Prisma SASE by Palo Alto Networks

Integrate with Palo Alto Networks Prisma SASE to query activity and take actions.

## Prisma Access Content Pack

This content pack enables XSOAR to integrate with Palo Alto Networks Prisma Access. It includes 2 integrations.

### Prisma Access Egress IP feed

Dynamically retrieve and allow IPs Prisma Access uses to egress traffic to the internet and SaaS apps.

This integration can be used as a TIM feed to fetch indicators, or if a playbook starts from a non-indicator trigger it can use the command to get the IPs.

### Prisma Access

Integrate with Prisma Access to query the status of the service and take actions.

The integration includes commands to:

Force logout a specific user from Prisma Access
List currently active users
Run a Prisma Access query (e.g. getGPaaSLast90DaysUniqueUsers)
Run a custom CLI command

The integration uses both the Panorama XML API and SSH into the PAN-OS CLI. SSH is based on the netmiko library and will use the netmiko docker image.

### Prisma SASE

Integrate with Prisma SASE to view or make changes to Prisma Access configurations.

The integration includes commands to:

Create, update, delete and get security rules.
Create, update, delete and get address objects.
Create, update, delete and get external dynamic lists.
Create, update, delete and get custom URL categories.
Create, update, delete and get tags.
Create, update, delete and get address groups.
Get configuration jobs.
Push all configuration jobs.

The integration uses the Prisma SASE Multi-tenant API documented here: Prisma SASE API.

Pack Contributors:

JD Plant

Contributions are welcome and appreciated. For more info, visit our Contribution Guide.

Name	Description
Prisma Access Egress IP feed	Dynamically retrieve and add to allow list IPs Prisma Access uses to egress traffic to the internet and SaaS apps.
Palo Alto Networks - Prisma SASE	Provides commands for interaction with Prisma SASE API.
Prisma Access	Integrate with Prisma Access to monitor the status of the Service, alert and take actions.

Name	Description
Prisma Access Whitelist Egress IPs on SaaS Services	Retrieve Prisma Access Egress IP for specific geographic zones and populate in security groups within cloud services.
Prisma Access - Logout User	This playbook forces logout of a specific user and computer from Prisma Access.
Prisma Access - Connection Health Check	Use the Prisma Access integration to run SSH CLI commands and query the connection states for all tunnels. If any tunnels are down - the playbook escalates to a manual task for remediation and provides recommendations on next steps in the task description. The playbook can be run as a job, or triggered from an incoming event to confirm an initial suspicion (such as a tunnel log from Cortex Data Lake) to validate that the issue still exists.

Name	Description
Prisma Access Egress IP feed	Dynamically retrieve and add to allow list IPs Prisma Access uses to egress traffic to the internet and SaaS apps.
Palo Alto Networks - Prisma SASE	Provides commands for interaction with Prisma SASE API.
Prisma Access	Integrate with Prisma Access to monitor the status of the Service, alert and take actions.

Name	Description
Prisma Access Whitelist Egress IPs on SaaS Services	Retrieve Prisma Access Egress IP for specific geographic zones and populate in security groups within cloud services.
Prisma Access - Logout User	This playbook forces logout of a specific user and computer from Prisma Access.
Prisma Access - Connection Health Check	Use the Prisma Access integration to run SSH CLI commands and query the connection states for all tunnels. If any tunnels are down - the playbook escalates to a manual task for remediation and provides recommendations on next steps in the task description. The playbook can be run as a job, or triggered from an incoming event to confirm an initial suspicion (such as a tunnel log from Cortex Data Lake) to validate that the issue still exists.

Pack Name	Pack By
AWS - EC2	By: Cortex XSOAR
Okta	By: Cortex XSOAR
Base	By: Cortex XSOAR
Google Cloud Compute	By: Cortex XSOAR

Prisma SASE by Palo Alto Networks

## Prisma Access Content Pack

### Prisma Access Egress IP feed

### Prisma Access

### Prisma SASE

Pack Contributors:

Integrations

Prisma Access

New: Palo Alto Networks - Prisma SASE

Integrations

Prisma Access

Integrations

Prisma Access Egress IP feed

Integrations

Prisma Access Egress IP feed

PUBLISHER

PLATFORMS

INFO

WORKS WITH THE FOLLOWING INTEGRATIONS:

DISCLAIMER

Pack Name	Pack By
Remote Access	By: Cortex XSOAR
Slack	By: Cortex XSOAR
MITRE ATT&CK	By: Cortex XSOAR
Active Directory Query	By: Cortex XSOAR
AWS - EC2	By: Cortex XSOAR
Google Maps	By: Cortex XSOAR
Okta	By: Cortex XSOAR
Filters And Transformers	By: Cortex XSOAR
Google Cloud Compute	By: Cortex XSOAR

Certification	Certified	Read more
Supported By	Cortex
Created	July 22, 2020
Last Release	February 8, 2023