Tutorials / Code & Cloud

Cloud Security Posture Management (CSPM)

Prancer delivers robust CSPM capabilities across Azure, AWS, Google Cloud, and private Kubernetes environments, enabling automated security discovery, misconfiguration detection, compliance checks, risk visualization, and remediation—all under a unified platform.

  • * *

Step 1: Launch CSPM via Autonomous Security Wizard

1. Navigate to the Autonomous Security Wizard in the portal.

<tutorialimage module="m11" index="1" alt="Image 18 — Module 11 (local #1)"></tutorialimage>

2. Select a cloud provider (Azure, AWS, or GCP) and enter the required connection credentials.

3. Optionally limit the scanner’s reach—for instance, in Azure, choose specific subscriptions even if the Service Principal has broader access. Read-only permissions are generally sufficient for discovery and posture evaluation.

4. Submit the wizard. Prancer will:

  • Crawl and identify cloud resources
  • Run CSPM checks to detect misconfigurations and compliance gaps
  • Optionally generate PAC manifests and run pentests if configured
  • * *

Step 2: Explore CSPM Results in Infrastructure Findings

1. Access Infrastructure Findings from the main menu to review CSPM outcomes.

<tutorialimage module="m11" index="2" alt="Image 19 — Module 11 (local #2)"></tutorialimage>

2. Use filters to refine results by cloud provider, collection, compliance standard, or resource type.

3. The summary panel provides quick stats—total tests run, resources evaluated, and compliance metrics.

4. The findings table displays failed checks by default, but you can toggle to show passed or all. Sort, search, and browse individual results.

  • * *

Step 3: Drill Down on Finding Details

Click any finding to view details, including:

  • Title, Description, and direct link to the impacted cloud resource
  • More panel showing associated compliance requirements, including framework references and rule IDs
  • Action options:
  • Exclude Resource from All Tests
  • Exclude Resource from This Test Only

These exclusions are applied on the next scan run. To manage exclusions, visit Collection Management > Exclusions.

  • * *

Step 4: Download Findings & Leverage Auto-Remediation

  • You can export findings in CSV format for external analysis.

Step 5: Remediation Support

Auto-Remediation

Prancer's Auto Remediation capabilities help streamline fixing CSPM issues:

  • Toggle the Remediate switch on the findings table to highlight fixable items (blue = pending remediation, green = already remediated)
  • Open a remediable finding and click Remediate—Prancer can apply the fix in your cloud environment directly, provided your connector has write access.
  • * *

AI-Powered Remediation

Prancer includes OpenAI-powered guidance for fixing CSPM issues:

  • Finding details include:
  • Suggested remediation steps
  • Remediation script/code snippets
  • The first load of AI results may take a few seconds; subsequent views are cached.
  • This uses a private, dedicated OpenAI model (via Microsoft), ensuring your data is redacted and secure—not part of ChatGPT or general model training.

Step 5: CSPM Correlation with Application Findings

Prancer enables a powerful integration where CSPM results can be directly correlated within Application Findings. This is particularly valuable when performing application-level pentesting on a resource like a cloud VM. By linking the resource’s infrastructure context (CSPM findings) directly to the application scope, you gain a cohesive, holistic view of security posture.

How to Enable Correlation

To activate this feature, simply add the cloud resource identifier to your PAC manifest. Within the PAC configuration file (accessible via Inventory Management → PAC Configuration), insert the resourceId locator like so:

ResourceId: /subscriptions/<sub-id>/resourceGroups/<rg>/providers/Microsoft.Compute/virtualMachines/myVM

Here, ResourceId points Prancer to the underlying infrastructure component tied to ApplicationProfile: Name: MyAppOnCloudVM the application, allowing it to gather CSPM insights for that VM.

  • * *

Viewing Correlated Results During Scan

After adding the ResourceId and submitting your scan, navigate to Application Findings. You will now find an extra tab labeled "Attack Surface & CSPM"—appearing alongside your standard findings.

This tab consolidates:

  • Infrastructure misconfigurations detected by CSPM
  • Application-level vulnerabilities from pentesting
  • Visual and contextual linkage between them, streamlining remediation efforts
  • * *

Why This Matters

| Benefit | Description |

| Unified View | See both application and underlying infrastructure risks in one place. |

| Efficient Remediation | Pinpoint the root cause—whether code-level or configuration-level—more quickly. |

| Better Risk Context | Understand how cloud misconfigurations might affect app security. |

  • * *

Summary: End-to-End CSPM Workflow

| Step | Action |

| 1 | Run Autonomous Security Wizard → select cloud provider → configure limits → submit |

| 2 | View CSPM results in Infrastructure Findings, filter by provider, collection, compliance |

| 3 | Drill into finding for details & compliance context; apply exclusions if needed |

| 4 | Export results via CSV and toggle Remediate for supported items |

| 5 | Use AI-generated remediation advice and fix directly in cloud (with appropriate access) |

| 6 | Complete the Correlation between the Application and Infrastructure layers |

  • * *

Additional Screenshots

Additional screenshots, in order of appearance.

<tutorialgallery module="m11" startIndex="3"></tutorialgallery>