Prisma AIRS
Use the Prisma AIRS AI Sessions and API Application Views
Table of Contents
Expand All
|
Collapse All
Prisma AIRS Docs
Use the Prisma AIRS AI Sessions and API Application Views
Learn how to use the AI Session and A
| Where Can I Use This? | What Do I Need? |
|---|---|
|
Prisma AIRS's AI Sessions and API Applications views provide you with essential
visibility into the runtime security of your AI applications. You can verify the
legitimacy of threat blocks, understand the context of security violations, and manage
your AI applications from a single interface in Strata Cloud Manager (SCM). Moreover,
you’re able to view the actual prompts and model responses that trigger security alerts.
And Additionally, you can view the specific LLM payloads that violated security
policies, helping you validate detections and reduce false positives.
The Applications View provides a centralized dashboard showing all your AI
applications with their associated security violations, allowing you to quickly identify
which applications need attention. You can filter applications by monitoring period,
violation severity, tags, security profiles, and cloud provider. For each application,
you can see detailed metadata, violation trends, and linked security profiles.
The Sessions View allows you to examine individual AI sessions, which are
logical groupings of related API calls sharing the same transaction ID. This view shows
the sequential flow of prompts and responses that make up a conversation, with clear
indicators of which content violated security policies. You can drill down into
individual transactions to see the exact payload content and which security profiles
were violated.
This feature requires your applications to send a consistent transaction ID
with related API calls to properly correlate them into sessions. If no transaction ID is
provided, the system automatically creates one for each atomic API call. For enterprise
deployments, the feature supports RBAC integration to ensure that sensitive data in
prompts and responses is only accessible to authorized personnel.
API Applications View
Prisma
AIRS Runtime Security's AI Application view provides you with comprehensive
visibility into your AI-enabled applications in Strata Cloud Manager (SCM). This
feature addresses a critical challenge for security teams - understanding which AI
applications exist in your environment and identifying which ones have security
violations.
You can discover and monitor all AI applications that
interact with your Prisma AIRS API, with each application displaying its associated
sessions, violations, and security profiles. The Application View enables you to
quickly identify which applications have the most violations through a top-level
dashboard that shows total applications with violations and application violation
trends over time. You can filter applications by monitoring period, violation
severity, tags, security profiles, and cloud provider to focus on specific segments
of your environment.
For each application, you see detailed
information including application ID, name, tags, cloud provider, and violation
metrics. When you select a specific application, a detailed flyout view reveals
expanded metadata, session counts, violation breakdowns by severity and type, and
linked security profiles. This context helps you prioritize which applications need
immediate security attention and understand the nature of the violations occurring
in each application.
The Application View displays a dashboard that
shows total applications with violations and application violation trends over time.
The Total Applications with Violations pie chart shows your
top five applications with security issues over the selected period. The
Application Violations Timeline presents a trend view of violations
across all applications for the past 30 days, allowing you to identify patterns or
spikes in security incidents.
The AI Application View becomes more
valuable when paired with the AI Sessions View, as you can click through from an
application to see all of its associated sessions, providing the context needed to
analyze and address security incidents. You can see the details of manually-created
applications and applications that are automatically discovered when developers make
API calls with new application names in metadata, enabling comprehensive visibility
regardless of how applications are onboarded.
You can filter applications using
several criteria. The Monitor Since filter limits results to a
specific time range. Violations by Severity allows you to focus
on critical, high, medium, or low severity issues. Tags filters
by user-defined application tags. Security Profiles Applied
narrows results to applications using specific security configurations.
Cloud filters by cloud provider, and
Source indicates the detection method.
| Column Name | Description |
|---|---|
|
Application ID and Application Name
|
Unique identifiers for your application
|
|
Tags
|
User-defined labels for organization.
|
|
Cloud
|
The cloud service provider (AWS, Azure, GCP, or Other) hosting
your application
|
|
Source
|
The source of detection; how the application was discovered
|
|
Violating Sessions
|
The number of sessions that violate your enabled security
profiles and the total number of sessions detected
|
You can view further details about each application by clicking on
the Application Name.
| Field Name | Description | |
|---|---|---|
|
Application Overview
| ||
|
Application Name
|
Unique identifier for your application
| |
|
Tag
|
User-defined labels for organization
| |
|
Cloud
|
The cloud service provider (AWS, Azure, GCP) hosting your
application
| |
|
Linked Security Profile
|
Shows which security configurations are protecting the
application
| |
|
Monitor Since
|
Indicates when monitoring began when monitoring of this
application began
| |
|
Source of Detection
|
Shows how the application was discovered
| |
|
Related AI Sessions
| ||
|
Total Sessions
|
The total session associated with this application
| |
|
Violated Sessions
|
The total number of sessions that violate a security profile
| |
|
Violation Breakdown
|
Provides details about the number of violations of each
severity level.
