A DevOps lead reviewed some system logs and notices some odd behavior that could be a data exfiltration attempt. The DevOps lead only has access to vulnerability data in Prisma Cloud Compute, so the DevOps lead passes this information to SecOps.
Which pages in Prisma Cloud Compute can the SecOps lead use to investigate the runtime aspects of this attack?
The SecOps lead should use the Incident Explorer page and Monitor > Events > Container Audits to investigate the runtime aspects of the attack. Incident Explorer provides a detailed view of security incidents, and Container Audits allow for monitoring and investigating events related to container activities. These are the most appropriate tools for examining suspicious runtime behavior and potential data exfiltration attempts.
Compliance vulnerabilities should already be seen by DevOps. SecOps should see Audits.
option C is the correct
option C is the correct choice for the SecOps lead to investigate the runtime aspects of the attack in Prisma Cloud Compute.
C is the correct option. DevOps team has noticed a runtime incident (odd behavior) which you can explore either through Incident Explorer or Container audits.
C container audits under events)