Cortex Data Lake (CDL) is the centralized log storage for Prisma Access. The Authentication logs within CDL specifically contain records of all user login attempts, including timestamps, usernames, source IPs, and success/failure status, making them the definitive source for an audit trail of authentication events.

When configuring a Remote Network (branch office) connection to Prisma Access, the configuration template generated in the cloud portal provides specific IP addresses for the Primary and Secondary Gateways. The local firewall’s IKE Gateway must be configured to peer with this specific ‘Primary Gateway IP’ provided in the template for the IPSec tunnel to establish correctly.

Prisma SaaS can identify files by their true type (e.g., ‘Windows Executable’) via content inspection, not just by their extension. Using the ‘File Type’ criterion is more robust because it detects the actual file format, preventing simple evasion tactics like renaming extensions. This is a core capability for effective SaaS security posture management.

Prisma Access Insights is designed for this type of operational analysis. Drilling down from the high-level metric (session spike) to understand the contributing factors—such as a surge in traffic from a specific application—is the correct diagnostic approach. This data-driven investigation will reveal if it’s a legitimate business need (new app) or potentially malicious activity, informing the appropriate next action.

When Explicit Proxy is configured in Prisma Access, a dedicated proxy service endpoint is created in the cloud. The GlobalProtect agent must be configured to send its web traffic to this specific Prisma Access Proxy Gateway FQDN, not to an on-premise resource. This ensures the traffic is routed through the cloud-based inspection engines.

The SPN acts as an on-ramp for user and branch traffic into the Prisma Access cloud. Its key requirement is reliable, high-bandwidth connectivity to the public internet to establish optimal tunnels to the nearest Prisma Access Points of Presence (PoPs). Placing it in a zone with unrestricted outbound access is crucial for performance and reliability.

Prisma Access uses the Agent client configuration to determine which traffic is sent through the secure tunnel (tunneled) and which goes directly to the internet (local). If the subnet 10.10.50.0/24 is accidentally listed in the ‘Exclude List’ or not present in the ‘Include List’ for the Contractor’s client configuration, their traffic to that server would bypass the tunnel and likely be blocked by on-premise firewall policies, explaining the group-specific access failure.

Prisma SaaS uses the Google Reports API and Drive Activity API to gather the audit logs and activity data necessary for security analysis. The ‘admin.reports.audit.readonly’ scope allows reading audit logs, and ‘drive.activity.readonly’ allows reading Drive file activity. These are the precise, least-privilege scopes needed for the integration to function, aligning with the principle of minimal permissions.

Prisma Access Decryption policy rules are evaluated from top to bottom. Creating a rule with a higher priority (placed above) that matches the destination FQDN ‘secure.legalresearch.com’ and has an action of ‘No Decryption’ will exempt that specific traffic from decryption, while allowing inspection to continue for all other traffic. This provides a precise, policy-based exemption.

Cortex Data Lake (CDL) is the centralized log storage for Prisma Access. The Authentication logs within CDL specifically contain records of all user login attempts, including timestamps, usernames, source IPs, and success/failure status, making them the definitive source for an audit trail of authentication events.0