What is the behavior of Defenders when the Console is unreachable during upgrades?

Question

Options

• ADefenders will fail open until the web-socket can be reestablished.
• BDefenders will fail closed until the web-socket can be re-established
• CDefenders continue to alert, but not enforce, using the policies and settings most recently cached
• DDefenders continue to alert and enforce using the policies and settings most recently cached

• A
  5% (1)
• B
  5% (1)
• D
  90% (19)

Explanation

Prisma Cloud Defenders are designed to operate autonomously even when the Console is temporarily unreachable. They cache the most recently received policies and settings locally. During Console downtime or during upgrades when the websocket connection is interrupted, Defenders continue to both alert on policy violations AND enforce rules (block/prevent actions) using this locally cached policy set. This is a 'fail secure' design - security is maintained without any gap. Option A (fail open) would mean security stops, which is incorrect. Option B (fail closed) would mean all traffic is blocked, also incorrect. Option C partially describes the behavior but incorrectly states Defenders only alert without enforcing.

No community discussion yet for this question.