Palo Alto Prisma Cloud (PAN_PRISMA_CLOUD)

Overview

This topic describes the steps to collect the Access Key ID & Secret Key on the Palo Alto Prisma Cloud.

Prerequisites

Need to have Administrator login credentials.

Collection of Access Key ID & Secret Key

Step 1. Sign in to the Palo Alto Prisma Cloud Console with an administrator account.

Step 2. In the Settings menu, click Access Keys.

Step 3. Click Add New and enter a Name.

Step 4. Click Create. The Access Key ID and Secret Key values appear

Step 5. Save the Access Key ID and Secret Key values. These values are required when you configure the Google Security Operations feed.

Configuring a Feed in Chronicle

1. Click Feeds -> ADD NEW

2. Now Add the following Details.

• FEED NAME: Palo Alto Prisma Cloud
• SOURCE TYPE: Third party API
• LOG TYPE: Palo Alto Prisma Cloud

3. Click Next 

4. Now add Following the details, 

• HOSTNAME: provide the Access Key ID that you have obtained previously.  

Example: a3ab08b-c969-4db1-8f62-2a9b55f3

• PASSWORD: provide the Secret Key that you have obtained previously.

Example:  Bdfch36hahN8IReoUwJXICS2vf9w= 

• API HOSTNAME: specify your Prisma Cloud API Hostname

Example: api2.prismacloud.io or app.prismacloud.io 

5. Click Next & Submit.