Skip to content

Commit d40a740

Browse files
authored
Merge pull request #5096 from DebLanger/US428946_WIZ_no_crowdstrike_sentinelone
Us428946 wiz no crowdstrike sentinelone
2 parents c3f6e04 + 40b4ba6 commit d40a740

9 files changed

+231
-15
lines changed

exposure-management/Qualys-data-connector.md

Lines changed: 11 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -48,8 +48,6 @@ To establish a connection with Qualys in Exposure Management, follow these steps
4848

4949
Qualys connector retrieves data on compute devices, including machines and virtual machines, and vulnerability findings from Qualys on those assets. It also retrieves some networking data to identify those devices.
5050

51-
Only devices that were modified in the last 90 days are retrieved, based on assessing the "modified" field in the Qualys asset.
52-
5351
| **Category** | **Properties** |
5452
|-------------------------|--------------------------------------------------------------------------------|
5553
| **Assets/devices** | - Gateway address<br>- FQDN<br>- IP address<br>- MAC address<br>- OS information<br>- Qualys criticality data |
@@ -72,4 +70,14 @@ Here are some common issues that might arise when configuring the Qualys Connect
7270

7371
## Next steps
7472

75-
[Getting value from your data connectors](value-data-connectors.md).
73+
After configuring the Qualys data connector:
74+
75+
- [Review your attack surface map](enterprise-exposure-map.md) to see Qualys data
76+
- [Explore security recommendations](security-recommendations.md)
77+
- [Set up security initiatives](initiatives.md) to track remediation progress
78+
79+
## Related articles
80+
81+
- [Data connectors overview](overview-data-connectors.md)
82+
- [Configure data connectors](configure-data-connectors.md)
83+
- [Getting value from your data connectors](value-data-connectors.md)

exposure-management/Rapid7-data-connector.md

Lines changed: 11 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -31,8 +31,6 @@ To establish a connection with Rapid7 in Exposure Management, follow these steps
3131

3232
Exposure Management retrieves data on compute devices from Rapid7, including machines and virtual machines. It also retrieves vulnerabilities reported by Rapid7 on those devices.
3333

34-
Only devices that were actively scanned in the last 90 days are retrieved, based on assessing the "last_scan_end" field in the Rapid7 asset.
35-
3634
| Category | Properties |
3735
|------------------------|----------------------------------------------------------------------------|
3836
| **Assets/devices, and data per each identifier** | - Rapid7 ID<br>- Hostname<br>- IP address<br>- mac Address<br>- OS information<br>- Rapid7 risk score<br>- Tags<br>- Rapid7 criticality data<br>- Cloud platform |
@@ -54,4 +52,14 @@ Here are some common issues that might arise when configuring the Rapid7 Connect
5452

5553
## Next steps
5654

57-
[Getting value from your data connectors](value-data-connectors.md).
55+
After configuring the Rapid7 data connector:
56+
57+
- [Review your attack surface map](enterprise-exposure-map.md) to see Rapid7 data
58+
- [Explore security recommendations](security-recommendations.md)
59+
- [Set up security initiatives](initiatives.md) to track remediation progress
60+
61+
## Related articles
62+
63+
- [Data connectors overview](overview-data-connectors.md)
64+
- [Configure data connectors](configure-data-connectors.md)
65+
- [Getting value from your data connectors](value-data-connectors.md)

exposure-management/ServiceNow-data-connector.md

Lines changed: 11 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -40,8 +40,6 @@ To establish a connection with ServiceNow in Exposure Management, follow these s
4040

4141
Exposure Management currently retrieves data on devices, their business application association, and business criticality. Additional data is also retrieved that helps identify the device, such as network adapter information and OS data.
4242

43-
Only devices that were active in the last 90 days are retrieved, based on assessing the "sys_updated_on" field in the ServiceNow CI.
44-
4543
The following fields are ingested via the connector:
4644

4745
| **Category** | **Properties** |
@@ -69,4 +67,14 @@ Here are some common issues that might arise when configuring the ServiceNow Con
6967

7068
## Next steps
7169

72-
[Getting value from your data connectors](value-data-connectors.md).
70+
After configuring the ServiceNow data connector:
71+
72+
- [Review your attack surface map](enterprise-exposure-map.md) to see ServiceNow data
73+
- [Explore security recommendations](security-recommendations.md)
74+
- [Set up security initiatives](initiatives.md) to track remediation progress
75+
76+
## Related articles
77+
78+
- [Data connectors overview](overview-data-connectors.md)
79+
- [Configure data connectors](configure-data-connectors.md)
80+
- [Getting value from your data connectors](value-data-connectors.md)

exposure-management/TOC.yml

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -46,6 +46,12 @@
4646
items:
4747
- name: ServiceNow
4848
href: ServiceNow-data-connector.md
49+
- name: Cloud Security data connectors
50+
items:
51+
- name: Wiz
52+
href: wiz-data-connector.md
53+
- name: Palo Alto Prisma
54+
href: palo-alto-prisma-data-connector.md
4955
- name: Vulnerability Management data connectors
5056
items:
5157
- name: Qualys

exposure-management/Tenable-data-connector.md

Lines changed: 11 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -44,8 +44,6 @@ To establish a connection with Tenable in Exposure Management, follow these step
4444

