View Advanced Threat Prevention in Activity Insights
Use the Threats tab in Activity Insights in Strata Cloud Manager to drill down
through Advanced Threat Prevention detection categories and investigate individual
threats.
| Where Can I Use
This? | What Do I Need? |
|---|
The Threats tab in Activity Insights in Strata Cloud Manager provides a multi-level
drill-down view of Advanced Threat Prevention detections. Where Command Center shows a
high-level summary, Activity Insights allows you to progressively filter from the
overall detection overview down to specific attack categories, subcategories, and
individual signatures.
Detection Types
Activity Insights groups detections into the following types:
- Pre-Disclosure Exploits—Threats detected by Frontier Virtual Patching
signatures for vulnerabilities that have not been publicly disclosed. This
detection type is available only with an Advanced Threat Prevention Plus
license.
- New & Unknown—Threats detected by Inline Cloud Analysis ML models,
including unknown HTTP-based C2 traffic, command injection, and SQL injection
exploits that do not match any existing signature.
- Platform Effects—Threats detected by vulnerability and C2 content
signatures delivered through standard content updates.
Drill-Down Levels
Activity Insights provides the following levels of analysis:
- Detection overview—Total threat counts grouped by detection type,
showing the distribution across attack categories.
- Category drill-down—Select an attack category to view the threat count
and blocked/alerted breakdown for that category. Categories include
Reconnaissance & Pre-Attack, Phishing, Malware, Exploitation and Code
Execution, Post-Exploitation & Lateral Movement, C2 & Exfiltration,
Disruption & Extortion, and Network Protocol Abuse.
- Subcategory drill-down—Select a category to view the specific attack
types within it (for example, Code Execution, Overflow, SQL
Injection).
- Threats list—View individual signatures with their severity, threat
name, action totals, affected users, applications, devices, category,
subcategory, license type, Threat ID, and rule name.
Filters
Use the filter bar at the top of Activity Insights to scope the view by time range
(such as Last 30 Days), scope (Prisma Access, NGFW, or both), subtenant, threat
license, threat action, and threat severity. You can toggle between the
Threat and CVE views using the
toggle at the top left.
To isolate Advanced Threat Prevention Plus activity, set the Threat
License filter to ATP-Plus.
Investigate Individual Signatures
From the threats list, select a signature to view its details in Threat Search. The
detail view displays full signature metadata including the name, Threat ID, CVE
number, vendor ID, description, category, severity, and reference links, along
with an Evidence in Your Network panel showing total, blocked, and alerted counts
with first-seen and last-seen dates.
Use the View Log link to jump directly to the relevant threat
log entries for a specific signature.
For predisclosure signatures detected by Frontier Virtual Patching, the investigation
workflow includes additional fields and indicators. See
View Frontier Virtual Patching
Detections for the predisclosure-specific drill-down.
