Palo Alto Networks - Strata Cloud Manager

Prisma Access Content Pack

This content pack enables XSOAR to integrate with Palo Alto Networks Prisma Access. It includes 2 integrations.

Prisma Access Egress IP feed

Dynamically retrieve and allow IPs Prisma Access uses to egress traffic to the internet and SaaS apps.

This integration can be used as a TIM feed to fetch indicators, or if a playbook starts from a non-indicator trigger it can use the command to get the IPs.

Prisma Access

Integrate with Prisma Access to query the status of the service and take actions.

The integration includes commands to:

Force logout a specific user from Prisma Access
List currently active users
Run a Prisma Access query (e.g. getGPaaSLast90DaysUniqueUsers)
Run a custom CLI command

The integration uses both the Panorama XML API and SSH into the PAN-OS CLI. SSH is based on the netmiko library and will use the netmiko docker image.

Prisma SASE

Integrate with Prisma SASE to view or make changes to Prisma Access configurations.

The integration includes commands to:

Create, update, delete and get security rules.
Create, update, delete and get address objects.
Create, update, delete and get external dynamic lists.
Create, update, delete and get custom URL categories.
Create, update, delete and get tags.
Create, update, delete and get address groups.
Get configuration jobs.
Push all configuration jobs.

The integration uses the Prisma SASE Multi-tenant API documented here: Prisma SASE API.

Pack Contributors:

JD Plant

Contributions are welcome and appreciated. For more info, visit our Contribution Guide.

Name	Description
Palo Alto Networks - Strata Cloud Manager	Provides commands for interaction with Prisma SASE API.
Prisma Access	Integrate with Prisma Access to monitor the status of the Service, alert and take actions.
Prisma Access Egress IP feed	Dynamically retrieve and add to allow list IPs Prisma Access uses to egress traffic to the internet and SaaS apps.

Name	Description
Prisma SASE - Quarantine a SentinelOne Host With Active Threat	Goal This playbook is designed to automatically quarantine a SentinelOne host in response to a new threat incident trigger using Prisma SASE. Playbook Flow Trigger: The playbook activates upon the creation of a new SentinelOne Threat incident. Process: Retrieves the Host ID from Cortex Data Lake. Loads detailed information about the agent. If the Host ID is found and the agent is not decommissioned, it initiates quarantine through Prisma SASE. Dependencies and Configuration This playbook requires being set as the default in the SentinelOne instance configuration. It specifically responds to events categorized as 'Threats'. Ensure that the Prisma SASE, Cortex Data Lake and SentinelOne integrations are properly configured and operational for seamless execution of this playbook.
Prisma SASE - Block URL	The playbook will handle the operation of blocking a URL within the organization. If a category is provided, the URL will be added to the list. If not, a new URL category will be created, and a new security rule that blocks that category.
Prisma SASE - Create or Edit Security Policy Rule	This playbook handles the creation or editing of the Security Policy Rule for Prisma SASE integration.
Prisma Access - Logout User	This playbook forces logout of a specific user and computer from Prisma Access.
Prisma SASE - Create a security pre-rule for EDL	This playbook helps to create a security rule to block indicators from an EDL. This playbook should run only once to setup the EDL object and its rule.
Prisma Access Whitelist Egress IPs on SaaS Services	Retrieve Prisma Access Egress IP for specific geographic zones and populate in security groups within cloud services.
Prisma SASE - Block IP	This playbook assists in blocking communication with the provided IPs in the Prisma SASE policy. If a group name is provided, the IPs will be added to the mentioned static address group (there should be a rule associated with the group name to block communication with that group). And if the group name is not provided, a new group will be created with a dedicated rule to block communication with those IPs.
Prisma SASE - Create or Edit EDL object	This playbook helps to create an EDL object within the Prisma SASE Objects section.
Prisma Access - Connection Health Check	Use the Prisma Access integration to run SSH CLI commands and query the connection states for all tunnels. If any tunnels are down - the playbook escalates to a manual task for remediation and provides recommendations on next steps in the task description. The playbook can be run as a job, or triggered from an incoming event to confirm an initial suspicion (such as a tunnel log from Cortex Data Lake) to validate that the issue still exists.
Prisma SASE - Add IPs to Static Address Group	This playbook appends a Static Address Group with provided IPs.
Prisma SASE - Create Address Object	This playbook creates new address objects in the Prisma SASE Object section. Those objects can be used later on in other objects such as Security Rules.

