Ingest Prisma Browser logs into Cortex XSIAM.
Prisma Browser is a Palo Alto Networks browser designed specifically for enterprise use, and is fortified with security features to protect users and organizations. You can configure Cortex XSIAM to ingest Prisma Browser logs into a dataset called panw_prisma_access_browser_raw, that can be queried using XQL. This integration gives you visibility into issues that are generated by the browser. The ingested data can also be used for performing threat hunting queries and correlations within the Cortex platform.
Only one instance of this collector can be created per Cortex XSIAM tenant.
Note
If you change a device region, you must first disconnect the device from Cortex XSIAM and then reconnect it after the region change is complete.
In Cortex XSIAM, select → .
On the Data Sources & Integrations page, click + Add New, search for and select Prisma Access Browser, click Add or Add Another Instance.
In the Connect Prisma Access Browser dialog box, select the checkbox for Connect Prisma Access Browser to this account.
Click Connect.
Connection can take up to several minutes.
On the Data Sources & Integrations page, expand Prisma Access Browser to track the status of your instance.
Validate that data is streaming to your tenant by using XQL to query the dataset
panw_prisma_access_browser_raw.
After you have created a Prisma Browser instance, you can use the Data Sources & Integrations page to view information about the integration, or delete the instance.