Use the Prisma AIRS AI Sessions and API Application Views
Focus
Focus
Prisma AIRS

Use the Prisma AIRS AI Sessions and API Application Views

Table of Contents

Use the Prisma AIRS AI Sessions and API Application Views

Learn how to use the AI Session and A
Where Can I Use This?What Do I Need?
  • Strata Cloud Manager
  • Prisma AIRS
Prisma AIRS's AI Sessions and API Applications views provide you with essential visibility into the runtime security of your AI applications. You can verify the legitimacy of threat blocks, understand the context of security violations, and manage your AI applications from a single interface in Strata Cloud Manager (SCM). Moreover, you’re able to view the actual prompts and model responses that trigger security alerts. And Additionally, you can view the specific LLM payloads that violated security policies, helping you validate detections and reduce false positives.
The Applications View provides a centralized dashboard showing all your AI applications with their associated security violations, allowing you to quickly identify which applications need attention. You can filter applications by monitoring period, violation severity, tags, security profiles, and cloud provider. For each application, you can see detailed metadata, violation trends, and linked security profiles.
The Sessions View allows you to examine individual AI sessions, which are logical groupings of related API calls sharing the same transaction ID. This view shows the sequential flow of prompts and responses that make up a conversation, with clear indicators of which content violated security policies. You can drill down into individual transactions to see the exact payload content and which security profiles were violated.
This feature requires your applications to send a consistent transaction ID with related API calls to properly correlate them into sessions. If no transaction ID is provided, the system automatically creates one for each atomic API call. For enterprise deployments, the feature supports RBAC integration to ensure that sensitive data in prompts and responses is only accessible to authorized personnel.

API Applications View

Prisma AIRS Runtime Security's AI Application view provides you with comprehensive visibility into your AI-enabled applications in Strata Cloud Manager (SCM). This feature addresses a critical challenge for security teams - understanding which AI applications exist in your environment and identifying which ones have security violations.
You can discover and monitor all AI applications that interact with your Prisma AIRS API, with each application displaying its associated sessions, violations, and security profiles. The Application View enables you to quickly identify which applications have the most violations through a top-level dashboard that shows total applications with violations and application violation trends over time. You can filter applications by monitoring period, violation severity, tags, security profiles, and cloud provider to focus on specific segments of your environment.
For each application, you see detailed information including application ID, name, tags, cloud provider, and violation metrics. When you select a specific application, a detailed flyout view reveals expanded metadata, session counts, violation breakdowns by severity and type, and linked security profiles. This context helps you prioritize which applications need immediate security attention and understand the nature of the violations occurring in each application.
The Application View displays a dashboard that shows total applications with violations and application violation trends over time. The Total Applications with Violations pie chart shows your top five applications with security issues over the selected period. The Application Violations Timeline presents a trend view of violations across all applications for the past 30 days, allowing you to identify patterns or spikes in security incidents.
The AI Application View becomes more valuable when paired with the AI Sessions View, as you can click through from an application to see all of its associated sessions, providing the context needed to analyze and address security incidents. You can see the details of manually-created applications and applications that are automatically discovered when developers make API calls with new application names in metadata, enabling comprehensive visibility regardless of how applications are onboarded.
You can filter applications using several criteria. The Monitor Since filter limits results to a specific time range. Violations by Severity allows you to focus on critical, high, medium, or low severity issues. Tags filters by user-defined application tags. Security Profiles Applied narrows results to applications using specific security configurations. Cloud filters by cloud provider, and Source indicates the detection method.
Column NameDescription
Application ID and Application Name
Unique identifiers for your application
Tags
User-defined labels for organization.
Cloud
The cloud service provider (AWS, Azure, GCP, or Other) hosting your application
Source
The source of detection; how the application was discovered
Violating Sessions
The number of sessions that violate your enabled security profiles and the total number of sessions detected
You can view further details about each application by clicking on the Application Name.
Field NameDescription
Application Overview
Application Name
Unique identifier for your application
Tag
User-defined labels for organization
Cloud
The cloud service provider (AWS, Azure, GCP) hosting your application
Linked Security Profile
Shows which security configurations are protecting the application
Monitor Since
Indicates when monitoring began when monitoring of this application began
Source of Detection
Shows how the application was discovered
Related AI Sessions
Total Sessions
The total session associated with this application
Violated Sessions
The total number of sessions that violate a security profile
Violation Breakdown
Provides details about the number of violations of each severity level.
You can hover over the information icon to view additional details about the violations, such as the violation types and the number and severity of each type.
Security Profile Overview
Provides details on the security policies protecting this application

