Focus

Malware Protection Events

Table of Contents

Malware protection events are generated when Prisma Browser detects malicious content in files, websites, or browser extensions.

Event Types

Event Type	UI Name	Description
maliciousFile	Malicious file identified	A file was identified as malicious by one or more scan engines
maliciousWebsite	Malicious website	A website was classified as malicious by URL reputation or real-time analysis
maliciousExtension	Malicious extension	A browser extension was identified as malicious

Field	UI Label	Description
file.name	File name	The name of the malicious file
file.extension	File type	The file extension
file.sha256	File SHA-256	The SHA-256 hash of the file
file.url	File URL	The URL from which the file was downloaded
content.scanEngine	Scan engine	The engine that detected the threat (Talon, CrowdStrike, CrowdStrike Quick Scan, CrowdStrike Indicators, OPSWAT MetaDefender Core, Yazamtech, Symantec, Votiro, AWF)
classification.maliciousCategories	Reason	The malware categories identified (Keyloggers, Malware, Phishing, Spyware and Adware, Botnet, Spam)
classification.reputation	Reputation	Numeric reputation score

Field	UI Label	Description
network.url	URL	The malicious URL
network.classifications	Website classification	URL categories assigned
network.webScanEngine	Web Scan Engine	The engine that classified the URL (PAN-DB, URL Real-Time, Live Page Scanning, ADNS, Hosts File)
network.webScanEngines	Web Scan Engines	All engines that contributed to the classification
network.webRiskLevel	Risk Level	The risk level of the URL
classification.maliciousCategories	Reason	The threat categories (Keyloggers, Malware, Phishing, Spyware and Adware, Botnet, Spam)

When a malicious website is detected by real-time page scanning rather than URL reputation:

Field	Description
content.liveScanning.scanMethod	Detection method used (Content analysis, Injected script, Screenshot analysis)
content.liveScanning.triggeredBy	User action or automatic page behavior
content.liveScanning.maliciousObject	The type of malicious object (Iframe, Webpage, Service worker, Clipboard)
content.liveScanning.maliciousContentUrl	URL of the malicious content

Field	UI Label	Description
browserExtension.name	Extension name	The name of the malicious extension
browserExtension.id	Extension ID	The Chrome Web Store extension ID
browserExtension.version	Extension version	The extension version
extensionRisk.risk	Risk	The risk level assigned (Low, Medium, High, Malicious, Unknown)
extensionRisk.initiator	Initiator	Who initiated the action (User, Policy, Automatic)
extensionRisk.trigger	Trigger	What triggered the detection (ID, Permissions, Risk)

Prisma Browser uses multiple scan engines to detect threats. The following engines may appear in malware protection events:

Engine	Description
Talon	Prisma Browser built-in scan engine
CrowdStrike	CrowdStrike file reputation check
CrowdStrike Quick Scan	CrowdStrike cloud-based quick scan
CrowdStrike Indicators	CrowdStrike indicator-based detection
OPSWAT MetaDefender Core	OPSWAT multi-scan engine
Yazamtech	Yazamtech file analysis
Symantec	Symantec file scan
Votiro	Votiro content disarm and reconstruction
AWF	Advanced WildFire sandbox analysis

For website classification:

Engine	Description
PAN-DB	Palo Alto Networks URL filtering database
URL Real-Time	Real-time URL classification
Live Page Scanning	Real-time analysis of page content, scripts, and iframes
ADNS	Advanced DNS-based classification
Hosts File	Local hosts file-based filtering

Events may include one or more of the following threat categories:

Category	Description
Keyloggers	Keystroke logging malware
Malware	General malware
Phishing	Credential harvesting or social engineering
Spyware and Adware	Tracking or advertising software
Botnet	Command-and-control communication
Spam	Spam-related content

Malicious File — Blocked on Download

Field	Value
Type	Malicious file identified
Category	Malware
User	john.smith@acme.com
URL	www.sketchy-downloads.net/free-tool.exe
File name	free-tool.exe
Scan engine	CrowdStrike
Reason	Malware
Action	Blocked
Severity	High

Malicious Website — Phishing (PAN-DB)

Field	Value
Type	Malicious website
Category	Malware
User	jane.doe@acme.com
URL	www.acme-login-verify.fake-domain.com/signin
Web Scan Engine	PAN-DB
Reason	Phishing
Risk Level	High
Action	Blocked

Malicious Website — Detected by Live Page Scanning

Field	Value
Type	Malicious website
Category	Malware
User	bob.jones@acme.com
URL	www.legitimate-news.com/article/12345
Web Scan Engine	Live Page Scanning
Scan method	Content analysis
Malicious object	Iframe
Malicious content URL	malware-cdn.evil.net/payload.js
Reason	Malware
Action	Blocked
Severity	Very high

Malicious Extension — Detected by Risk