The "Relearn" function in Prisma Cloud Compute is designed to update an existing runtime model without discarding it. When anomalies are identified as false positives, it means the model is too restrictive. Initiating "Relearn" keeps the established model intact but enters a learning phase where new, legitimate behaviors (processes, network connections, etc.) are observed. These new behaviors are then added to the model, which can be reviewed and saved by the administrator, thus resolving the false positives.

A. Deleting the model and relearning from scratch for a fixed period is not the function of "Relearn"; this would be a more disruptive reset action.

B. Relearn does not automatically add all past anomalies; it initiates a new learning period to observe and incorporate new, persistent behaviors into the model.

C. This describes the action of clearing or resetting a model, which erases all learning. "Relearn" is an additive process that builds on the existing model.

1. Palo Alto Networks

"Prisma Cloud Compute Edition Administrator's Guide"

Version Darwin. Section: "Monitor > Runtime > Image analysis > Runtime model". The documentation explains that models are learned and can be refined. The "Relearn" feature is described as a method to augment an existing model with new

observed activity.

2. Palo Alto Networks

"Understanding Runtime Protection in Prisma Cloud Compute"

(paloaltonetworks.com/blog). This resource explains the concept of behavioral learning and modeling

where "Relearn" is the mechanism to adapt the model to evolving application behavior without starting from zero.