Cloud Management

To take advantage of inline cloud analysis, you must have an active
Prisma Access
subscription, which provides access to Advanced Threat Prevention features. For information about the applications and services offered with
Prisma Access
, refer to All Available Apps and Services.
To verify subscriptions for which you have currently-active licenses, Check What’s Supported With Your License.
Use the credentials associated with your Palo Alto Networks support account and log in to the
Strata Cloud Manager
on the hub.
Update or create a new Anti-Spyware Security profile to enable inline cloud analysis (to analyze traffic for advanced C2 (command-and-control) and spyware threats in real-time).
Select
Manage
Configuration
NGFW and
Prisma Access
Security Services
Anti-Spyware
.
Select your Anti-Spyware security profile and then go to
Inline Cloud Analysis
panel and
Enable Inline Cloud Analysis
.

Specify an
Action
to take when a threat is detected using a corresponding analysis engine.
The default action for each analysis engine is
alert
, however, Palo Alto Networks recommends setting all actions to
Reset-Both
for the best security posture.
Allow
—The request is allowed and no log entry is generated.
Alert
—The request is allowed and a Threat log entry is generated.
Drop
—Drops the request; a reset action is not sent to the host/application.
Reset-Client
—Resets the client-side connection.
Reset-Server
—Resets the server-side connection.
Reset-Both
—Resets the connection on both the client and server ends.
Click
OK
to exit the Anti-Spyware Profile configuration dialog and
Commit
your changes.
(Optional)
Add URL and/or IP address exceptions to your Anti-Spyware profile if Inline Cloud Analysis produces false-positives. You can add exceptions by specifying an external dynamic list (URL or IP address list types) or an
Addresses
policy object.
Add an
External Dynamic Lists
or [IP]
Addresses
object exception.
Select
Manage
Configuration
Anti-Spyware
.
Select an Anti-Spyware profile for which you want to exclude specific URLs and/or IP addresses and then go to the
Inline Cloud Analysis
pane.
Add EDL/URL
or
Add IP Address
, depending on the type of exception you want to add, and then select a pre-existing URL or IP address external dynamic list. If none are available, create a new external dynamic list policy object. For IP address exceptions, you can, optionally, select an
Addresses
object list.

Click
OK
to save the Anti-Spyware profile and
Commit
your changes.
Update or create a new Vulnerability Protection Security profile to enable inline cloud analysis (to analyze traffic for command injection and SQL injection vulnerabilities in real-time).
Select an existing Vulnerability Protection security profile or
Add Profile
(
Manage
Configuration
Vulnerability Protection
).
Select your Vulnerability Protection profile and then go to
Inline Cloud Analysis
and
Enable inline cloud analysis
.
Specify an
Action
to take when a vulnerability exploit is detected using a corresponding analysis engine. There are currently two analysis engines available:
SQL Injection
and
Command Injection
.
Allow
—The request is allowed and no log entry is generated.
Alert
—The request is allowed and a Threat log entry is generated.
Reset-Client
—Resets the client-side connection.
Reset-Server
—Resets the server-side connection.
Reset-Both
—Resets the connection on both the client and server ends.
Click
OK
to exit the Vulnerability Protection Profile configuration dialog and
Commit
your changes.
(Optional)
Add URL and/or IP address exceptions to your Vulnerability Protection profile if Inline Cloud Analysis produces false-positives. You can add exceptions by specifying an external dynamic list (URL or IP address list types) or an
Addresses
object.
Add an
External Dynamic Lists
or [IP]
Addresses
object exception.
Select
Objects > Security Profiles > Vulnerability
to return to your Vulnerability Protection profile.
Select a Vulnerability profile for which you want to exclude specific URLs and/or IP addresses and then select
Inline Cloud Analysis
.
Add
an
EDL URL
or
IP Address
, depending on the type of exception you want to add, and then select a pre-existing URL or IP address external dynamic list. If none are available, create a new external dynamic list. For IP address exceptions, you can, optionally, select an
Addresses
object list.
Click
OK
to save the Vulnerability Protection profile and commit your changes.
(Optional)
Monitor Advanced Threat Prevention