T Techclick ← All lessons
Palo Alto · Prisma Cloud · Interactive lesson

Compute runtime Defender then rule

Ticket: payments-api-7f9b on k8s-worker-02 is mining. Runtime Security shows zero incidents. The container policy exists. Nobody deployed a Defender on that node. Compute runtime is not CSPM and not an image scan. Console writes the rule; Defender on the workload evaluates process, file-system and network events against the model plus the rule, then raises an audit. Incident Explorer sews the kill chain. Proof is the incident story plus effect=alert|prevent on the audit — not a green Radar tile.

16 min read · L2 primary · Quiz at end

After this page you can

Lessons · Prisma Cloud series · Compute runtime

Compute Console vs Runtime Security

Self-hosted Compute Edition is the Console. Prisma Cloud Enterprise parks the same tree under Runtime Security. Paths below are the Compute-internal ones: Defend, Monitor, Manage. Prefix Runtime Security on a SaaS tenant.

This lesson is CWPP runtime on the workload. It is not CSPM/RQL, not registry scan, not WAAS. Prisma Cloud interview covers the CNAPP map.

Hero · Defender sits on the node, the rule rides down from Compute
Kubernetes worker node with a Defender container beside app cubes, Compute console pushing a runtime rule, incident card on the right
Mood, not a wiring diagram. Exact path is in the SVG: Container Defender on k8s-worker-02, rule payments-runtime, process /tmp/xmrig, Incident Explorer. The cube labeled Compute is Console, not an AWS account.
Quick answer

Defender is the agent that enforces Compute runtime on the host or container. Console stores the policy; Defender pulls it and keeps the last push if Console is unreachable. Container policy (Defend → Runtime → Container policy) is models plus rules for images — process, network, filesystem, anti-malware. Host policy is a different object for VMs that do not run containers. Custom expressions live in Defend → Custom Rules → Runtime and are attached onto a runtime rule (processed first). Effects: disable / alert / prevent / block. Audits are the raw events; Incident Explorer sews a kill chain. Proof is the incident story plus the audit effect, not Radar being pretty.

Concept — a rule with no Defender is a document

The day-one ticket is always the same: “We have a container runtime rule. Why did the miner run?” Wrong unit of work. A runtime rule is configuration in Console. Enforcement is a Defender process on that node. If k8s-worker-02 has no Container Defender, payments-runtime never sees /tmp/xmrig.

Three silent-miss states look identical from the queue (zero incidents):

Saving the rule does not protect the pod

Defender must be Connected on the node that runs the container. Policy is evaluated on the Defender, top to bottom, first match. Console being green is not evidence the workload is defended.

Defender, container, host, incident

Four objects. Name them before you add a deny path.

Path · Defender, runtime rule, event, incident
Four glass panels labeled Defender, Runtime rule, Event, Incident
Feel of the order. Exact Compute sequence — Defender type, Container vs Host policy, custom rule first, Incident Explorer — is in the SVG below. The shield icon is mood, not a Defender binary.

Defender

Agent on the workload. Types: Container (covers the host plus containers), Host, Serverless, App-Embedded. Linux: user-mode container with net_admin / sys_admin / sys_ptrace / mknod / setfcap — not --privileged. Windows: service + drivers. Fail-open on the runC shim after 60s.

Runtime rule

Defend → Runtime → {Container | Host | Serverless | App-Embedded} policy. Scope is a collection. Made of models and rules. Custom expressions attach here. First matching rule wins; inside a rule, custom rules run first.

Container vs host

Container Defender: behavioral modeling, process / net / fs, forensics, WAAS, Radar. Host Defender: process / net / fs / anti-malware on VMs that do not run containers — no container models. App-Embedded: no learning, no models.

Incident

Logical grouping of audits that match a known attack pattern (crypto miner, reverse shell, port scan, hijacked process). Monitor → Runtime → Incident Explorer. Raw rows stay under Monitor → Events → Container / Host audits.

Say this out loud

Defender is the sensor and the enforcer. The runtime rule is the policy object. Container and host are different policies. An audit is one event. An incident is the sewn kill chain.

Path — Defender then rule then incident

Existing incident first: if Incident Explorer already has this image / host / category in the last 24 hours, you join that story — same type on the same resource is suppressed for a day. New activity walks Defender → policy pull → sensors → custom then model → effect → audit → incident. Forensics land about a minute later.

