Configure Session URL in API Logs

1. Log in to Strata Cloud Manager.
2. Navigate to Incidents and Alerts Log Viewer.Verify that you see the AIRS AI Runtime Security API log type.
3. Select Firewall/AI Security.
4. Ensure Strata Logging Service log forwarding is enabled. This is typically done while associating your deployment profile with a Tenant Service Group (TSG).

   Strata Logging Service generates the AI security logs when AI security threats are detected between AI applications and AI models. These logs include detailed threat snippet identification and reporting and provide in-depth threat information and reports for different protection types such as AI model protection, AI application protection, and AI data protection. For more information, see Threat Logs and AI Security Logs.
5. To receive logs containing the session_URL in your SIEM:

   1. Create a Log Forwarding Profile: In SCM, specify the log type (Prisma AIRS API) and the destination (your SIEM's IP/URL).
   2. Select attributes. While the session_URL is a mandatory field in the new schema, ensure your SIEM is configured to parse this new String field from the incoming JSON or Syslog stream.

      When you configure log forwarding to a SIEM, Prisma AIRS automatically enriches the standard API scan log with the session_URL field. Below is a representation of how this appears in the JSON structure of a log entry sent to your SIEM:

      {
        "timestamp": "2025-10-01T14:10:45Z",
        "scan_id": "[scan ID]",
        "app_name": "SmartSync",
        "verdict": "Block",
        "threat_type": "Prompt Injection",
        "severity": "Critical",
        "model_name": "GPT-5",
        "user_ip": "[IP address]",
        "session_URL": "https://stratacloudmanager.paloaltonetworks.com/ai-runtime/sessions/[session-number]"
      }
      

      The log includes standard metadata alongside the new mandatory field.

      There are a few key fields in the log output related to the session URL:

      • scan_id: A unique identifier for the specific atomic API call that was scanned.
      • session_URL: The new String field containing the direct link to the full conversation context in Strata Cloud Manager (SCM).
      • verdict: Indicates the action taken (e.g., Block), which identifies this entry as a violation.