GenAI Prompt Logging

Table of Contents

Create Custom Security Policy Rules to Control GenAI Access

AI Access Security Recommendations

GenAI Prompt Logging

Gain visibility into employee interactions with GenAI apps by logging and analyzing prompts across your network.

Where Can I Use This?	What Do I Need?
NGFW (Managed by Panorama or Strata Cloud Manager) Prisma Access (Managed by Panorama or Strata Cloud Manager)	Strata Logging Service license One of the following: Enterprise DLP license CASB-PA license CASB-X license

Where Can I Use This?

What Do I Need?

NGFW (Managed by Panorama or Strata Cloud Manager)
Prisma Access (Managed by Panorama or Strata Cloud Manager)

Strata Logging Service license

One of the following:

Enterprise DLP license
CASB-PA license
CASB-X license

GenAI Prompt Logging provides a comprehensive audit trail of user-submitted prompts to the GenAI apps you select across your enforcement points. You can capture, sanitize, and log prompts submitted through NGFW and Prisma Access channels to maintain visibility into how employees use GenAI tools in your organization.

Prompt logging addresses critical security and compliance requirements by enabling you to monitor GenAI usage patterns, detect potential data exfiltration through prompts, and maintain a forensic record of all GenAI interactions. This visibility supports regulatory compliance with AI governance frameworks and organizational acceptable use policies.

When you enable prompt logging, GenAI Prompt Logging captures the original user prompt as submitted to the GenAI app, free from surrounding HTTP/API request code, headers, or other non-prompt data. It removes duplicate prompts to avoid capturing interim versions that GenAI apps save during composition.

Access to prompt data follows a role-based model:

Admins and Viewers can access sanitized and truncated prompts (up to 2,000 characters) in the AI Conversation Log.
Superusers and Data Security administrators can view the raw, unsanitized original user prompt in the detailed view for forensic auditing, after acknowledging a warning notification.

You log prompts to Strata Logging Service, which provides searchable, near-real-time access to prompt data. You can export prompt logs to CSV or forward them to your security information and event management (SIEM) system for integration with your existing security monitoring workflows.

Log in to Strata Cloud Manager.
Activate Strata Logging Service.
GenAI prompt logging requires an activated Strata Logging Service to capture prompt history and generate logs.
Configure Enterprise DLP to detect sensitive data.
- Configure a data profile to define the match criteria for sensitive data you want to detect.
- Configure the DLP rule to define the type of traffic to inspect, the affected file types, the action, and the log severity for the data profile match criteria. Enterprise DLP automatically creates a DLP rule when you create a data profile.
  Enable both file and non-file inspection to detect file uploads and text prompts.
- Configure evidence storage to automatically store evidence for traffic that generates a DLP incident.
  Enterprise DLP creates an evidence file for both non-file text prompts and file-based attachments. If a single prompt contains both, Enterprise DLP creates an evidence file for each.
Enable GenAI Prompt Logging.
1. Select ConfigurationData Loss PreventionSettingsGenAI Prompt Analysis.
2. Enable GenAI Prompt Analysis.
  
  Enterprise DLP doesn't generate an audit log when you enable or disable GenAI Prompt Analysis.
3. Select the GenAI apps for which you want to enable prompt logging.
  You can enable prompt logging for the following GenAI apps:
  
  ChatGPT
  Claude
  Google Gemini
  Perplexity
4. Click Save.
  
  You must select at least one app before you can save.
5. When prompted, click Confirm to enable GenAI Prompt Logging.
  
  Enabling GenAI Prompt Logging saves your prompts to Strata Logging Service.
View the AI Conversation Log.
1. Select Log ViewerAI AccessAI Conversation Log.
  The AI Conversation Log includes a Content column that reflects how each app submits prompts and attachments.
  Some apps submit the prompt text and an attachment URL as a single value. In this case, the text and URL appear together in a single entry.
  When you upload an archive (.zip) that contains multiple files, AI Access Security™ merges the extracted text from all embedded files into a single entry, without separators between the files.
  If a single prompt contains multiple attachments that contain exactly the same sensitive data, then a single log entry is created even though each attachment contains its own instance of the same sensitive data.
2. To open a specific log record, click the detail icon in the first column on the left.
  
  The log details page consists of two tabs. The general traffic details, which contain 32 parameters, include who performed the action, what the action was, when it happened, and other associated details.
3. (Optional) Use the search and filter options to narrow results by any field.
  
  You can search all fields, including the full prompt content (not just the truncated 2,000-character display). Use "if contains" matching for long-string fields.
Export AI Conversation Log data.
1. Select Log ViewerAI AccessAI Conversation Log.
2. (Optional) Apply filters to narrow the data you want to export.
3. Click Export.
  
  The CSV export includes the full prompt text for all entries, not the truncated 2,000-character version displayed in Log Viewer. The export also includes all metadata fields, such as Timestamp, User ID, App Name, and App ID.
To forward AI Conversation Log data to your SIEM in near real time, configure log forwarding by selecting SettingsLog Forwarding. Log forwarding sends the full, untruncated prompt text to your configured SIEM destination.