Palo Alto Networks Prisma Access is a cloud-delivered secure access service edge (SASE) platform that provides network security and access controls for users connecting to the internet, SaaS applications, and private applications. For more information, refer to the Palo Alto Networks Prisma Access official documentation.
Integration Method: Syslog, HTTP Collector
Tables: Network Activity, HTTP Activity
This integration supports the following events.
Event | Description |
|---|---|
Network Activity | Internet and VPN network traffic events. |
Security Events | Threat detection and security events. |
CASB Events | Cloud Access Security Broker events for SaaS application usage. |
Prerequisites
The user should have administrator access to the Prisma Access management console.
The user should have access to the DataBee console.
Configuration Overview
Data ingestion for this data source is via the DataBee HTTP collector. To set this up:
Create a Prisma Access data feed in the DataBee console and note the generated API key, datasource ID, and HTTP collector endpoint URL.
Configure Prisma Access log forwarding to send syslog or HTTP-based log data to the DataBee HTTP collector endpoint.
DataBee Configuration
Login to the DataBee UI, navigate to Data > Data Feeds and click the Add New Data Feed button.
Search for Palo Alto Networks Prisma Access and select it.
Select the HTTP Collector option for the collection method.
Enter feed contact information and click Next.
Generate a new API key and save it for later use, then click Submit.
Return to the Data Feeds tab, open the newly created Prisma Access feed card, and copy the datasource ID and HTTP collector endpoint URL for use when configuring log forwarding in Prisma Access.
Prisma Access Configuration
Log in to the Prisma Access management console (Strata Cloud Manager or Panorama, depending on your deployment).
Configure a log forwarding profile to send Network Activity, Threat, and CASB event logs to the DataBee HTTP collector endpoint noted above.
Apply the log forwarding profile to the relevant security rules or service connections.
Troubleshooting Tips
If events are not appearing in DataBee, confirm that the log forwarding profile is applied to the correct security rules and that outbound connectivity to the DataBee HTTP collector endpoint is allowed.
Verify the API key and datasource ID used in the log forwarding configuration match the values shown on the feed card in the DataBee console.
Note: This page was generated from release documentation and should be reviewed by the feed owner for exact configuration field names and screenshots before publishing.