This lab was developed with our partner, Palo Alto Networks. Your personal information may be shared with Palo Alto Networks, the lab sponsor, if you have opted in, to receive product updates, announcements, and offers in your Account Profile.
Prisma Cloud is the industry’s most complete cloud-native application protection platform (CNAPP), with the industry’s broadest security and compliance coverage—for infrastructure, workloads, and applications, across the entire cloud-native technology stack—throughout the development lifecycle and across hybrid and multicloud environments.
In this lab, you will gain hands-on experience with Prisma Cloud's workload protection platform (CWPP) to secure Google Kubernetes and Compute Engine. You will learn how CWPP protects all workloads, regardless of their underlying compute technology, through its cloud native and API enabled technologies. In addition, you will also learn how CWPP provides web application and API security (WAAS) for any cloud native architecture.
In this lab, you will perform the following tasks:
Read these instructions. Labs are timed and you cannot pause them. The timer, which starts when you click Start Lab, shows how long Google Cloud resources are made available to you.
This hands-on lab lets you do the lab activities in a real cloud environment, not in a simulation or demo environment. It does so by giving you new, temporary credentials you use to sign in and access Google Cloud for the duration of the lab.
To complete this lab, you need:
Click the Start Lab button. If you need to pay for the lab, a dialog opens for you to select your payment method. On the left is the Lab Details pane with the following:
Click Open Google Cloud console (or right-click and select Open Link in Incognito Window if you are running the Chrome browser).
The lab spins up resources, and then opens another tab that shows the Sign in page.
Tip: Arrange the tabs in separate windows, side-by-side.
If necessary, copy the Username below and paste it into the Sign in dialog.
You can also find the Username in the Lab Details pane.
Click Next.
Copy the Password below and paste it into the Welcome dialog.
You can also find the Password in the Lab Details pane.
Click Next.
Click through the subsequent pages:
After a few moments, the Google Cloud console opens in this tab.
Prisma Cloud Runtime Defense contains features to provide predictive protection and threat-based protection for containers and machines.
These protections are delivered through an array of sensors that monitor the filesystem, network, and process activity. Each sensor is implemented with its own set of rules and alerts. This unified architecture simplifies the administrator experience and also demonstrates what Prisma Cloud automatically learns from each image.
In this step, access a GKE cluster. Then, deploy a sample application to the cluster. Later in the lab, you will protect this application by Prisma Cloud Defenders.
Click Activate Cloud Shell at the top of the Google Cloud console.
In Cloud Shell, authenticate to the GKE cluster.
Verify you have successfully authenticated to the cluster.
In Cloud Shell, create the sample web application deployment.
Verify the deployment progress. Proceed to the next step once all of the pods READY state show 1/1.
Retrieve the sample application's external service IP address.
EXTERNAL-IP shows pending, please wait and try again. It can take several minutes for the public IP to attach to the cluster.
Copy the EXTERNAL-IP and paste it into a new browser tab (use http://EXTERNAL-IP). The following page should appear.
In this step, configure Prisma Cloud's security agent, Defender, to secure the containers within the GKE cluster. Prisma Cloud leverages Docker’s ability to grant advanced kernel capabilities to enable Defender to protect your whole stack, while being completely containerized and utilizing a least privilege security design.
Access the Prisma Cloud console:
| Key | Value |
|---|---|
| Console | |
| Username | |
| Password |
Go to Manage → Defenders → Names. Select Click to Add to add the console's address to the SAN list.
On the Prisma Cloud Console, click Deployed Defenders → Manual Deploy.
Configure the Defender deployment as follows:
→ Method: Orchestrator
→ Orchestrator type: Kubernetes
→ PCC Name: SAN name you previously added
→ Workstation Platform: Linux x86_64
→ Collect Deployment and Namespace labels: Check ON
Under Installation Scripts → Install, click Copy.
From the /prisma_cloud directory in Cloud Shell. Paste the install script to deploy the Defenders.
On the Prisma Cloud Console, click Deployed Defenders. A Defender is deployed on each node in the GKE cluster.
On the Prisma Cloud Console, go to Radars → Containers. Select cluster1.
