>
    Strata Copilot
    Enable Inline Cloud Analysis
    Focus
    Download PDF
    Focus
    1. Home
    2. FedRAMP
    3. Network Security FedRAMP
    4. NGFW (Hardware and VM) FedRAMP Moderate and High Requirements
    5. FedRAMP High CDSS Single SKU
    6. Enable Inline Cloud Analysis
    Download PDF
    FedRAMP

    Enable Inline Cloud Analysis

    Table of Contents

    Enable Inline Cloud Analysis

    Enable Inline Cloud Analysis (ICA) to allow Advanced WildFire, Advanced URL Filtering, and Advanced Threat Prevention to share security intelligence in real time.
    Where Can I Use This?What Do I Need?
    • NGFW (Managed by Strata Cloud Manager)
    • NGFW (Managed by PAN-OS or Panorama)
    • FedRAMP High Advanced WildFire license
    • FedRAMP High Advanced URL Filtering license
    • FedRAMP High Advanced Threat Prevention license
    • PAN-OS 11.1 or later
    • FIPS-CC mode enabled
    Inline Cloud Analysis (ICA) uses a single file manager to process data for Advanced WildFire, Advanced URL Filtering, and Advanced Threat Prevention together, enabling these services to share real-time security intelligence and improve threat detection accuracy.
    You must have active FedRAMP High licenses for all three services (Advanced WildFire, Advanced URL Filtering, and Advanced Threat Prevention) before you enable ICA. Enabling ICA without all three FedRAMP High licenses causes connectivity issues with Advanced URL Filtering and Advanced Threat Prevention.
    1. Verify that active FedRAMP High licenses exist for Advanced WildFire, Advanced URL Filtering, and Advanced Threat Prevention.
      1. Log in to the NGFW web interface.
      2. Select DeviceLicenses and confirm that Advanced WildFire, Advanced URL Filtering, and Advanced Threat Prevention licenses are active and classified as FedRAMP High.
    2. Edit to the Advanced WildFire configuration.
      1. Select DeviceSetupWildFire.
      2. Select Edit in the General Settings section.
    3. Enable Inline Cloud Analysis.
      1. Enable Inline Cloud Analysis.
        When ICA is enabled, Advanced WildFire, Advanced URL Filtering, and Advanced Threat Prevention use a shared single file manager to process inline analysis data. This allows all three services to coordinate threat intelligence in real time.
      2. Select OK to save the settings.
    4. Select Commit to apply the changes.
    5. Verify ICA is active by running the following CLI command:
      show wildfire status
      Confirm that the ICA status shows as active and that the connection uses a FedRAMP High Advanced WildFire domain.

    © 2026 Palo Alto Networks, Inc. All rights reserved.