An administrator sees that a runtime audit has been generated for a host. The audit message is: “Service postfix attempted to obtain capability SHELL by executing /bin/sh /usr/libexec/postfix/postfix- script.stop. Low severity audit, event is automatically added to the runtime model” Which runtime host policy rule is the root cause for this runtime audit?

The audit message explicitly states that the service "attempted to obtain capability SHELL." Prisma Cloud's runtime protection for hosts includes default policy rules that monitor for processes acquiring specific Linux capabilities, which grant them privileged kernel-level permissions. The message also indicates the event is being added to the runtime model, which is the standard behavior for the machine learning component when it observes a new, low-severity event for the first time. This audit is a direct result of a default rule designed to detect and learn about capability usage.

A. The audit is about process capabilities, not the modification of a file's content or attributes, which is the focus of file integrity monitoring.
B. This audit does not involve any network connections, ports, or protocols; it is a process-level event occurring on the host itself.
D. While this is a type of runtime behavior, option C is far more specific and accurate, as the audit log directly references a "capability."

1. Palo Alto Networks, Prisma Cloud Administrator's Guide (Compute). "Runtime defense for hosts." This section details how Prisma Cloud models host behavior, including "Process activity and capabilities." It explains that the default policy creates alerts for anomalous capabilities.

2. Palo Alto Networks, Prisma Cloud Docs. "Understanding Runtime Audits." The documentation provides examples of audits generated by the runtime protection engine. Audits for Linux capabilities are a standard feature of the default host protection rules, which learn normal behavior and flag deviations.