In Prisma Cloud, an alert rule is the mechanism that connects policies to specific cloud accounts or account groups. Even if policies are enabled and resource ingestion is working for a new account, no alerts will be generated for that account unless it is explicitly included in the scope of an alert rule. The alert rule dictates which policies to monitor for which accounts and triggers the alert upon violation. The fact that RQL queries work confirms data ingestion and policy logic are sound, pointing to the missing link in the alerting workflow.

A. Alert notifications are configured within an alert rule. If the account is not in an alert rule, the notification setting is irrelevant.

B. Audit trail ingestion is for different policy types (event-based), not for the configuration policies mentioned in the scenario.

C. This is directly contradicted by the problem statement, which says configuration resource ingestion is visible and RQL queries return results.

1. Palo Alto Networks

Prisma Cloud Administrator's Guide (SaaS). "Create an Alert Rule for a Build Policy". The guide states

"Alert rules enable you to select the set of policies for which you want to generate alerts... You can create alert rules that are targeted for a specific account group

a cloud account

or a repository." This highlights the role of alert rules in targeting accounts.

2. Palo Alto Networks

Prisma Cloud Administrator's Guide (SaaS). "Alerts". The documentation outlines the workflow: "Prisma Cloud generates an alert when a resource violates a policy that is enabled in an alert rule." This confirms the alert rule is the trigger.