>
    Strata Copilot
    Security Lifecycle Review (SLR) for AWS Overview
    Focus
    Download PDF
    Focus
    1. Home
    2. Prisma AIRS
    3. Activation & Onboarding
    4. Security Lifecycle Review (SLR) for AWS Overview
    Download PDF
    Prisma AIRS

    Security Lifecycle Review (SLR) for AWS Overview

    Table of Contents

    Security Lifecycle Review (SLR) for AWS Overview

    This page walks you through the steps to deploy Security Lifecycle Review (SLR) in your cloud environment using the deployment workflow in Strata Cloud Manager.
    Where Can I Use This?What Do I Need?
    • Prisma AIRS AI Runtime Security Risk Assessment in AWS
    The cloud SLR (Cloud Risk Assessment) monitoring provides comprehensive visibility, control, security, and reporting for cloud workloads (VMs and cluster traffic) without deploying an inline firewall. SLR is deployed in packet mirroring mode to monitor the mirrored traffic sourced from the application Elastic Network Interface (ENI).
    Key Features:
    • Monitors inbound, outbound, and east-west traffic flows.
    • Use mirrored traffic between the application ENIs.
    • Generates detailed threat reports for threat and risk assessment.

    Limitations

    • SLR reports display only encrypted SSL/TLS traffic.
    • SLR deployment is supported in the US region and on AWS only.
    • SLR is supported on Prisma AIRS AI Runtime: Network intercept.
    • The SLR report does not differentiate between cluster and non-cluster traffic, as the report has no cluster ID.
    • SLR only monitors traffic from application ENIs on instance types supported by AWS.

    Getting Started

    1. Log in to the Hub and launch Strata Cloud Manager.
    2. Onboard and Activate a Cloud Account in Strata Cloud Manager.
      When you apply the onboarding Terraform in your cloud environment, it generates a service account with the necessary permissions to enable cloud asset discovery. The discovery identifies both applications and ENIs. The ENIs are used to send traffic to the SLR.
      You can onboard multiple projects or VPCs.
    3. Deploy SLR in AWS (GWLB-based or per-application VPC-based deployment). This deploys SLR in packet mirror mode.
    4. Download SLR reports to assess and identify potential threats.
    5. View the threat logs and AI security logs generated by SLR in the log viewer.
    6. After you assess the threats, deploy Prisma AIRS AI Runtime: Network intercept to secure your cloud assets.

    © 2026 Palo Alto Networks, Inc. All rights reserved.