You can hover over the information icon to view
additional details about the violations, such as the violation
types and the number and severity of each type.
| |
|
Security Profile Overview
|
Provides details on the security policies protecting this
application
| |
AI Sessions View
Prisma AIRS
Runtime Security's AI Session view enables you to inspect and analyze individual AI
conversations processed through your Prisma AIRS API. This view provides visibility
into AI transactions by allowing you to verify the legitimacy of security findings
and understand the context in which violations occur.
To implement
this feature, you must configure your applications to include a consistent
transaction ID with related API calls. This allows the system to correlate requests
into coherent conversations, providing the context necessary for meaningful security
analysis.
The Session View displays high-level statistics at the top
of the page. These metrics aggregate data over the selected time period and display
percentage changes compared to the previous comparable period. The Total
AI Sessions vs. Violations bar chart visualizes the relationship
between your total sessions and those with security issues over time.
You can
filter sessions using several criteria. The Monitoring Period
lets you select from the past one hour, 24 hours, 7 days, or 30 days.
Application Name filters sessions to a specific application.
Violations by Severity narrows results by security impact
level. Security Profiles Applied shows sessions using particular
security configurations, and Cloud filters by provider.
| Field Name | Description |
|---|---|
|
Total AI Sessions
|
The total number of AI sessions processed by Prisma AIRS during
the last 30 days
|
|
Total AI Sessions with Violations
|
The total number of AI sessions with violations identified during
the last 30 days
|
|
Total Critical Violations
|
The total number of AI sessions with critical violations
identified during the last 30 days
|
|
AI Session ID
|
Unique identifiers for the session
|
|
Application Name
|
The name of the application participating in the session
|
|
Tags
|
User-defined labels for organization
|
|
Last Session Activity
|
The date and time of the last activity of the session
|
|
Violations
|
The number of violations that occurred during the specified
session and the severity of each violation
|
You view additional details about each session by clicking on the
AI Session ID.
| Field Name | Description | |
|---|---|---|
|
AI Session Overview
| ||
|
AI Session ID
|
Unique identifier of the AI session
| |
|
Application Name
|
The name of the application associated with the session
| |
|
Application Tag(s)
|
User-defined tags applied to the application associated with the
session
| |
|
Cloud
|
The cloud service provider (AWS, Azure, GCP, or Other)) hosting
your application
| |
|
Source of Detection
|
Shows how the application was discovered
| |
|
Last Activity
|
The time and date of the last time activity was detected for the
session
| |
|
Start Time
|
The time and date the session began
| |
|
End Time
|
The time and date the session ended
| |
|
AI Session Transaction Details
| ||
|
Timestamp
|
The time of each transaction in the session
| |
|
Scan ID
|
A unique identifier of the scan
| |
|
Content Type
|
Indicates what the type of transaction occurred
| |
|
Security Breakdown
|
The number of violations per transaction and the severity of each
violation
| |
To gain further insight into the session, you can drill down to the transaction
that caused the security profile violation. This view provides the details of the
transaction including the prompt and response where the violation
occurred.
| Field Name | Description | |
|---|---|---|
|
Content Overview
| ||
|
Action Time
|
The time the transaction began
| |
|
Duration
|
The amount of time the transaction lasted
| |
|
Status
|
Displays the status of the transaction.
| |
|
Policy Violation
|
The number and severity of the violation(s)
| |
|
Application Name
| Name of the application that participated in the transaction | |
|
Transaction Metadata
| ||
|
Session ID
|
Unique identifier of the AI session
| |
| Scan ID |
A unique identifier of the scan
| |
|
Scan Sub Request ID
|
If the Scan API request is of the Async type, with multiple
requests sent in a batch, this identifier identifies each
request in the batch. Scan requests that are not batched have a
Scan Sub Request ID of zero (0).
| |
|
Environment
|
The cloud service provider (AWS, Azure, GCP, or Other) hosting
your application
| |
|
Model Name
| The AI model name sent in the API request metadata. | |
|
Environment
|
The cloud service provider (AWS, Azure, GCP, or Other) hosting
your application
| |
|
Profile
|
The security profiles applied to this session
| |
|
Transaction Content
| If the Content Type is Prompt |
The prompt and response of the transaction
|
| If the Content Type is Tool Event | The contents of the tool event request | |
|
Security Profiles Used by the Transaction
|
The security profiles applied to this session and on which
detector(s) the transaction failed
| |