About Prisma SASE Incidents and Alerts
Learn where to manage Prisma Access incidents and alerts in Strata Cloud Manager
and how to use this reference to remediate them.
| Where Can I Use This? | What Do I Need? |
|---|
|
|
- AI-Powered ADEM license
- Autonomous DEM license
Prisma Access license
|
The Prisma® Access Incidents & Alerts dashboard is
deprecated. Strata Cloud Manager now manages
Prisma Access incidents through the
Unified Incident Framework, which you access from
Incidents.
Strata™ Cloud Manager consolidates incidents from
Prisma Access, Next-Generation
Firewalls (NGFWs), Cloud NGFW, and WildFire® into a single
Incidents view. You can troubleshoot a
Prisma Access issue alongside related issues on your other products without
switching dashboards, and you manage settings and notifications for all products in one
place. To view
Prisma Access incidents, select , and then filter by
Product or select the
Prisma Access count in the
BY PRODUCT widget. Select an
incident to view its description, impacted objects, evidence, remediation, and activity
log. The
Code column shows the incident code that you look up in
this reference.
If your deployment includes more than one
Prisma Access tenant, choose a tenant from
Prisma Access Tenant to scope incidents and incident settings
to that tenant.
Panorama subtenancy support keeps your
tenant selection as you move between the incident list and the settings pages, and
incidents from other products remain visible regardless of the tenant you choose.
How Prisma Access Raises Incidents
An incident is a current or emerging degradation in availability, security posture,
or performance that requires your action. Prisma Access raises an incident when
it can detect and qualify business impact, or when it can detect the issue with
higher precision through correlation, aggregation, or anomaly detection.
Alerts are the underlying signals that feed incidents. When an issue occurs in your
network (for example, 15 minutes of continuous application degradation), a raise
condition triggers an alert. The Strata Cloud Manager incident correlation engine
then groups related alerts into a single incident for the underlying issue. For
example, when a tunnel goes down and causes a Border Gateway Protocol (BGP) session
to drop, you receive one incident for the tunnel, with the BGP session drop included
as a related symptom. The engine waits for a short evaluation window before it
raises an incident so that related alerts can arrive. If the condition resolves
within that window, no incident is raised.
When you fix the underlying issue, Prisma Access validates the cause, resolves the
symptoms, and clears the incident automatically. You can also acknowledge, comment
on, or manually clear an incident from the incident table. Priority alerts clear
only when the issue that triggered them is fixed; you can't clear them
manually.
You receive incident notifications through the
notification profiles that you attach to
incident settings, using email, webhooks, or ServiceNow. Email notifications for
associated events, which are new alerts
that correlate with an open incident, are disabled by default to reduce notification
volume.
Where to Find Prisma Access Dashboard Features
Each page of the deprecated Prisma Access Incidents & Alerts dashboard has an
equivalent in .
| Previous Dashboard Page | Location in Strata Cloud Manager Incidents |
|---|
| Overview | Summary—The RAISED PAST
24H, CLEARED PAST 24H,
SUPPRESSED PAST 24H, BY
SEVERITY, BY PRODUCT,
BY PRIORITY, BY
CATEGORY, and INCIDENT
TREND widgets. |
| Incident List | Summary—The Incidents table. Filter by
Product, Severity,
Priority,
Category, Incident
Code, Object Type, or
State, or use Add
Filter for more options. The table also shows
operational status and assignee, which replace the ServiceNow
widgets on the previous dashboard. |
| Priority Alerts | No separate page. The correlation engine groups priority alerts
into incidents. Look up alert codes in Priority Alerts. |
|
| Notification Profiles | Notification Profiles—Create and test email,
webhook, and integration profiles. |
| ServiceNow Audit Log | ServiceNow Audit Log—Each incident ID and
the ServiceNow operations performed on it, such as create, update,
and delete. Set up the connection with ServiceNow integration. |
|
Notification Profiles, Informational
Alerts, and ServiceNow Audit Log apply to
your entire tenant service group rather than to a single Prisma Access tenant,
so the Prisma Access Tenant selector doesn't appear on those
pages.
