Cloud Threat Detection | Prisma - Palo Alto Networks

Microsoft Exchange Server Exploit response

Accurate threat detection is essential for risk clarity

The dynamic, distributed nature of cloud environments often creates alerts that lack context, at a volume that can overwhelm security teams. Attempting to correlate logs, API metadata and signature-driven alerts can quickly flood teams with false positives instead of actionable insight. The key to high-fidelity alerts is threat intelligence sources with depth and breadth.

Cloud threat detection bolstered by multiple intelligence sources

Prisma™ Cloud combines rule- and behavior-based analytics and augments the data with the Prisma Cloud Intelligence Stream – a combination of data from over 30 unique sources, including commercial, open source and proprietary data sources across hosts, images and functions. Further enhanced with Palo Alto Networks threat intelligence from AutoFocus™ and WildFire^®, along with third-party sources like Qualys® and Tenable®, security teams rise above the noise to identify real threats, faster – ultimately reducing time to remediation.

Over 14 billion unique data points provide unrivaled threat intel for Prisma Cloud

Learn about the AutoFocus integration

Explore our Threat Detection module

User Entity Behavior Analytics (UEBA)

Prisma™ Cloud monitors and tracks user activities, and alerts on any deviations from established normal behavior via a ML-powered UEBA engine.

API-based network traffic visibility, analytics and anomaly detection

Prisma Cloud analyzes network traffic flows to establish baseline application behavior and detects deviations from normal activities.

Comprehensive threat intelligence

Prisma Cloud ingests data from the Prisma Cloud Intelligence Stream, AutoFocus, Wildfire, and third-party vulnerability feeds such as Qualys and Tenable.

Automated investigation and response

Prisma Cloud leverages deep, contextual understanding of every cloud environment to help prioritize investigations into the highest risk threats and create automated responses.

Prisma™ Cloud monitors and tracks user activities, and alerts on any deviations from established normal behavior via a ML-powered UEBA engine.

Prisma Cloud analyzes network traffic flows to establish baseline application behavior and detects deviations from normal activities.

Prisma Cloud ingests data from the Prisma Cloud Intelligence Stream, AutoFocus, Wildfire, and third-party vulnerability feeds such as Qualys and Tenable.

Prisma Cloud leverages deep, contextual understanding of every cloud environment to help prioritize investigations into the highest risk threats and create automated responses.