4545
Exposure Management retrieves data on compute devices from Tenable, including machines and virtual machines. It also retrieves some networking data to identify those devices.
4646

47-
Only devices that were modified in the last 90 days are retrieved, based on assessing the "updated_at" field in the Tenable asset.
48-
4947
Exposure Management also retrieves vulnerability findings from Tenable on those assets.
5048

5149
The vulnerability data retrieved for Tenable is applicable to CVEs only, and not other types of vulnerabilities or misconfigurations. Tenable shows total vulnerability counts that include other non-CVE misconfigurations as well, so these counts aren't applicable to the numbers of vulnerabilities ingested to Exposure Management.
@@ -77,4 +75,14 @@ Here are some common issues that might arise when configuring the Tenable Connec
7775

7876
## Next steps
7977

80-
[Getting value from your data connectors](value-data-connectors.md).
78+
After configuring the Tenable data connector:
79+
80+
- [Review your attack surface map](enterprise-exposure-map.md) to see Tenable data
81+
- [Explore security recommendations](security-recommendations.md)
82+
- [Set up security initiatives](initiatives.md) to track remediation progress
83+
84+
## Related articles
85+
86+
- [Data connectors overview](overview-data-connectors.md)
87+
- [Configure data connectors](configure-data-connectors.md)
88+
- [Getting value from your data connectors](value-data-connectors.md)

exposure-management/configure-data-connectors.md

Lines changed: 8 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -30,6 +30,11 @@ To view the status of the connectors, you can use one of the following roles:
3030
- Global Reader (read permissions)
3131
- Security Reader (read permissions)
3232

33+
You can also use [Microsoft Defender XDR Unified role-based access control (RBAC)](/defender-xdr/manage-rbac) with the following permissions:
34+
- **Exposure Management (read)** for read-only access to Exposure Management experiences
35+
- **Exposure Management (manage)** for full access to manage Exposure Management experiences
36+
- **Core security settings (manage)** for connecting or changing vendor configurations (located under Authorization and settings category)
37+
3338
You can find more details about the permission levels here, [Prerequisites, and support](prerequisites.md).
3439

3540
## Establish a connection
@@ -42,8 +47,8 @@ To establish a connection with any of the supported external products, follow th
4247
- [Qualys VM](Qualys-data-connector.md)
4348
- [Rapid7 VM](Rapid7-data-connector.md)
4449
- [Tenable](Tenable-data-connector.md)
45-
- Wiz (coming soon)
46-
- Palo Alto (coming soon)
50+
- [Wiz](wiz-data-connector.md)
51+
- [Palo Alto Prisma](palo-alto-prisma-data-connector.md)
4752

4853
2. Go to **Data Connectors** in the Exposure Management navigation.
4954
3. Select **Connect** on the selected data connector from the external connectors catalog.
@@ -81,4 +86,4 @@ Select the external data connector you want to configure and follow the steps to
8186

