This article explains how to connect Prisma Cloud Compute to Workbench.
Step 1: Add service account
Service accounts differ from user accounts in that they don't need an email address associated with them and don't need to be validated or activated in an external system before they can be used. You must have the System Administrator role on Prisma Cloud Compute to add a service account.
Caution
Think carefully about the information you provide, because after you create a service account, you can't make changes. You must delete it and start over.
-
Select Settings > Users and then select Add New > Service Account. The Account Details tab appears.
-
Type these account details:
-
Service Account Name: expel_service_account
-
Role: System Admin
-
-
Click Next. The Access Key Details tab appears.
-
Type an Access Key Name (your choice).
Caution
Do NOT select Enable Expiration.
-
Click Save & Create (1 of 2) to generate the key. The Access Key Results screen appears.
-
Click Download .csv file to download your access key as a .csv file and then store it in a secure location.
Note
Access keys are not stored on Prisma Cloud Compute, so this is the only opportunity that you have to download it.
-
To view the new service account, select Settings > Users and type the service account name in the Search field. If there is a problem with the service account, delete it and start over at Step 1.
Step 2: Determine Prisma Cloud Compute console URL
Prisma Cloud Compute can be either a self-hosted or SaaS installation. The Prisma Cloud Compute console URL depends on your specific installation. Use the following sections to determine your Prisma Cloud Compute console URL.
Self-hosted installation
For self-hosted environments, the Prisma Cloud Compute API is exposed on port 8083 (HTTPS). This port is specified at install time in twistlock.cfg.
-
For Kubernetes Installations (most common):
-
Console service is exposed by a LoadBalancer.
-
The console URL is the LoadBalancer followed by port 8083:
https://<LOAD_BALANCER>:8083
-
-
For Onebox installations:
-
Console installed on a standalone host.
-
The Console URL is the IP address or DNS name of the host followed by port 8083:
https://<IP_ADDRESS>:8083
-
SaaS installation
-
Log into Console.
-
Go to Manage > System > Utilities.
-
The console URL is listed under Path to Console at the bottom of the page.
Step 3: Configure the technology in Workbench
Note
Expel secures all login information our SOC analysts need about your devices in a MFA password product. Access to this login information is protected using our internal MFA processes. To learn more about the IP addresses all Expel traffic comes from, go here.
-
Go to https://workbench.expel.io/settings/security-devices?setupIntegration=prisma_cloud_compute.
-
Do one of the following:
-
If you are running a Prisma Cloud Compute SaaS installation, then select Cloud for Where is your device.
-
If you are running a Prisma Cloud Compute self-hosted installation, select On-prem and then select Assembler from the list. Select the assembler you set up in Getting connected to Expel Workbench
-
-
For Name and Location type Prisma and for Location either Cloud or On-prem.
-
For Username type the Access Key ID created in Step 1.
-
For Password type the Secret Access Key created in Step 1.
-
For Server address type the console URL determined in Step 2.
-
For Prisma Cloud Compute multi-tenant (only available for on-prem deployments), select Yes or No.
Comments
2 comments
It seems that this documentation might be a bit outdated.
I found that `Step 1` isn't really necessary (creating the expel_analyst@expel.io user).
If you follow the documentation, you will notice that Step 2 creates a service account and an access key and then never makes use of either.
The way I've configured my system:
1 - Created the service account as described in step 2 (except that you don't have to provide the timezone anymore in Prisma)
2 - Found the URL requested on step 3 by going to: Compute -> Manage -> System and then clicking the `Utilities` tab and scrolling all the way down until I found the `Path to Console` box with the URL.
3 - For step 4, I used the Access Key ID as the username (for both the connection settings and console settings) and the Secret Key of that access key as the password.
Save everything and it should just work!
I hope this helps someone else :)
Hi Henrique, thank you for your feedback. We will review this and update the guide accordingly. Thank you!
Please sign in to leave a comment.