Prisma Incidents

Overview

Prisma Cloud is the industry’s most comprehensive cloud native security platform (CNSP), with the industry’s broadest security and compliance coverage for users, applications, data, and the entire cloud native technology stack throughout the development lifecycle and across hybrid and multi-cloud environments.

The Prisma Incidents connector fetches the Incidents generated by Prisma Cloud. Prisma Cloud Compute analyzes individual audits and correlates them together to surface unfolding attacks. These chains of related audits are called incidents.

Reference:
https://pan.dev/prisma-cloud/api/cwpp/get-audits-incidents/

Pre-requisites

• Username
• Password
• Prisma URI

Steps to derive prerequisites:

• Reference to create credentials: https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-admin/manage-prisma-cloud-administrators/create-access-keys.html

Configurations

The following are the configurations to forward Prisma Incidents Connector logs to DNIF.‌

Field Name	Description
Connector Name	Enter a name for the connector
Prisma URI	Enter address for Prisma Cloud   Console
Prisma Username	Enter Username/access key ID to   access the API
Prisma Password	Enter Password/secret key to access the API

• Click Save after entering all the required details and click Test Connection, to test the configuration.
• A Connection successful message will be displayed on screen along with the time stamp.
• If the connection is not successful an error message will be displayed. Refer Troubleshooting Connector Validations for more details on the error message.

Once the connector is configured, validate if the connector is listed under Collection Status screen with status as Active. This signifies the connector is configured successfully and data is ready to ingest.