|
| 1 | +--- |
| 2 | +title: Integrate Palo Alto Prisma data connector in Microsoft Security Exposure Management |
| 3 | +description: Learn how to integrate the Palo Alto Prisma data connector in Microsoft Security Exposure Management. |
| 4 | +ms.author: dlanger |
| 5 | +author: dlanger |
| 6 | +manager: ornat-spodek |
| 7 | +ms.topic: overview |
| 8 | +ms.service: exposure-management |
| 9 | +ms.date: 09/09/2025 |
| 10 | +--- |
| 11 | + |
| 12 | +# Palo Alto Prisma data connector? |
| 13 | + |
| 14 | +To integrate with Palo Alto Prisma, you need to provide an authentication endpoint API URL, and a valid Access Key and Secret Key generated using a Palo Alto service account. |
| 15 | + |
| 16 | +> [!Note] |
| 17 | +> We recommend creating a dedicated service account for use with data connectors in Exposure Management. |
| 18 | +
|
| 19 | +## Palo Alto Prisma configuration |
| 20 | + |
| 21 | +First, you need to create a service account with the required permissions to get the Access Key and Secret Key. |
| 22 | + |
| 23 | +> [!Note] |
| 24 | +> To create a Palo Alto API Client, you must be logged in as a user with the System Admin role. |
| 25 | +
|
| 26 | +### Add an API Client |
| 27 | + |
| 28 | +1. Log in to your Palo Alto Prisma account with the required permissions. |
| 29 | +2. Go to **Settings** > **Access Control** > **Access keys**. |
| 30 | +3. Click **Add**, then **Access key**. |
| 31 | +4. Enter a meaningful **Access Key Name**, then click **Save**. |
| 32 | +5. Copy and save the **Access Key ID** and **Secret Access Key** that appears. |
| 33 | +6. Close the credential window. |
| 34 | + |
| 35 | +## Establish Palo Alto Prisma connection in Exposure Management |
| 36 | + |
| 37 | +To establish a connection with Palo Alto Prisma in Exposure Management, follow these steps: |
| 38 | + |
| 39 | +1. Open the [Exposure Management Connectors](https://security.microsoft.com/exposure-data-connectors) page and click **Connect** in the Palo Alto tile. |
| 40 | +2. Enter your Palo Alto API URL and authentication credentials, then click **Connect**. |
| 41 | + |
| 42 | +## Retrieved data |
| 43 | + |
| 44 | +The Palo Alto Prisma connector retrieves data on your IT assets and risks, providing extended exposure insights based on the additional data and context it offers. |
| 45 | + |
| 46 | +| **Category** | **Properties** | |
| 47 | +|-------------------------|--------------------------------------------------------------------------------| |
| 48 | +| **Assets/devices** | - Cloud provider information<br>- Resource type<br>- Network interfaces<br>- IP address<br>- Public DNS name<br>- Operating system details<br>- Internet facing<br>- Palo Alto criticality data | |
| 49 | +| **Vulnerability findings** | Palo Alto Prisma retrieves CVE findings on the assets that it ingests. | |
| 50 | + |
| 51 | +## Troubleshooting the Palo Alto Prisma data connector |
| 52 | + |
| 53 | +Here are some common issues that might arise when configuring the Palo Alto Prisma Connector, and suggestions for how to resolve them. |
| 54 | + |
| 55 | +| **Error Type** | **Troubleshooting Action** | |
| 56 | +| ------------------------------------------------------------ | ------------------------------------------------------------ | |
| 57 | +| **Authorization failure** | Check your credentials and make sure they're correct and valid. Also check that your credentials have the required permissions. See the Palo Alto [configuration section](#palo-alto-prisma-configuration) for details on how to assign the appropriate roles. | |
| 58 | +| **Access forbidden error** | This error indicates that the provided credentials lack the necessary permissions to run the requested APIs. Update your credentials with the proper permissions as described in the [configuration section](#palo-alto-prisma-configuration). | |
| 59 | +| **Not found error** | This error indicates that the requested endpoint wasn't found to be reachable. Verify that your Palo Alto authentication endpoint URL is correct, see the [configuration section](#palo-alto-prisma-configuration) for details. | |
| 60 | +| **Too many requests** | The system periodically pulls data from the configured external providers, which might have a limit on the number of concurrent requests. We recommend creating a dedicated service account for the connector to avoid reaching this limit. | |
| 61 | +| 'Temporary disconnected' or 'Temporary failure' error message | Verify the connector configuration (authentication endpoint URL and credentials). If the configuration is valid and the issue doesn't resolve on its own, contact Support. | |
| 62 | +| Not seeing my assets or the vulnerabilities reported by Palo Alto Prisma in the ingested data | See [Retrieved data](#retrieved-data) for a description of the expected retrieved data by the Palo Alto Prisma connector. If there's still missing data, contact Support. | |
| 63 | + |
| 64 | +## Next steps |
| 65 | + |
| 66 | +After configuring the Palo Alto Prisma data connector: |
| 67 | + |
| 68 | +- [Review your attack surface map](enterprise-exposure-map.md) to see Palo Alto Prisma data |
| 69 | +- [Explore security recommendations](security-recommendations.md) |
| 70 | +- [Set up security initiatives](initiatives.md) to track remediation progress |
| 71 | + |
| 72 | +## Related articles |
| 73 | + |
| 74 | +- [Data connectors overview](overview-data-connectors.md) |
| 75 | +- [Configure data connectors](configure-data-connectors.md) |
| 76 | +- [Getting value from your data connectors](value-data-connectors.md) |
0 commit comments