Flow 1 · lab story payments-api-7f9b → /tmp/xmrig → 203.0.113.88
1 Defender k8s-worker-02 connected 2 Runtime rule payments-runtime · Alert 3 Sensors process · fs · net 4 Incident Explorer + forensics Inside the rule: custom expressions first, then model / allow-deny, then anti-malware proc.path contains "xmrig" → effect Alert (pilot) then Prevent audit: image payments/api:1.8.2 · attack type · effect=alert|prevent Miss at step 1: rule saved, no Container Defender on the node. Miner runs. Queue stays empty. Host Defender on a container node is the other miss. Models never build. App-Embedded never learns. Predictive: process not in origin image, unexpected listen socket. Threat: Intelligence Stream miner / botnet. Same incident type on the same resource is suppressed 24h. Raw audits still list under Monitor → Events. Source: Prisma Cloud — deploy Defender; runtime defense; custom runtime rules; Incident Explorer.

Read left → right, then the gold bar. Defender is the unit of enforcement. The incident is the sewn story. Audits are how you prove the effect.

ObjectLab valueIf missing
DefenderContainer Defender on k8s-worker-02 ConnectedNo process/fs/net events from the pod. Policy is a document.
Collection / scopepayments-prod (ns payments)Default rule may still hit All; a tight collection that misses the image looks like “runtime is off.”
Container rulepayments-runtime, learning on, Processes = AlertDisable = sensors off. Empty model if learning is off.
Host rulejenkins-host-runtime on vm-jenkins-01Container policy never applies to a Host-only Defender.
Custom ruleproc.path contains "xmrig" log as incidentYou wait for the model. Known-bad binaries should be explicit.
Incident proofExplorer story + Container audit effectArchiving the incident without the audit CSV is closing the ticket, not proving the block.

Container vs host vs custom vs effect

Pick the policy object that matches the asset. Mixing them is the usual “I wrote a container rule on a Jenkins VM” ticket.

Flow 2 · four different jobs
Container policy models + rules process · net · fs learning on image Defend → Runtime Host policy VM / bare metal anti-malware · sudo sshd · docker activity no container models Custom rule expression library proc / file / net-out attach + set effect log audit or incident Effect disable · alert prevent · block pilot = Alert then Prevent Custom rules inside a runtime rule take precedence over allow/deny lists. Host process order is Activities → custom → anti-malware. proc.cmdline and file.type are not supported with Prevent. Deny the process on the Processes tab if you must stop it before argv exists. App-Embedded: no models, no Block on some custom types. Serverless is a fourth policy object — not this lab. Source: Prisma Cloud custom runtime rules; runtime defense for hosts; Defender types.

Four columns, four tickets. Do not Prevent a noisy model on day one. Alert, read the audit, then raise the effect.

NeedUseSkip
K8s node running podsContainer Defender (covers host + containers) + Container policyHost Defender only. You lose models and container sensors.
Jenkins / bastion with no runtimeHost Defender + Host policy (anti-malware, sshd, sudo, outbound)Container policy. Nothing to model.
Known-bad binary / C2 IPCustom rule proc.path / net.outgoing_ip, attach, log as incidentWaiting for learning. Models are allow-lists of observed behaviour.
Fargate / Cloud Run taskApp-Embedded Defender + App-Embedded policyContainer models. App-Embedded does not learn.

Do — runbook Side A / B / C

Side A is Defender on the right asset. Side B is the runtime rule (Alert). Side C is the incident plus the audit. Do not start at C.

Side A — Defender on the node

  1. Pick the Defender type from the asset

    Manage → Defenders → Deploy. Lab: Single / Orchestrator Container Defender — Linux on k8s-worker-02 (Docker or containerd as the runtime type). Separate install: Host Defender — Linux on vm-jenkins-01. Container Defender already includes host capabilities on a container node — do not stack a second Host Defender there. Source: Prisma Cloud — Deploy the Prisma Cloud Defender.

  2. Prove Connected, not “script ran”

    Manage → Defenders: hostname k8s-worker-02, type Container, status Connected. Defender talks out to Console (PCCE 8083 / SaaS websocket 8084). If a third-party EDR (Microsoft Defender runtime, similar) blocks kernel events, Prisma does not support that pairing — sensors go dark. Source: Prisma Cloud — Deploy Container Defender; Defender architecture.

