This section describes the incident types surfaced in Incident Explorer.
Altered binary
Backdoor admin accounts
Backdoor SSH access
Brute force
Crypto miners
Execution flow hijack attempt
Kubernetes attack
Lateral movement
Malware
Port scanning
Reverse shell
Suspicious binary
https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-admin-compute/runtime_defense
/incident_types

https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-admin-compute/continuous_integration
/set_policy_ci_plugins

https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-admin-compute/access_control/rbac

In Prisma Cloud, configuration policies are categorized to align with the different phases of the cloud security lifecycle, emphasizing a holistic approach to cloud security management. The subtypes "Build and Run" encapsulate this approach by covering both the development phase (Build) - where cloud resources and applications are designed and created, and the operational phase (Run) - where these resources and applications are deployed and actively used. This categorization ensures that security and compliance are integral throughout the lifecycle, from the initial creation of cloud infrastructure and applications to their deployment and day-to-day operation, thereby enhancing the overall security posture.