Click the mongo:latest container to view all information Prisma Cloud has found about the container.
Click Vulnerabilities to see the various CVEs associated with the selected container.
Click mongo:latest → Processes to view all the processes executed by the container.
(Optional) Feel free to explore other information and events Defender has collected from the GKE cluster.
In this step, create a runtime policy to alert on all network traffic. Then, simulate a reverse shell attack. During the attack, the attacker operates as a listener and the victim as an initiator. The attacker looks for initiators that send out remote connection requests, on a specific port, to the attacker's machine. This enables the attacker to deliver additional malware to the network to ultimately exfiltrate sensitive data.
In Prisma Cloud, go to Defend → Runtime → Container Policy. Click + Add Rule.
Enter alert-networking for the name.
Click the Networking tab and configure:
→ Listening ports effect: Alert
→ Outbound internet ports effect: alert
→ Outbound IPs effect: alert
Click Save.
In Cloud Shell, create an attacker pod. This pod initiates the reverse shell connection from the victim pod.
Log into the attacker pod.
Create a reverse shell connection to the attacker pod.
Go to Radars → Containers to observe the attacker pod (ncat:v1).
→ Clear the search filter and select the default namespace.
→ Select the ncat:v1 container.
→ Click This image is involved in an incident
Click View live forensic to view more information about the reverse shell connection.
Without secure hosts, you cannot have secure containers. Host machines are a critical component in the container environment, and they must be secured with the same care as containers. Prisma Cloud Host Defender collects data about your hosts for monitoring and analysis.
Runtime host protection is designed to continuously report an up-to-date context for your hosts. You can set detection for malware, network, log inspection, file integrity, activities and custom events. Some of the detected events can only be alerted on, while others can be prevented.
In this step, deploy Host Defender to an existing Jenkins virtual machine running on Google Compute Engine (GCE).
Exit your session with the attacker pod to return to Cloud Shell.
In Cloud Shell, connect to the Jenkins server.
In the Prisma Cloud, go to Manage → Defenders → Manual Deploy.
Configure the deployment as follows.
→ Method: Single Defender
→ Defender type: Host Defender - Linux
→ Console Name: SAN name you previously added
→ Under Installation → Scripts Install, click Copy.
While logged into the jenkins machine in Cloud Shell, paste the install command.
Go to Monitor → Vulnerabilities → Hosts. Select jenkins. Feel free to click the various tabs to learn more about the jenkins host.
By default, Prisma Cloud ships with an empty host runtime policy. An empty policy disables runtime defense entirely. In this step, create a new rule to enable runtime defense. This enables Defender to automatically collect data about the host.
Go to Defend → Runtime → Host Policy. Click Add rule.
Click the Anti-malware tab and configure:
→ Rule name: My First Rule
→ Denied process events: Prevent
→ Prevent processes by paths: cat
Click the Networking tab and configure:
→ Denied domains effect: Prevent
→ Domains: weather.com, *.weather.com
Click the Log inspection tab and configure:
→ Specify path to log file: /var/log/auth.log
→ Inspection expression: .
→ Click Add rule.
Click the File integrity tab, click Add rule, and configure:
→ Path: /etc
→ Check On: Write, Read, Metadata
→ Click Add file integrity rule.
Click the Activities tab and configure:
→ Check On: Docker commands
→ Click Save.
In Cloud Shell, if you have been logged out of the Jenkins server, log in again.
Test the Anti-malware runtime policy by executing cat on the Jenkins server.
cat process.
Test the Networking runtime policy by performing an nslookup.
Test the File integrity runtime policy by modifying /etc/resolv.conf.
Test the Host Activity Monitoring runtime policy by running docker.
In Prisma Cloud, go Go to Monitor → Events to investigate the Runtime Policy enforcement results.
Click Host audits to investigate the Anti-malware and Networking runtime enforcement results.
Click Host log inspection to investigate the Log Inspection runtime results.
Click Host file integrity to investigate the File Integrity runtime results.
Click Host Activities to investigate the Activities runtime results.
Log4Shell (CVE-2021-44228) was a zero-day vulnerability in Log4j, a popular Java logging framework, involving arbitrary code execution.
