Create the Integration

1. Establish the Service Account

   Before configuring ServiceNow, we must establish a secure "handshake" between the platforms. A Service Account in Prisma Access is your API interface.

   • In StrataCloudManager (SCM) go to: System SettingsIdentity and Access Management.
   • Click Add Identity button.
   • Select Identity TypeService Account.
   • Click Next.
   • Copy or download Client Credentials- that’s your API Key, you will need it later.
   • Assign Roles: Prisma Browser Superuser - you may later demote this role, if needed.
2. Create an Application in ServiceNow

   1. Navigate to App Engine Studio and click Create app.
   2. In the "Basic Info" step, enter the Name: PB JIT (or whatever the name you prefer) and Description: Prisma Browser user-requests admin approval.
   3. Click Continue.
   4. In the "Roles" step, keep the default roles (admin and user) and click Continue.
   5. Click Go to app dashboard:

   Create a Data Table

   Create a Data Table to mirror the requests from the Browser. This allows for native ServiceNow reporting, auditing, and assignment.

   In the app dashboard, under the "Data" section, click Add.

   • Select Create a blank table and click Continue.
   • Select Create new table and click Continue.
   • Define the table properties:
     • Table label: Requests
     • Table name prefix: x_1679770_pb_jit_0_ (This will vary)
     • Table name: requests
     Save the Table name prefix and table name (for example: x_1679770_pb_jit_0_requests). You will need this later.
   • Click Continue.
   • Define permissions for the table (ensure admin and user roles have Create, Read, Write, Delete permissions) and click Continue.
   • Once the table is created, click Edit and add the following table fields:
   • Column label	Column name	Type	Max length
     RequestID	requestid	String	40
     URL	url	String	2,048
     Reason	reason	String	255
     Status	status	String	40
     UserID	userid	String	40
     CreatedAt	createdat	String	40
     Username	username	String	128
     Email	email	String	320
     Comment	comment	String	255
     adminBypassTimeframe	adminbypasstimeframe	String	40
     Type	type	String	40

   • Click Save.
   • Click Preview and then click the gear icon to Personalize List.
   • Select the following fields:
     • RequestID,
     • URL
     • Reason
     • Status
     • CreatedAt.

   Configure the Form

   This is the form where every individual request will be seen and acted upon.

   1. Go back to Data Table & Forms tab where the Requests table is open, click on the Forms.
   2. Configure the form similar to what is shown below. Make all fields Read only except Status, Comment, and adminBypassTimeframe.
   3. Configure the Status field to be a dropdown with the following choices:
      • Label: PendingValue: pending
      • Label: PendingValue: pending
      • Label: DeclinedValue: decline
      • Label: RevokedValue: revoke
   4. Configure the adminBypassTimeframe field to be a dropdown with the following choice of values: Once, 10m, 1h, 4h, 9h, 12h, 24h, 3d, 7d, 14d, 30d, 60d, 90d
   5. Click Apply and then Save form.
      The final result will look like this -

   Create the Admin Approval Workspace

   Workspace is your dashboard where you see a list of all requests. A main interface for your app.

   1. In the app dashboard, under the "Experience" section, click Add.
   2. Select Workspace.
   3. Define the workspace properties:
      • Name: PB Admin Approval
      • URL: pb-admin-approval (The full URL will be displayed)
      • Name: PB Admin Approval URL: pb-admin-approval (The full URL will be displayed) Roles: will be pre-populated with default Admin and User created previously (your prefix will vary)
   4. Click Continue.

   Select Requests as the Primary table and click Continue.

   You can then edit the default view to make your dashboard more aesthetic and informative:

   At this point, your application has a table to store your requests and a user interface to see or approve/deny these requests.
3. Configure Prisma Access as an OAuth Provider

   Before we script the logic, we define the "Interface" in ServiceNow. This centralizes the endpoints so that if the API version updates, you change it in one place rather than in every script.

   Path:System Web Services > Outbound > REST Messages

   Native OAuth 2.0 Integration involves three main ServiceNow components:

   1. Application Registry: Defines the external system (Prisma Access) as an OAuth provider.
   2. OAuth 2.0 Credentials: Stores your client secret and links it to the provider profile.
   3. Outbound REST Message: Uses the credential to automatically inject the Bearer token into your POST requests.

   Register an Application

   Before ServiceNow can request a token, it must know where to send the request.

   • Navigate to All > System OAuth > Application Registry and click New.
   • Select Connect to a third party OAuth Provider.
   • Name: Prisma Access.
   • Client ID & Client Secret: Insert your ID and Secret obtained in Step 1
   • Token URL: https://auth.apps.paloaltonetworks.com/oauth2/access_token
   • Default Grant Type: Client Credentials for this system-to-system integration.
   • OAuth entity profile will be created automatically.