AI Sessions View

Prisma AIRS Runtime Security's AI Session view enables you to inspect and analyze individual AI conversations processed through your Prisma AIRS API. This view provides visibility into AI transactions by allowing you to verify the legitimacy of security findings and understand the context in which violations occur.
To implement this feature, you must configure your applications to include a consistent transaction ID with related API calls. This allows the system to correlate requests into coherent conversations, providing the context necessary for meaningful security analysis.
The Session View displays high-level statistics at the top of the page. These metrics aggregate data over the selected time period and display percentage changes compared to the previous comparable period. The Total AI Sessions vs. Violations bar chart visualizes the relationship between your total sessions and those with security issues over time.
You can filter sessions using several criteria. The Monitoring Period lets you select from the past one hour, 24 hours, 7 days, or 30 days. Application Name filters sessions to a specific application. Violations by Severity narrows results by security impact level. Security Profiles Applied shows sessions using particular security configurations, and Cloud filters by provider.
Field NameDescription
Total AI Sessions
The total number of AI sessions processed by Prisma AIRS during the last 30 days
Total AI Sessions with Violations
The total number of AI sessions with violations identified during the last 30 days
Total Critical Violations
The total number of AI sessions with critical violations identified during the last 30 days
AI Session ID
Unique identifiers for the session
Application Name
The name of the application participating in the session
Tags
User-defined labels for organization
Last Session Activity
The date and time of the last activity of the session
Violations
The number of violations that occurred during the specified session and the severity of each violation
You view additional details about each session by clicking on the AI Session ID.
Field NameDescription
AI Session Overview
AI Session ID
Unique identifier of the AI session
Application Name
The name of the application associated with the session
Application Tag(s)
User-defined tags applied to the application associated with the session
Cloud
The cloud service provider (AWS, Azure, GCP, or Other)) hosting your application
Source of Detection
Shows how the application was discovered
Last Activity
The time and date of the last time activity was detected for the session
Start Time
The time and date the session began
End Time
The time and date the session ended
AI Session Transaction Details
Timestamp
The time of each transaction in the session
Scan ID
A unique identifier of the scan
Content Type
Indicates what the type of transaction occurred
Security Breakdown
The number of violations per transaction and the severity of each violation
To gain further insight into the session, you can drill down to the transaction that caused the security profile violation. This view provides the details of the transaction including the prompt and response where the violation occurred.
Field NameDescription
Content Overview
Action Time
The time the transaction began
Duration
The amount of time the transaction lasted
Status
Displays the status of the transaction.
  • Passed: no violations detected
  • Violated: one or more violations were detected
Policy Violation
The number and severity of the violation(s)
Application Name
Name of the application that participated in the transaction
Transaction Metadata
Session ID
Unique identifier of the AI session
Scan ID
A unique identifier of the scan
Scan Sub Request ID
If the Scan API request is of the Async type, with multiple requests sent in a batch, this identifier identifies each request in the batch. Scan requests that are not batched have a Scan Sub Request ID of zero (0).
Environment
The cloud service provider (AWS, Azure, GCP, or Other) hosting your application
Model Name
The AI model name sent in the API request metadata.
Environment
The cloud service provider (AWS, Azure, GCP, or Other) hosting your application
Profile
The security profiles applied to this session
Transaction Content
If the Content Type is Prompt
The prompt and response of the transaction
If the Content Type is Tool EventThe contents of the tool event request
Security Profiles Used by the Transaction
The security profiles applied to this session and on which detector(s) the transaction failed