Name	Description
Prisma Access Egress IP feed	Dynamically retrieve and add to allow list IPs Prisma Access uses to egress traffic to the internet and SaaS apps.
Prisma Access	Integrate with Prisma Access to monitor the status of the Service, alert and take actions.
Palo Alto Networks - Strata Cloud Manager	Provides commands for interaction with Prisma SASE API.

Name	Description
Prisma SASE - Block URL	The playbook will handle the operation of blocking a URL within the organization. If a category is provided, the URL will be added to the list. If not, a new URL category will be created, and a new security rule that blocks that category.
Prisma SASE - Create Address Object	This playbook creates new address objects in the Prisma SASE Object section. Those objects can be used later on in other objects such as Security Rules.
Prisma SASE - Block IP	This playbook assists in blocking communication with the provided IPs in the Prisma SASE policy. If a group name is provided, the IPs will be added to the mentioned static address group (there should be a rule associated with the group name to block communication with that group). And if the group name is not provided, a new group will be created with a dedicated rule to block communication with those IPs.
Prisma Access - Connection Health Check	Use the Prisma Access integration to run SSH CLI commands and query the connection states for all tunnels. If any tunnels are down - the playbook escalates to a manual task for remediation and provides recommendations on next steps in the task description. The playbook can be run as a job, or triggered from an incoming event to confirm an initial suspicion (such as a tunnel log from Cortex Data Lake) to validate that the issue still exists.
Prisma Access - Logout User	This playbook forces logout of a specific user and computer from Prisma Access.
Prisma SASE - Create or Edit Security Policy Rule	This playbook handles the creation or editing of the Security Policy Rule for Prisma SASE integration.
Prisma SASE - Create or Edit EDL object	This playbook helps to create an EDL object within the Prisma SASE Objects section.
Prisma SASE - Quarantine a SentinelOne Host With Active Threat	Goal This playbook is designed to automatically quarantine a SentinelOne host in response to a new threat alert trigger using Prisma SASE. Playbook Flow Trigger: The playbook activates upon the creation of a new SentinelOne Threat alert. Process: Retrieves the Host ID from Cortex Data Lake. Loads detailed information about the agent. If the Host ID is found and the agent is not decommissioned, it initiates quarantine through Prisma SASE. Dependencies and Configuration This playbook requires being set as the default in the SentinelOne instance configuration. It specifically responds to events categorized as 'Threats'. Ensure that the Prisma SASE, Cortex Data Lake and SentinelOne integrations are properly configured and operational for seamless execution of this playbook.
Prisma Access Whitelist Egress IPs on SaaS Services	Retrieve Prisma Access Egress IP for specific geographic zones and populate in security groups within cloud services.
Prisma SASE - Create a security pre-rule for EDL	This playbook helps to create a security rule to block indicators from an EDL. This playbook should run only once to setup the EDL object and its rule.
Prisma SASE - Add IPs to Static Address Group	This playbook appends a Static Address Group with provided IPs.

Pack Name	Pack By
Base	By: Cortex XSOAR
Common Scripts	By: Cortex XSOAR
Filters And Transformers	By: Cortex XSOAR

Pack Name	Pack By
AWS - EC2	By: Cortex XSOAR
Strata Logging Service by Palo Alto Networks	By: Cortex XSOAR
Google Cloud Compute	By: Cortex XSOAR
Okta	By: Cortex XSOAR

Pack Name	Pack By
Filters And Transformers	By: Cortex XSOAR
Common Scripts	By: Cortex XSOAR
Cortex REST API	By: Cortex XSOAR
Base	By: Cortex XSOAR

Playbooks

Prisma Access Whitelist Egress IPs on SaaS Services

Set sub-playbooks to be skipped if unavailable

New: Prisma SASE - Add IPs to Static Address Group

New: This playbook appends a Static Address Group with provided IPs.
This playbook appends a Static Address Group with provided IPs. (Available from Cortex XSOAR 6.8.0).