Side A — Defender is a user-mode container (Linux). Last policy still enforces if Console is down. 
# After install, Console must list the node. If it does not:
# 1) node → Console reachability (proxy / whitelist console URL + api.<region>.prismacloud.io)
# 2) Defender type vs asset (Host Defender will never model payments-api)
# 3) Competing runtime agent blocking kernel events — unsupported

# Lab names
# node     k8s-worker-02    10.20.20.42    Container Defender
# host     vm-jenkins-01    10.20.20.51    Host Defender
# image    registry.example.com/payments/api:1.8.2
# pod      payments-api-7f9b   ns=payments

Side B — container rule then host rule

https://console.example.com/#/defend/runtime/container Training mock · not live

Defend › Runtime › Container policy › Add rule

payments-runtime

payments-runtime
payments-prod
On
Alert
Alert (pilot)
deny-xmrig · log as Incident

Source: Prisma Cloud — Custom runtime rules; runtime defense. Path: Defend → Runtime → Container policy → Add rule. Learning on. Processes / Networking / Filesystem = Alert on the pilot. Attach custom rules on the Custom Rules tab; set Effect and log-as (audit vs incident) per expression.

  1. Write the custom expression in the library first

    Defend → Custom Rules → Runtime → Add rule. Type Processes. Lab expression: proc.path contains "xmrig" or proc.name = "nc". Optional network: net.outgoing_ip = "203.0.113.88". Prisma Cloud Labs rules (Owner: system) ship disabled via Intelligence Stream — review, then enable. Source: Prisma Cloud — Custom runtime rules.

  2. Attach onto Container policy and Host policy separately

    Container: payments-runtime, collection payments-prod, Custom Rules tab → Apply → Effect Alert → log as Incident. Host: Defend → Runtime → Host policy rule jenkins-host-runtime, Anti-malware crypto miners / reverse shell / wildfire = Alert, same custom rule attached. Host process order is Activities → custom → anti-malware. Source: Prisma Cloud — custom runtime rules (activating); runtime defense for hosts.

Custom rule library — attach, do not leave orphaned 
# Defend → Custom Rules → Runtime
# Type: Processes
proc.path contains "xmrig" or proc.name = "nc"

# Type: Networking-outgoing
net.outgoing_ip = "203.0.113.88"

# Then Defend → Runtime → Container policy → payments-runtime
# Custom Rules → select both → Effect: Alert (pilot) → log as: Incident
# proc.cmdline / file.type cannot be Prevent. Deny the process on the Processes tab instead.

Side C — incident then audit then forensics

https://console.example.com/#/monitor/runtime/incidents Training mock · not live

Monitor › Runtime › Incident Explorer › Active

Incident · cryptominer

payments-api-7f9b · k8s-worker-02
payments/api:1.8.2
cryptominer
/tmp/xmrig → 203.0.113.88:443
alert (pilot)
View forensic data

Source: Prisma Cloud — Incident Explorer. Path: Monitor → Runtime → Incident Explorer. Story is the sewn audits. Raw rows: Monitor → Events → Container audits. Forensics: View forensic data (pulled ~1 min after the incident; FIFO snapshots in Console). Do not Archive until the audit CSV and the model microscope agree.

  1. Trigger on the lab pod, then open Explorer

    Exec /tmp/xmrig (or nc outbound to 203.0.113.88:443) inside payments-api-7f9b. Monitor → Runtime → Incident Explorer should show category cryptominer / hijacked process with that container. Same type on the same resource is suppressed 24h — further copies are not new incidents. Source: Prisma Cloud — Incident Explorer; cryptominers.

  2. Read the audit effect, not the tile

    Monitor → Events → Container audits: image, hostname, attack type, effect = alert or prevent. Host path: Host audits. Syslog tag on Linux Defender is Twistlock-Defender, type=incident, incident_category. Aggregation can fold a burst after a 15-minute quiet window — one “high rate of …” row is not a miss. Source: Prisma Cloud — syslog and stdout integration; event aggregation.

  3. Forensics and the model

    Incident → View forensic data. On-demand: Monitor → Runtime → Container Models → microscope on the image. Host: Monitor → Runtime → Host Models. Collection is Manage → System → Forensics (default on; ~100 MB container / 10 MB host per Defender). Source: Prisma Cloud — Incident Explorer (forensics).

Green proof

Defender Connected on k8s-worker-02. Incident Explorer story names /tmp/xmrig on payments-api-7f9b. Container audit effect=alert (pilot) or prevent after you raise it. Host path on vm-jenkins-01 is a separate Host audit. Radar being drawn is not the proof.