8287
- [CMDB data connectors](ServiceNow-data-connector.md)
8388
- [Vulnerability management data connectors](Qualys-data-connector.md)
84-
- Cloud security data connectors (coming soon)
89+
- [Cloud security data connectors](wiz-data-connector.md)
Lines changed: 76 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,76 @@
1+
---
2+
title: Integrate Palo Alto Prisma data connector in Microsoft Security Exposure Management
3+
description: Learn how to integrate the Palo Alto Prisma data connector in Microsoft Security Exposure Management.
4+
ms.author: dlanger
5+
author: dlanger
6+
manager: ornat-spodek
7+
ms.topic: overview
8+
ms.service: exposure-management
9+
ms.date: 09/09/2025
10+
---
11+
12+
# Palo Alto Prisma data connector?
13+
14+
To integrate with Palo Alto Prisma, you need to provide an authentication endpoint API URL, and a valid Access Key and Secret Key generated using a Palo Alto service account.
15+
16+
> [!Note]
17+
> We recommend creating a dedicated service account for use with data connectors in Exposure Management.
18+
19+
## Palo Alto Prisma configuration
20+
21+
First, you need to create a service account with the required permissions to get the Access Key and Secret Key.
22+
23+
> [!Note]
24+
> To create a Palo Alto API Client, you must be logged in as a user with the System Admin role.
25+
26+
### Add an API Client
27+
28+
1. Log in to your Palo Alto Prisma account with the required permissions.
29+
2. Go to **Settings** > **Access Control** > **Access keys**.
30+
3. Click **Add**, then **Access key**.
31+
4. Enter a meaningful **Access Key Name**, then click **Save**.
32+
5. Copy and save the **Access Key ID** and **Secret Access Key** that appears.
33+
6. Close the credential window.
34+
35+
## Establish Palo Alto Prisma connection in Exposure Management
36+
37+
To establish a connection with Palo Alto Prisma in Exposure Management, follow these steps:
38+
39+
1. Open the [Exposure Management Connectors](https://security.microsoft.com/exposure-data-connectors) page and click **Connect** in the Palo Alto tile.
40+
2. Enter your Palo Alto API URL and authentication credentials, then click **Connect**.
41+
42+
## Retrieved data
43+
44+
The Palo Alto Prisma connector retrieves data on your IT assets and risks, providing extended exposure insights based on the additional data and context it offers.
45+
46+
| **Category** | **Properties** |
47+
|-------------------------|--------------------------------------------------------------------------------|
48+
| **Assets/devices** | - Cloud provider information<br>- Resource type<br>- Network interfaces<br>- IP address<br>- Public DNS name<br>- Operating system details<br>- Internet facing<br>- Palo Alto criticality data |
49+
| **Vulnerability findings** | Palo Alto Prisma retrieves CVE findings on the assets that it ingests. |
50+
51+
## Troubleshooting the Palo Alto Prisma data connector
52+
53+
Here are some common issues that might arise when configuring the Palo Alto Prisma Connector, and suggestions for how to resolve them.
54+
55+
| **Error Type** | **Troubleshooting Action** |
56+
| ------------------------------------------------------------ | ------------------------------------------------------------ |
57+
| **Authorization failure** | Check your credentials and make sure they're correct and valid. Also check that your credentials have the required permissions. See the Palo Alto [configuration section](#palo-alto-prisma-configuration) for details on how to assign the appropriate roles. |
58+
| **Access forbidden error** | This error indicates that the provided credentials lack the necessary permissions to run the requested APIs. Update your credentials with the proper permissions as described in the [configuration section](#palo-alto-prisma-configuration). |
59+
| **Not found error** | This error indicates that the requested endpoint wasn't found to be reachable. Verify that your Palo Alto authentication endpoint URL is correct, see the [configuration section](#palo-alto-prisma-configuration) for details. |
60+
| **Too many requests** | The system periodically pulls data from the configured external providers, which might have a limit on the number of concurrent requests. We recommend creating a dedicated service account for the connector to avoid reaching this limit. |
61+
| 'Temporary disconnected' or 'Temporary failure' error message | Verify the connector configuration (authentication endpoint URL and credentials). If the configuration is valid and the issue doesn't resolve on its own, contact Support. |
62+
| Not seeing my assets or the vulnerabilities reported by Palo Alto Prisma in the ingested data | See [Retrieved data](#retrieved-data) for a description of the expected retrieved data by the Palo Alto Prisma connector. If there's still missing data, contact Support. |
63+
64+
## Next steps
65+
66+
After configuring the Palo Alto Prisma data connector:
67+
68+
- [Review your attack surface map](enterprise-exposure-map.md) to see Palo Alto Prisma data
69+
- [Explore security recommendations](security-recommendations.md)
70+
- [Set up security initiatives](initiatives.md) to track remediation progress
71+
72+
## Related articles
73+
74+
- [Data connectors overview](overview-data-connectors.md)
75+
- [Configure data connectors](configure-data-connectors.md)
76+
- [Getting value from your data connectors](value-data-connectors.md)

exposure-management/whats-new.md

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,14 @@ Learn more about MSEM by reading the blogs, [here](https://techcommunity.microso
2626
2727
## September 2025
2828

29+
### New data connectors
30+
31+
We have added new data connectors for Wiz and Palo Alto Prisma. These connectors enable seamless integration of vulnerability and asset data from leading cloud security platforms into Microsoft Security Exposure Management, providing enhanced visibility and context for your environments.
32+
33+
For more information, see:
34+
- [Wiz data connector](wiz-data-connector.md)
35+
- [Palo Alto Prisma data connector](palo-alto-prisma-data-connector.md)
36+
2937
### New predefined classifications
3038

3139
The following predefined **Device** classification rules were added to the critical assets list:

0 commit comments

Comments
 (0)