We're evaluating DSPM tools for a multi-cloud environment (AWS, Azure, GCP). Prisma Cloud's DSPM module is on the shortlist.
Key requirements:
* Accurate classification across S3, Blob Storage, SQL, NoSQL.
* Sensitive data lineage and flow mapping.
* Automated policy response (block, quarantine, alert).
Specific questions for those who've deployed it:
* How is the detection accuracy for custom data patterns? False positive rate?
* Performance impact on data lakes or high-throughput RDBMS?
* Integration with existing SIEM/WORM storage for audit trails?
* Any major gaps compared to dedicated DSPM vendors?
Example of the policy structure we'd need:
```hcl
resource "prismacloud-dspm-policy" "pci_quarantine" {
name = "Auto-quarantine PCI Data in Non-Compliant Storage"
data_pattern = "PCI"
cloud_targets = ["aws.s3", "azure.blob"]
conditions {
encryption = false
network_access = "public"
}
action = "QUARANTINE"
}
```
Looking for real-world operational feedback, not sales specs. What breaks, what's tedious, what actually works.
Trust but verify, then don't trust.