Internet exposure detection - CNA detects assets that are exposed to unrestricted public network access. This is called internet exposure detection. - Administrator Guide - Cortex CLOUD

When CNA determines that an asset is potentially exposed to the internet, it forwards the public IP address or a fully qualified domain name (FQDN) to the external scanning service. The service verifies whether the IP or FQDN already exists in its database. If a match is found, the service notifies CNA and sends the additional information retrieved by the scan. The scan covers the entire internet rather than a subset of IP addresses owned by Cortex Cloud customers.

The following diagram illustrates what happens when CNA examines a virtual machine:

As illustrated in the diagram:

Cortex Cloud includes out-of-the box internet exposure rules and allows you to define custom internet exposure rules. See Create a Network Exposure Rule .Create a Network Exposure Rule

CNA detects internet exposure for the following cloud services and asset types:

CNA supports Kubernetes containers exposed to the internet behind a load balancer or behind an ingress.

CNA detects workloads exposed to the internet in Kubernetes clusters using Kubernetes configuration analysis and external scanning. The workloads must meet these requirements:

A workload is considered reachable from the internet when the following criteria are met:

CNA detects inbound exposure of workloads deployed behind a Palo Alto Networks Next-Generation firewall (NGFW). To scale security appliances in AWS, you can use Gateway Load Balancers (GWLBs) for "transparent" firewall deployments where AWS encapsulates/decapsulates traffic. This topology is considered isolated or distributed, since the firewall deployment is “embedded” within the VPC.

The following diagram illustrates a network topology supported by CNA:

The example network topology includes a single VPC where traffic to the target web server (top right) is forced to go through the GWLB (and thus through the NGFW VM-Series instances) to allow firewall inspection of the incoming and outgoing traffic. In a real-life scenario, there may be several firewall instances in the GWLB target group, however for brevity the diagram only shows one. The firewall EC2 instance itself (bottom right) is detected as a NGFW based on its image.

Cortex Cloud analyzes your VPC topology and verifies that it is similar to the one described in this example. Next, it verifies that the GWLB target group instances are NGFW VM-Series instances.

CNA detects inbound exposure of workloads deployed behind an AWS Web Application Firewall (AWS WAF). AWS WAF is a managed web application firewall service that can be associated with an Application Load Balancer (ALB) to inspect and filter incoming HTTP/HTTPS traffic based on configurable security rules (Web ACLs).

The following diagram illustrates a network topology supported by CNA:

The example network topology includes a VPC where traffic to the target web server (top right) is forced to go through the AWS WAF Web ACL, which inspects incoming HTTP/HTTPS requests before they are forwarded by the ALB to the target instance.

Cortex Cloud analyzes your VPC topology, identifies ALBs with associated WAF Web ACLs, and includes the WAF as a protective node in the exposure path. Workloads behind a WAF-protected ALB are marked as protected by a firewall in the exposure findings.