   Create the Credential Record

   This record acts as the "key" ServiceNow uses to authenticate.

   • Navigate to All > Connections & Credentials > Credentials and click New.
   • Select OAuth 2.0 Credentials.
   • Name: Prisma Access Creds.
   • OAuth Entity Profile: Select the profile automatically created in Step 1.
   • Click Submit. Open the record again and click the Get OAuth Token related link to verify ServiceNow can successfully reach the external system and receive a token.

   Open the record again and click the Get OAuth Token related link to verify ServiceNow can successfully reach the external system and receive a token.

   Create the Connection Alias

   1. Navigate to All > Connections & Credentials > Connection Aliases and click New.
   2. Name: Prisma_Access_Alias.
   3. Type: Connection & Credential.
   4. Configuration Tier: External.
   5. Submit.

   Now you need to add a connection.

   Link the Connection and Credentials

   Once the Alias is created, you must define the "Connection" record that tells the Alias where to go.

   1. Open your new Alias and click the Connections related list, then click New.
   2. Name: Prisma Access Connection For Alias
   3. Connection URL: Your Prisma Access API POST URL: https://api.sase.paloaltonetworks.com
   4. Credential: Select the OAuth 2.0 Credentials you created in the previous turn.

   Create an Outbound REST Message

   This REST Message will be used to both pull user-requests from the Prisma API into the ServiceNow table and to post updates.

   1. Navigate to Outbound REST Message and click New.
   2. Define the REST Message:
      • Name: Prisma Access Integration
      • Description: Outbound request to Prisma API
      • Endpoint: https://api.sase.paloaltonetworks.com/
      • Authentication: OAuth 2.0, pick the profile created earlier.
      • Click Submit.

   1. Open the Prisma Access Integration record to open it to configure HTTP Methods.

   Even though it is possible to manually define HTTP POST and GET URLs for each request, having these centrally managed is better in production.

   Configure the HTTP Methods:

   1. Add new HTTP Method
      • Name: get_requests
      • HTTP method: GET
      • Endpoint:
        https://api.sase.paloaltonetworks.com/seb-api/v1/user-requests?sort=${sort}&order=${order}&cursor=${cursor}
      Request parameters are optional, and only needed to handle sorting and pagination.
      • Authentication type: Inherit from parent
      • Click Auto-generate variables. This will create the cursor, order and sort variables.
      • Click Test. If all is well, you’ll get a sizable JSON with requests in response:
      • Click Update.
   2. Add a second HTTP Method to get User details:
      • Click New under HTTP Methods.
      • Name: get_user_details
      • HTTP method: GET
      • Endpoint: https://api.sase.paloaltonetworks.com/seb-api/v1/users/${userid}
      • Authentication type: Inherit from parent
      • Click Auto-generate variables. This will create userid variable.
      • Click Update.
   3. 1. Add a third HTTP Method to POST decisions:
         • Click New under HTTP Methods.
         • Name: post_action
         • HTTP method: POST
         • Endpoint: https://api.sase.paloaltonetworks.com/seb-api/v1/user-requests/${action}
         • Authentication type: Inherit from parent
         • Click Auto-generate variables. This will create action variable.
         • Click Update.
      This third method will be used to post both approve/deny and revoke decisions.
      Approval and revocation use different endpoints and different payload, hence the variable ${action} at the end so we can dynamically change it in a script depending on decision made.

   Your ServiceNow system is now ready to make API Calls
4. The Sync Engine - Pull Requests via Scheduled Jobs

   This logic acts as the "Heartbeat" of the integration. It reconciles the ServiceNow table with the Management Console every 5 minutes to prevent "State Drift."

   Path: System Definition > Scheduled Jobs

   1. Name: PB 5-Minute Request Sync
   2. Run: Periodically (Every 5 Minutes)
   3. Core Logic:
      • The script calls get_requests from the outbound REST call created earlier.
      • It iterates through the JSON payload.
      • If the record exists: It checks if the status has changed. If so, it updates the local record.
      • If the record is new: It creates a new entry and triggers a secondary call to get_user_details to enrich the record with the user’s real name and email.

   Technical Note on Cursor Pagination: The API utilizes a cursor for large data sets. The script is recursive; if the API response indicates hasNextPage: true, the script immediately calls itself again with the new cursor until the entire queue is synchronized. For large scale deployments, this can be implemented with Data Stream Action.