New: Prisma SASE - Block IP

New: This playbook assists in blocking communication with the provided IPs in the Prisma SASE policy.
If a group name is provided, the IPs will be added to the mentioned static address group (there should be a rule associated with the group name to block communication with that group).
And if the group name is not provided, a new group will be created with a dedicated rule to block communication with those IPs.
This playbook assists in blocking communication with the provided IPs in the Prisma SASE policy.
If a group name is provided, the IPs will be added to the mentioned static address group (there should be a rule associated with the group name to block communication with that group).
And if the group name is not provided, a new group will be created with a dedicated rule to block communication with those IPs. (Available from Cortex XSOAR 6.8.0).

New: Prisma SASE - Block URL

New: The playbook will handle the operation of blocking a URL within the organization.
If a category is provided, the URL will be added to the list.
If not, a new URL category will be created, and a new security rule that blocks that category.
The playbook will handle the operation of blocking a URL within the organization.
If a category is provided, the URL will be added to the list.
If not, a new URL category will be created, and a new security rule that blocks that category. (Available from Cortex XSOAR 6.8.0).

New: Prisma SASE - Create Address Object

New: This playbook creates new address objects in the Prisma SASE Object section. Those objects can be used later on in other objects such as Security Rules.
This playbook creates new address objects in the Prisma SASE Object section. Those objects can be used later on in other objects such as Security Rules.

New: Prisma SASE - Create a security pre-rule for EDL

New: This playbook helps to create a security rule to block indicators from an EDL. This playbook should run only once to setup the EDL object and its rule.
This playbook helps to create a security rule to block indicators from an EDL. This playbook should run only once to setup the EDL object and its rule. (Available from Cortex XSOAR 6.8.0).

New: Prisma SASE - Create or Edit EDL object

New: This playbook helps to create an EDL object within the Prisma SASE Objects section.
This playbook helps to create an EDL object within the Prisma SASE Objects section. (Available from Cortex XSOAR 6.8.0).

New: Prisma SASE - Create or Edit Security Policy Rule

New: This playbook handles the creation or editing of the Security Policy Rule for Prisma SASE integration.
This playbook handles the creation or editing of the Security Policy Rule for Prisma SASE integration.
(Available from Cortex XSOAR 6.8.0).

Certification	Certified	Read more
Supported By	Cortex
Created	July 22, 2020
Last Release	March 3, 2025

Palo Alto Networks - Strata Cloud Manager

Prisma Access Content Pack

Prisma Access Egress IP feed

Prisma Access

Prisma SASE

Pack Contributors:

Prisma Access Content Pack

Prisma Access Egress IP feed

Prisma Access

Prisma SASE

Pack Contributors:

Goal

Playbook Flow

Dependencies and Configuration

Goal

Playbook Flow

Dependencies and Configuration

Integrations

Palo Alto Networks - Strata Cloud Manager

Integrations

Prisma Access

Integrations

Palo Alto Networks - Strata Cloud Manager

Integrations

Palo Alto Networks - Strata Cloud Manager

Prisma Access Egress IP feed

Integrations

Prisma Access

Integrations

Prisma Access

Integrations

Prisma Access Egress IP feed

Integrations

Prisma Access

Integrations

Palo Alto Networks - Strata Cloud Manager

Playbooks

Prisma SASE - Quarantine a SentinelOne Host With Active Threat

Integrations

Prisma Access Egress IP feed

Playbooks

New: Prisma SASE - Quarantine Host With Active Threat

Playbook Flow

Dependencies and Configuration

Integrations

Palo Alto Networks - Prisma SASE

Integrations

Prisma Access Egress IP feed

Playbooks

Prisma Access Whitelist Egress IPs on SaaS Services

New: Prisma SASE - Add IPs to Static Address Group

New: Prisma SASE - Block IP

New: Prisma SASE - Block URL

New: Prisma SASE - Create Address Object

New: Prisma SASE - Create a security pre-rule for EDL

New: Prisma SASE - Create or Edit EDL object

New: Prisma SASE - Create or Edit Security Policy Rule

Integrations

Palo Alto Networks - Prisma SASE

Integrations

Palo Alto Networks - Strata Cloud Manager

Integrations

Prisma Access

Integrations

Palo Alto Networks - Strata Cloud Manager

Integrations

Palo Alto Networks - Strata Cloud Manager

Prisma Access Egress IP feed

Integrations

Prisma Access

Integrations

Prisma Access

Integrations

Prisma Access Egress IP feed

Integrations

Prisma Access

Integrations

Palo Alto Networks - Strata Cloud Manager

Playbooks

Prisma SASE - Quarantine a SentinelOne Host With Active Threat