
#### Incident Fields

Associated the following fields to "Prisma Cloud Compute Audit v3" incident type:
- **Prisma Cloud Compute Raw Alert JSON**
- **Prisma Cloud Compute Activity Type**
- **Prisma Cloud Compute AppID**
- **Prisma Cloud Compute Category**
- **Prisma Cloud Compute Command**
- **Prisma Cloud Compute Container**
- **Prisma Cloud Compute FQDN**
- **Prisma Cloud Compute Forensic**
- **Prisma Cloud Compute Function**
- **Prisma Cloud Compute Host**
- **Prisma Cloud Compute Image**
- **Prisma Cloud Compute Interactive**
- **Prisma Cloud Compute Kubernetes Resource**
- **Prisma Cloud Compute Labels**
- **Prisma Cloud Compute Line**
- **Prisma Cloud Compute Log File**
- **Prisma Cloud Compute Message**
- **Prisma Cloud Compute Region**
- **Prisma Cloud Compute Rule**
- **Prisma Cloud Compute Runtime**
- **Prisma Cloud Compute Service**
- **Prisma Cloud Compute Type**
- **Prisma Cloud Compute User**

Added the following new incident fields:
- New: **Prisma Cloud Compute Namespaces**
- New: **Prisma Cloud Compute Cluster**
- New: **Prisma Cloud Compute Namespaces**


#### Layouts

##### New: Prisma Cloud Compute Audit Layout v3

New: A new layout for the new "Prisma Cloud Compute - Audit Alert v3" incident type.
The following changes were added:
- Fixed an issue with the buttons `Add Hash to Prisma Blocklist` and  `Add IP to Prisma Malicious Feed` which prevented the buutons from working properly.
- Added `item owner Email` to the `Case Details` section.
- Changed the name of the tab `Container Forensics` to `Forensics` since this tab now includes host forensics on host events.


#### Playbooks

##### Prisma Cloud Compute - Audit Alert

- Deprecated. Use "Prisma Cloud Compute - Audit Alert v3" instead.

##### Prisma Cloud Compute - Audit Alert v2

- Deprecated. Use "Prisma Cloud Compute - Audit Alert v3" instead.

##### New: Prisma Cloud Compute - Audit Alert v3

New: Default playbook for parsing and enrichment of Prisma Cloud Compute audit alerts.
  The playbook has the following sections:
  Enrichment:
  - Image details
  - Similar container events
  - Owner details
  - Vulnerabilities
  - Compliance details
  - Forensics
  - Defender logs.

  Remediation:
  - Block Indicators - Generic v3
  - Cloud Response - Generic
  - Manual Remediation

##### New: Prisma Cloud Compute - Audit Alert Compliance Enrichment

New: This is a sub-playbook of the "Prisma Cloud Compute - Audit Alert v2" playbook.
Retrieves the following information:
- Alert profiles
- Container WAAS policies
- Image compliance issues

##### New: Prisma Cloud Compute - Audit Alert Enrichment

New: This is a sub-playbook of the "Prisma Cloud Compute - Audit Alert v2" playbook.
It does the following:
- Runs the "Prisma Cloud - Get Account Owner" playbook in order to retrieve potential owners for the alert.
- Sets the incident link to the layout.
- Pulls image details and alerts.
- Pulls host scan results.

##### New: Prisma Cloud Compute - Audit Alert Vulnerabilities Enrichment

New: This is a sub-playbook of the "Prisma Cloud Compute - Audit Alert v2" playbook.
It creates CVE indicators based on image or host vulnerabilities.

##### New: Prisma Cloud Compute - Container Forensics

New: This is a sub-playbook of the "Prisma Cloud Compute - Audit Alert v2" playbook.
Gets the container profile and forensics.

##### New: Prisma Cloud Compute - Get Container Events

New: This is a sub-playbook of the "Prisma Cloud Compute - Audit Alert v2" playbook.
- Get container WAAS events
- Get runtime container events and set it to layout.

##### New: Prisma Cloud Compute - Get Defender Logs

New: This is a sub-playbook of the “Prisma Cloud Compute - Audit Alert v2” playbook
- Gets defender logs and sets them to layout
- Downloads defender logs
- Gets defender backups


#### Mappers


##### Palo Alto Networks Prisma Cloud Compute - Incoming Mapper
- 
- Added support for the new "Prisma Cloud Compute - Audit Alert v3".


#### Classifiers

##### Palo Alto Networks Prisma Cloud Compute - Classifier

Changed the audit events type to `Audit Alert v3`.


#### Layout Rules


##### New: Prisma Cloud Compute - Audit Alert v3 Layout Rule

New: A new layout for `Prisma Cloud Compute - Audit Alert v3` incidents.


#### Incident Types

- New: **Prisma Cloud Compute Audit v3**

- **Prisma Cloud Compute Audit v2**


#### Triggers Recommendations

New: **Prisma Cloud Compute - Audit Alert v3 Trigger**