One miner after go-live

Container Defender on k8s-worker-02 is Connected. payments-runtime has learning on, Processes = Alert, custom proc.path contains "xmrig" attached and logged as incident. Someone drops /tmp/xmrig in payments-api-7f9b and it phones 203.0.113.88:443. Process sensor fires. Custom rule matches first. Audit: attack type + effect=alert. Incident Explorer opens a cryptominer story (process + net + maybe fs). Forensics snapshot arrives about a minute later. You read the model microscope — xmrig is not in the origin image — then raise Processes / custom effect to Prevent on that collection. Re-exec: process does not stay up; audit effect=prevent.

Proof · the incident story plus the audit effect
Analyst desk with a wide monitor showing green verification checks and a kill-chain timeline
Ops feel. The actual evidence is Incident Explorer + Container audits effect + Defender Connected. Artwork checkmarks are not Compute Console.
Raise the effect only after the pilot audit is the miner, not the backup job 
# Wrong: Prevent on day one, entire cluster, learning still filling the model
# Right: Alert on payments-prod → confirm audit path=/tmp/xmrig → Prevent on that rule

# If a legitimate sidecar is blocked after Prevent:
# 1) Open the model (Monitor → Runtime → Container Models)
# 2) Add the process to the allow list or wait for a relearn after the new image tag
# 3) Do not Disable the whole Processes tab to "fix prod"

Traps + proof

SymptomLikely causeProof
Rule saved, zero incidentsNo Container Defender on the node, or Host Defender on a container host.Manage → Defenders: type + Connected on k8s-worker-02.
Model empty after daysAutomatic runtime learning off, or App-Embedded (cannot learn).Container policy toggle. App-Embedded observations ≠ Container Models.
Backup cron blocked after PreventProcess never entered the model; new image tag not relearned.Container Models history. Allow-list the path or relearn, do not Disable sensors.
Custom Prevent greyed / errorproc.cmdline or file.type used with Prevent.Docs: those fields are Alert-only. Deny the process on the Processes tab.
Second miner, no new incidentSame type + same resource suppressed 24h.Container audits still list rows. Explorer is not the full log.
Defender Connected, sensors darkThird-party runtime agent blocking kernel events; or Processes effect = Disable.Unsupported pairing. Check the effect on the matching rule, top to bottom.
Console unreachable, “runtime died”Expected: last pushed policy still enforces.Defender architecture. Fail-open is the runC shim (60s), not “drop all rules.”
Do not Prevent the default All collection on day one

Learning is still filling models. Interactive kubectl exec looks like drift. Pilot one collection (payments-prod), Alert, read audits, then Prevent. Global Prevent-on-unknown-process is how you freeze the platform team’s debug sidecar.

Pilot checklist

Knowledge check

Six judgment items. Submit once. Reasons point back at the section to re-read.

Q1

payments-runtime is saved. payments-api-7f9b is mining. Incident Explorer is empty. First check?

Correct: b. A rule with no Defender on that node is a document. Host Defender on a container node is the other miss. Re-read Concept and Side A.
Q2

k8s-worker-02 runs pods. vm-jenkins-01 does not. How do you cover both?

Correct: a. Container Defender includes host capabilities on a container node. Host Defender is for hosts that do not run containers. App-Embedded does not learn. Re-read Defender, container, host and Flow 2.
Q3

Pilot collection payments-prod. You have not seen a real audit yet. Processes effect should be?

Correct: c. Disable turns sensors off. Global Prevent on an unlearned model freezes sidecars. Re-read Choose and the pilot checklist.
Q4

You need the kill chain for this miner, and the raw rows. Where?

Correct: b. Explorer correlates; Events is the ledger. Same type on the same resource is suppressed 24h in Explorer. Re-read Path and Side C.
Q5

You want to Prevent only when argv contains -l on nc. Custom rule uses proc.cmdline. What happens?

Correct: d. Custom rules run first inside a runtime rule, but cmdline/file.type cannot Prevent, and a Prevented process never reaches argv inspection. Re-read Flow 2 and Side B.
Q6

Why is “relearn the model after the new image tag” a runtime answer and not a CSPM answer?

Correct: a. Predictive protection is the model (process not in origin image, unexpected socket). Threat intel is the other half. They are not CSPM. Re-read Concept, Choose, and the miner story.

Sources

Related: Prisma Cloud interview — CNAPP map (CSPM, CIEM, WAAS) after you can already place Defender and the runtime rule.