not a distinct top-level policy type.
D. Config: Config policies are used to audit and enforce the static configuration of cloud resources, not to monitor real-time network traffic behavior.

1. Palo Alto Networks

Prisma Cloud Administrator's Guide (SaaS)

"Anomaly Policies". The documentation states

"Prisma Cloud uses machine learning to build models of normal behavior

then reports on any anomalous activity." It lists "Network anomaly policies" as a key type

which includes the detection of port scans.

2. Palo Alto Networks

Prisma Cloud Docs

"Default Anomaly Policies". This section details the built-in anomaly policies

including "Port scan

" which is categorized under network anomalies. It detects when a source communicates with an abnormally high number of ports on a destination.