In addition to coordinating with Palo Alto Networks next-generation firewalls, Device Security supports bidirectional integrations with many third-party systems through Next-Gen Integration. Device Security gathers device data, network data, security posture, and vulnerability information from third-party systems to enrich its own inventory and capabilities. At the same time, Device Security shares information back to those systems, augmenting their databases and services with contextual awareness of all device types, including IoT, OT, Medical IoT, and IT devices. Device Security can integrate with the following third-party applications:

Next-Gen Integration connects Device Security directly to third-party security and operations tools in your environment. Through Next-Gen Integration, you can manage scheduling, credential management, and data synchronization for each integration, giving you centralized visibility into integration health and activity across your network, all within Device Security.

Every integration is organized into four layers. An integration category groups integrations by functional domain, such as Network Access Control or Vulnerability Management. Within each category, an integration type identifies the specific third-party product, such as Cisco ISE or Tenable. An integration profile is a reusable configuration that defines the schedule and scope for use cases within an integration. An integration instance is a deployed, named connection to a specific third-party system. You can create multiple instances of the same integration type to connect to separate deployments of the same product.

Each integration type supports one or more use cases, which determine the direction and type of data exchange between Device Security and the third-party system. Inbound use cases pull data from the third-party system into Device Security, enriching the device inventory with additional attributes and context. Outbound use cases push data from Device Security to the third-party system, sharing device profiles, risk scores, and policy recommendations. Action use cases trigger an operation on the third-party system, such as quarantining a device or updating a network policy.

You configure use cases in profiles, and then associate profiles with integration instances. Each profile supports one configuration of each use case. Each integration instance supports one profile. To configure the same use case with different schedules, you need to configure a separate profile for each schedule, and then associate each profile with a different integration instance.

By default, Next-Gen Integration runs in the cloud and connects directly to third-party systems that expose cloud-accessible APIs. For third-party systems that are not reachable from the cloud, such as systems running in isolated networks or on-premises environments without public endpoints, you can deploy an on-premises engine. An engine is a lightweight agent that you run on a virtual machine in your network. It proxies communication between the cloud platform and the third-party system without requiring you to expose internal systems to the internet.