Before an official CVE identifier was made available on December 10th, 2021, the vulnerability had existed unnoticed since 2013 and was privately disclosed to the Apache Software Foundation on November 24, 2021.
Apache gave Log4Shell a CVSS severity rating of 10, the highest available score. The exploit was simple to execute and is estimated to affect hundreds of millions of devices.
In this step, create the environment for testing the vulnerability. In this environment, an attacker pod attempts to exploit two applications. The first application is protected by Prisma Cloud, the second application is not.
Exit your session with the Jenkins server to return to Cloud Shell.
In Cloud Shell, deploy the Log4Shell containers to our GKE cluster.
Verify the deployment progress. Proceed to the next step once all of the pods READY state show 1/1.
In Prisma Cloud, go to Radars → Containers. Clear the filter to make all resources appear.
In the log4shell namespace, click the container l4s-demo-app:1.0 → Vulnerabilities.
Find the Log4Shell vulnerability. Click the vulnerability to examine more information about it.
Click the Layers tab to review the vulnerabilites by layers within the container image.
In the previous step, two identical applications were created, vul-app1 and vul-app2.
In this step, configure Prisma Cloud WaaS policies to protect only the vul-app1 application. For demonstration purposes,vul-app2 is not protected by Prisma Cloud.
Go to Manage → Collections and Tags → Add collection. Configure the collection as follows:
→ Name: Collection 1
→ Containers: vul-app1
→ Images: l4s-demo-app:1.0
→ Click Save.
Go to Defend → WAAS → Container. Click Add rule.
Configure the WAAS rule as follows:
→ Rule name: WAAS Rule
→ Scope: Collection 1
→ Click Save.
Expand WaaS Rule. Click Add app.
In the App definition tab:
→ Click Add endpoint.
→ (Optional) Set App ports to 8080
→ Click Create.
In the Custom rules tab, click Select rules.
→ Search for log4j.
→ Select both log4j rules. Click Apply.
Set both rules to Prevent, then click Save.
In this step, attempt to expose the log4j vulnerability on the vul-app1 and vul-app2 pods.
In Cloud Shell, assign the IP address of the vul-app1 and vul-app2 pods to environment variables.
Pass the environment variables to the attacker pod and log into the attacker.
Attempt to expose the vulnerability on vul-app1 & vul-app2.
Event ID: 3ba1449d-d2db-1442-8b87-cadce8e693b5
Finally, within Prisma Cloud, investigate the results of the GKE log4j exploit.
In Prisma Cloud, go to Radars → Containers. Set the filter to the log4shell namespace. Click the l4s-demo-app:1.0.
att-machine:1.0) attempted to make a connection on TCP:8080 to the l4s-demo-app:1.0 container.
View the aggregated WAAS event logs. Go to Monitor → Events → WAAS. Select WAAS for containers → Custom Rule.
Examine the results of the WAAS event logs.
vul-app1 was successfully detected and prevented by Prisma Cloud CWPP.
You have successfully learned the fundamentals of Prisma Cloud Workload Protection on Google Cloud. You have learned how to secure Google Kubernetes and Compute Engine with Prisma Cloud Defenders. You have also demonstrated the ability to use Prisma Cloud WAAS engine to successfully prevent a real world threat.
...helps you make the most of Google Cloud technologies. Our classes include technical skills and best practices to help you get up to speed quickly and continue your learning journey. We offer fundamental to advanced level training, with on-demand, live, and virtual options to suit your busy schedule. Certifications help you validate and prove your skill and expertise in Google Cloud technologies.
Manual Last Updated: July 2, 2024
Lab Last Tested: July 2, 2024
Copyright 2025 Google LLC. All rights reserved. Google and the Google logo are trademarks of Google LLC. All other company and product names may be trademarks of the respective companies with which they are associated.
Este conteúdo não está disponível no momento
Você vai receber uma notificação por e-mail quando ele estiver disponível
Ótimo!
Vamos entrar em contato por e-mail se ele ficar disponível
Um laboratório por vez
Confirme para encerrar todos os laboratórios atuais e iniciar este