   • Script: JavaScript
   • Remember to replace the x_1679770_pb_jit_0_requests with your actual Table name

     (function() {
         var tableName = 'x_1679770_pb_jit_0_requests'; // <--your table name
         var restMsg = 'Prisma Access Integration';
         
         sync(null);
     
         function sync(cursor) {
             try {
                 var req = new sn_ws.RESTMessageV2(restMsg, 'get_requests'); // <-- HTTP methiod from outbount REST 
                 req.setStringParameterNoEscape('cursor', cursor || '');
                 req.setStringParameterNoEscape('sort', 'request.created_at');
                 req.setStringParameterNoEscape('order', 'desc');
     
                 var res = req.execute();
                 if (res.getStatusCode() != 200) return;
     
                 var body = JSON.parse(res.getBody());
                 var items = body.data || [];
     
                 for (var i = 0; i < items.length; i++) {
                     var item = items[i];
                     var id = item.id || item.requestId;
     
                     var gr = new GlideRecord(tableName);
                     gr.addQuery('requestid', id);
                     gr.query();
     
                     if (gr.next()) {
                         // Update only if status changed to save DB cycles
                         if (gr.getValue('status') != item.status) {
                             gr.setValue('status', item.status);
                             if (item.status === 'Revoked') {
                                 gr.setValue('comment', item.revokerComment);
                             }
                             gr.update();
                         }
                     } else {
                         // New Record
                         gr.initialize();
                         gr.setValue('requestid', id);
                         gr.setValue('url', item.url);
                         gr.setValue('status', item.status);
                         gr.setValue('reason', item.reason);
                         gr.setValue('userid', item.userId);
                         gr.setValue('createdat', item.createdAt);
                         gr.setValue('type', item.type);
                         gr.setValue('comment', item.adminComment);
     
                         // Optional: Fetch User Details for new records
                         var userReq = new sn_ws.RESTMessageV2(restMsg, 'get_user_details'); // <-- HTTP methiod from outbount REST 
                         userReq.setStringParameterNoEscape('userid', item.userId); // <-- mapping of ${userid} variable in HTTP method 
                         var userRes = userReq.execute();
                         if (userRes.getStatusCode() == 200) {
                             var user = JSON.parse(userRes.getBody());
                             gr.setValue('username', user.name);
                             gr.setValue('email', user.email);
                         }
                         gr.insert();
                     }
                 }
     
                 // Pagination support
                 if (body.pageInfo && body.pageInfo.hasNextPage && body.pageInfo.cursor) {
                     sync(body.pageInfo.cursor);
                 }
             } catch (e) {
                 gs.error("PAB Demo Sync Error: " + e.message);
             }
         }
     })();
     

   After running this script, your table will be populated with all the requests in the Strata Cloud Manager.
5. Create the Action (PB POST) for API Update

   While the Sync Engine handles the "Pull," we need a reactive mechanism for the "Push." When an admin clicks "Approved" in ServiceNow, we want that enforced in the browser instantly.

   The Action will be used to send the updated request status back to the Prisma API.

   Once created, a request has the status “Pending”.

   An administrator may later change status to “Approved” or “Denied”, and may also change the “Approved” status to “Revoked”.

   A proper implementation of this simple workflow in ServiceNOW user interface requires careful design of the forms and catching exceptions: “Approved” status can’t be changed back to “Pending”, denial can’t be revoked, and so on. Perfecting UX is a business decision and thus out of scope of this document.

   For this exercise, we will implement a very simple logic and process all three options: approve, deny and revoke - in a single scripted step.

   1. Navigate to Flow Designer or Action Designer and click New > Action.
   2. Define the Action properties:
      • Action name: PB POST
      • Application: PB JIT automation
   3. Click Submit.
   4. Add the following Inputs to the Action:

      Label	Name	Type
      RequestID	requestid	String
      Status	status	String
      Comment	comment	String
      BypassTimeframe	adminbypasstimeframe	String
   5. Add a new step: Script (from the list of steps):
   6. Configure the Script step:
      • Runtime: Instance
      • Input variables: requestid, status, comment and adminbypass. For each name, use a Data Pill Picker to link the matching variable from action Inputs:
   7. Script: copy and paste

      (function(inputs, outputs) {
         var requestId = inputs.requestid;
         var status = inputs.status;
         var comment = inputs.comment || "Actioned via ServiceNow";
         var bypass = inputs.adminbypass || "Once";
        
         // Initialize the REST Message using your pre-configured record
         var request = new sn_ws.RESTMessageV2('Prisma Access Integration', 'post_action');
        
         var payload = {};
         var actionPath = "";
      
      
         // LOGIC: Determine endpoint path and payload based on status
         // this is for revocation
         if (status === 'revoke') {
             // Path: /seb-api/v1/user-requests/:id/revoke
             actionPath = requestId + "/revoke"; // <- forming the endpoint for HTTP action
             payload = {
                 "revokerComment": comment
             };
         } else {
             // Path: /seb-api/v1/user-requests/:id/action
             // Status here should be "Approved" or "Declined"
             actionPath = requestId + "/action";
             payload = {
                 "action": status,
                 "adminComment": comment,
                 "adminBypassTimeframe": bypass
             };
         }
      
