Prisma AIRS
Without Strata Logging Service - Threat Logs
Table of Contents
Without Strata Logging Service - Threat Logs
View security threat logs without Strata Logging Service.
| Where Can I Use This? | What Do I Need? |
|---|---|
|
For comprehensive threat detection and analysis with Panorama, you should
use Firewall/Threat logs with subtype ai-security when not using
Strata Logging Service.
- Log in to Strata Cloud Manager.Navigate to Incidents and Alerts→ Log Viewer.Select Firewall/Threat logs with subtype "ai-security".The logs provide the following information:
- Panorama supports “Threat” logs with the subtype ‘ai-security' to log threats triggered by the AI security profile.
- The ' Threat Category ' column identifies specific Prisma AIRS AI Runtime: Network intercept threat types.
- Enhanced threat details include Threat IDs, which uniquely combine the threat category and model name (for example, “AI Prompt Injection: GCP - Gemini 1.5 Flash”). See the threat category types table below for more information about the specific Threat IDs, descriptions, and severities.
- Advanced filtering capabilities enable you to analyze specific threat types or combinations of threats and models.
- This log type is recommended for Panorama-managed firewalls or when you don’t want to forward the logs to Strata Logging Service.
![]()
Threat Category TypesThe table below provides details on the various threat categories, when they are triggered, and their respective severities:Threat CategoryIssue ID Description Severity Threat ID: Name Example Threat ID ai-prompt-injection Prompt injection detection Medium AI Prompt Injection: <Model Name> AI Prompt Injection: GCP - Gemini 1.5 Pro ai-url-security URL category triggered with action Alert or Block Low AI URL Security: <Model Name> AI URL Security: GCP - Gemini 1.5 Pro ai-data-leakage Sensitive data detected by DLP Dependent on configurations AI Data Leakage: <Model Name> AI Data Leakage: GCP - Gemini 1.5 Pro ai-model-access-control Traffic blocked due to model access control setting Low AI Model Access Control: <Model Name> AI Model Access Control: GCP - Gemini 1.5 Pro ai-latency-block Traffic blocked due to max latency setting Low AI Latency Block: <Model Name> AI Latency Block: GCP - Gemini 1.5 Pro ai-database-security-<query type> Database query detected with action Alert or BlockQuery Type: Read, Create, Update, DeleteRead: LowCreate: MediumUpdate: MediumDelete: HighAI Database Security <query type>: <Model Name> AI Database Security Read: GCP - Gemini 1.5 ProAI Database Security Create: GCP - Gemini 1.5 ProAI Database Security Update: GCP - Gemini 1.5 ProAI Database Security Delete: GCP - Gemini 1.5 Pro
