Cloud Security (CSPM): support reference¶
Internal. The customer-facing explanation is in the screen reference.
CSPM is a reporting surface, not a working module: nine screens across two families, no row actions on any of them. Everything it shows comes from a cloud posture platform, and almost every ticket is really a question about that platform or about scope.
Two families of screens — establish which one the caller is on¶
| Family | Screens | Fed by |
|---|---|---|
| Prisma CSPM | Asset Inventory, Alerts, Compliance, Policies | Prisma Cloud CSPM |
| CSPM | Assets, Issues, Cases, Rules, Policies | Cortex CSPM, SentinelOne CSPM |
Both families have a screen called Policies and both have an asset list. A caller who says "the CSPM policies page is empty" may be on either, and the two are fed by different integrations with different sync paths — so the first question on any CSPM ticket is which family, and the quickest way to settle it is the column set: Prisma's asset list has Total Policies and Alerts Distribution; the CSPM one has Issues → and Cases →.
The CSPM family also has a vocabulary Prisma does not: a rule raises issues, and issues are grouped into cases. Callers use "alert", "finding" and "issue" interchangeably; on the CSPM screens only issue exists.
Sync paths differ between the two CSPM sources¶
- Cortex CSPM has two sync actions on its integration page: Master Sync brings the reference data — rules and policies — and Sync brings the assets, issues and cases. An estate with rules and policies but no issues has had a master sync and no data sync, which is the normal state right after configuration.
- SentinelOne CSPM has a single Data Sync.
Both pages show Sync Status, Last Sync Type, Last Initiated At, Last Processed At and Last Completed At. Initiated without Completed is a sync still running or one that failed; look at the status before concluding the data is missing.
Nothing is edited here¶
There are no row actions because there is nothing to change. Alerts are resolved by fixing the cloud resource or by changing the policy in the source platform; NxSAM reflects the result at the next sync.
A caller looking for a way to close an alert here is looking for something that does not exist, and pointing them at the source platform is the whole answer.
Policy against reason¶
Two columns that are easy to conflate and answer different questions:
| Column | Means |
|---|---|
| Policy | The rule that was evaluated |
| Reason | The specific configuration that failed it |
The pair is the point. The policy says what is required; the reason says what is actually there. A reason column that merely restates the policy is a source-platform configuration issue, not a display fault.
Three integrations, three vendors, one module¶
Prisma Cloud, Cortex CSPM and SentinelOne all feed CSPM, with separate credentials. Prisma additionally appears as a container integration, which is a different connection entirely. Prisma feeds the Prisma CSPM screens only; Cortex and SentinelOne feed the CSPM screens only.
"We already connected Prisma" is a common reason for an empty CSPM module — the container one was connected.
All three ship unconfigured, so an empty screen with a prompt is the correct first-run display rather than a fault.
Standards are opt-in¶
The compliance standards list ships with everything available and only some enabled. A customer reporting that a benchmark "isn't being assessed" usually has it disabled here.
Rules, issues and cases do not have to reconcile either¶
On the CSPM screens:
- An issue touches one or more assets; its Asset Count is that number. The sum of asset counts across issues exceeds the number of assets, because one asset can carry many issues. That is not double counting.
- A case's severity is set by the platform and does not have to equal its worst issue.
- A rule that is disabled can still show an Issues Count — those issues are historical and nothing is re-evaluating them.
- A policy's Rules Count is the rules it contains, not the rules producing issues.
Alerts, assets and policies do not have to reconcile¶
- An asset with no alerts is compliant, or not covered by any enabled policy.
- A policy with no alerts is either satisfied everywhere or applies to no asset present.
- Total Policies on an asset counts what applies to it, not what failed.
Sums that "do not add up" across the three screens are usually this, and are not an error.
What to collect before escalating¶
- Which family of screens — Prisma CSPM or CSPM — and which integration feeds it.
- Which cloud account, and which cloud provider — the same policy name exists across AWS, Azure and GCP.
- The alert ID and its policy ID (Prisma), or the issue ID with its case and rule IDs (CSPM).
- When the last sync ran, which kind it was, and whether it completed.
- Whether the standard concerned is enabled (Prisma), or whether the rule and its policy are enabled (CSPM).
- For empty modules: which integration was configured — the container Prisma connection is the usual wrong answer.