      
         // Set the ${action} variable in your endpoint URL
         request.setStringParameterNoEscape('action', actionPath);
        
         // Set the Request Body
         request.setRequestBody(JSON.stringify(payload));
         request.setRequestHeader("Content-Type", "application/json");
      
      
         // Execute the call
         var response = request.execute();
         var statusCode = response.getStatusCode();
         var responseBody = response.getBody();
      
      
         // Output results to the Flow for logging/error handling
         outputs.status_code = statusCode;
         if (statusCode >= 200 && statusCode < 300) {
             outputs.result = "Success";
         } else {
             outputs.result = "Error";
             gs.error("PAB Action Failed. Status: " + statusCode + " Body: " + responseBody);
         }
      })(inputs, outputs);
      

   8. Click Save, then click Publish.
6. Create the Flow

   The Flow will trigger the PB POST action when a request record is updated in ServiceNow.

   1. Go back to App Engine Studio and navigate to your app's home page.
   2. Under "Logic and automation," click Add.
   3. Select Flow and click Continue.
   4. Define the Flow properties:
      • Name: PB POST
   5. Click Continue, then Edit this flow.
   6. Configure the TRIGGER:
      • Trigger: Updated
      • Table: Requests ([x_1117946_talon_requests]) <- use your table name
      • Condition: Status changes to Approved OR Status changes to Declined OR Status change to Revoked
      • Run Trigger: For every update
   7. Configure the ACTIONS:
      • Click (+) Add an Action, Flow Logic, or Subflow.
      • Select Action and choose the PB POST action you created on previous step.
      • Map the Action Inputs using the Data Pill Picker:
        • RequestID: Trigger - Record Updated > Requests Record > RequestID
      • Status: Trigger - Record Updated > Requests Record > Decision
      • Comment: Trigger - Record Updated > Requests Record > Comment
      • Admintimeframe: Trigger - Record Updated > Requests Record > timeframe
   8. Click Save and then Activate.

   Your applicationis now populated with fresh requests, and you will be able to act on them.
7. Add a Webhook

   We can configure Prisma Access to send a webhook every time a new permission request is generated.

   For simplicity, every webhook will trigger an already existing scheduled update script from Step 4 to initiate an update immediately.

   Configure ServiceNOW as API endpoint for Strata Logging Service

   1. Go to System Web Services -> Scripted REST API click New.
   2. Create an API.
      • Name: Prisma Browser API
      • Default ACL: Scripted REST External Default.
   3. Add API definition
      • Name: Prisma Browser Definition
      • HTTP method: POST
      • Relative path /incoming
      • Security: uncheck “requires authentication”; it makes an API public - for simplicity.
      • Content Negotiation: Check “Override…”, add “text/plain” to Supported formats.

   Copy and save Resource path - you will need it in the next step to configure a webhook in SLS

   Add the following script to call a scheduled job every time a webhook arrives:

   (function() {
      var jobName = "PB 5-Minute Request Sync";
      var gr = new GlideRecord('sysauto_script');
   
      // We use 'global' prefix if the job is in the global scope,
      // otherwise, GlideRecord will look in your app scope.
      gr.addQuery('name', jobName);
      gr.query();
   
      if (gr.next()) {
          gs.info("PB Automation: Found job: " + gr.name + " (SysID: " + gr.getUniqueValue() + ")");
         
          // Use executeNow for scoped apps
          gs.executeNow(gr);
         
          gs.info("PB Automation: Trigger command sent successfully.");
      } else {
          // If it fails here, the job might be in the Global scope while you are searching from a Private scope
          gs.error("PB Automation: ERROR - Job '" + jobName + "' not found. Check if the job is in the Global scope.");
      }
   })();
   

   Configure HTTPS event forwarding in Strata Logging Service (SLS)

   1. Open StrataLoggingService and open Log Forwarding. Add HTTPS forwarding profile:
   2. Name: Any descriptive name.
   3. URL: a combination of your ServiceNOW tenant URL plus Resource Path from previous step:
      • https://dev324853.service-now.com/api/x_1679770_pb_jit_0/pb_webhook/incoming
        your url will be different.
   4. Click Test Connection - if ServiceNow is configured properly, Test connection will succeed. Click Next.
   5. Add HTTPS filter:
      • endpoint/Events policy.action = 'permissionRequested'≠
8. Verify

   • Generate a new request with a browser.
   • Make sure it shows up in SCM as pending
   • Within 60 seconds, it shall be visible in the application - you will see it in your dashboard.
   • Approve the request in ServiceNow - SCM will show it as approved by Service Account you created on Step 1.
   • Revoke the permission in ServiceNow - - SCM will show it as Revoked by Service Account you created on Step 1.

Best Practices for Production Readiness