>
    Strata Copilot
    PACli Commands for Collecting Endpoint Insights
    Focus
    Download PDF
    Focus
    1. Home
    2. Prisma Agent
    3. Manage Prisma Agents
    4. Endpoint Insights for Prisma Agent
    5. PACli Commands for Collecting Endpoint Insights
    Download PDF
    Prisma Agent

    PACli Commands for Collecting Endpoint Insights

    Table of Contents

    PACli Commands for Collecting Endpoint Insights

    Learn how to manage endpoint insights using specific Prisma Agent (PACli) commands.
    Where Can I Use This?What Do I Need?
    • Prisma Access (Managed by Strata Cloud Manager)
    • Prisma Access (Managed by Panorama)
    • NGFW (Managed by Panorama)
    • Check the prerequisites for the deployment you're using
    • Minimum required Prisma Agent version: 25.7
    • macOS 14 and later or Windows 10 version 2024 and later desktop devices
    • Contact your Palo Alto Networks account representative to activate the Prisma Agent feature
    You can manage endpoint insights using specific Prisma Agent commands (PACli) on your endpoints. These commands enable you to control various aspects of the feature's functionality directly from the command-line interface. You can ask the user to enter the commands or enter the commands on their behalf in the remote shell.

    Core Endpoint Insights Commands

    • pacli eie status
      Enter this command to show the status of endpoint insights, including whether diagnostics collection and self-healing are enabled, and any active self-healing sessions.
    • pacli eie enable
      Enter this command to manually enable diagnostics collection, which is disabled by default. Administrators can also enable this feature by selecting Endpoint Insights in the Agent Settings in Strata Cloud Manager.
    • pacli eie disable
      Enter this command to manually disable diagnostics collection. Administrators can also disable this option by deselecting Endpoint Insights in the Agent Settings in Strata Cloud Manager.
    • pacli eie report -d "<description>"
      Enter this command to report an issue and trigger the collection of diagnostics from an endpoint. When self-healing is enabled, the agent also automatically applies remediation steps. Users enter a description in 1000 characters or less. If Endpoint Insights is disabled, no diagnostic data is collected. If self-healing is disabled, diagnostic data is collected, but no self-healing actions are taken.
      The pacli eie trigger command is deprecated in Prisma Agent 26.3 and replaced by pacli eie report. The behavior is identical.

    Self-Healing Commands (Prisma Agent 26.3)

    • pacli eie heal enable
      Enter this command to manually enable self-healing on the endpoint. You can also enable self-healing from the Self Healing setting in the agent settings in Strata Cloud Manager.
    • pacli eie heal disable
      Enter this command to manually disable self-healing on the endpoint. You can also disable self-healing from the Self Healing setting in the agent settings in Strata Cloud Manager.
    • pacli eie heal run
      Enter this command to run only local self-healing actions on the endpoint. This does not collect logs or request remote actions from Endpoint Manager
    • pacli eie sessions
      Enter this command to list recent Endpoint Insights sessions, including self-healing sessions, with their session IDs and status. Active sessions are marked with an asterisk (*) in the output.
    • pacli eie sessions <id>
      Enter this command to show the details of a specific Endpoint Insights session, including which remediation actions were applied and whether the session succeeded. Replace <id> with the session ID from the pacli eie sessions output.
      The in-depth details are only available after the session completes. While a session is running, use pacli eie sessions (without an ID) and check the state column to track the progress.

    © 2026 Palo Alto Networks, Inc. All rights reserved.