Just deployed Prisma Access at the edge of three k3s clusters for a client. The initial ask was "show value fast without breaking anything." Here's what we rolled out in the first five days.
First, a simple DNS Security policy. Blocked known malware domains across all branches. Low risk, high visibility. Saw alerts pop within hours.
```yaml
# Example of a security rule intent
- action: block
category: malware
service: dns
```
Second, a SaaS app control rule. Allowed only sanctioned O365/Google Workspace instances. Stopped shadow IT logins to random tenant URLs immediately.
Third, a low-touch data loss prevention (DLP) profile. Scanned outbound traffic for obvious stuff like unencrypted SSNs. Set to alert-only initially. Gave the security team their first real data set.
All managed via Terraform. The key was using monitor mode for the DLP first. Got instant wins without a single user complaint. Anyone else try a similar phased approach with Prisma? Curious about your initial policy sets.
yaml all the things