Prisma SD-WAN Command Center Dashboard

• Unified Network Visibility — Gain a comprehensive view of network health, security, and efficiency across your SASE and standalone Prisma SD-WAN deployments.
• Enhanced Threat Monitoring — Consolidate SD-WAN security events into a single, aggregated threat dashboard for quicker detection and response.
• Actionable Insights — Classify hosts (Users, IoT, Unclassified) and applications (Internet, SaaS, Private) to understand traffic patterns and security posture.
• Streamlined Operations — Quickly identify and differentiate between Prisma SD-WAN sites and other network traffic for targeted management.

• Sources — Entities initiating network traffic, identified by endpoint type:
  • IoT & IT Devices
  • Users
  • Unclassified Hosts
  If Device Security or IoT Security is not active on your deployment, IoT & IT Devices displays zero and traffic from unidentified endpoints appears under Unclassified Hosts.
• Platforms — Network infrastructure components through which traffic traverses. These show which Palo Alto Networks products process your traffic:
  • NGFW
  • Prisma Access
  • Prisma SD-WAN — represented as Direct Access and Secure Direct Access. These labels reflect the Branch Security licensing and policy state at each site, not SD-WAN path-selection or routing behavior:
    • Direct Access — Prisma SD-WAN branches that do not have an active Branch Security license or any configured security policies. Traffic at these sites is not inspected at the branch.
    • Secure Direct Access — Prisma SD-WAN branches with an active Branch Security license and at least one configured security policy. Command Center identifies these sites through license association and policy attachment. It does not display an explicit traffic inspection tag — sites are classified based on their license and policy state.
• Applications — The ultimate destinations or services accessed by your traffic, categorized by type:
  • Internet Apps
  • SaaS Apps
  • Private Apps

Summary View

The Summary view provides an overview of network traffic flowing from source entities through platform nodes to application categories. Review the Source entities (IoT & IT Devices, Users, Unclassified Hosts) on the left, Platform nodes in the middle (including Direct Access and Secure Direct Access for Prisma SD-WAN branches), and Application categories (Internet, SaaS, Private) on the right. Hover over specific nodes to highlight traffic flows and view associated data counts. When you hover over a Prisma SD-WAN branch node, you can select View Branch Sites or Security Policy to navigate directly to branch details or the site's policy configuration.

To isolate Prisma SD-WAN traffic, open the Filters drawer and select Secure Direct Access under Platform Device Scope. By default, Command Center shows an aggregated view across all integrated products.

The bottom of the Summary view displays three widgets: Total Threats (blocked and alerted count), Best Practices Posture Assessment (compliance score and critical recommendations count for Prisma Access and NGFW assessments — clicking through opens the Zero Trust Posture Center; requires Essentials license; not applicable for standalone Prisma SD-WAN), and Gen AI Applications (count of Gen AI applications and users).

Threats View

The Threats view provides an aggregated count of threats detected across all connected products, including Prisma SD-WAN. The total threats widget displays how many threats were blocked, alerted, and the change in threat count over the selected time range. This view provides a generic, aggregated perspective without further classification by source or specific SD-WAN sites.

SD-WAN threat visibility requires active Branch Security or CDSS licenses on your Prisma SD-WAN branches. If Branch Security licenses and security policies are not configured on a site, threat data specific to that site does not populate in this view.

For a detailed breakdown of threats by severity and category, navigate to InsightsActivity InsightsThreats.

Operational Health View

The Operational Health view displays site and user health metrics based on ADEM experience scores. Health is categorized as Good, Fair, or Poor for each monitored site. The bottom of the view shows the Average User Experience score, Average Site Experience score, and Critical Incidents count.

This view requires an active Autonomous DEM (ADEM) license. Without an active ADEM license, the health nodes display in neutral gray (Unmonitored) rather than color-coded status, and experience score data does not populate.

Data Security View

The Data Security view provides a sensitive and high-risk data map across your network and connected SaaS applications. It shows users with sensitive data activity, the sanctioned, unsanctioned, tolerated, or untagged applications where sensitive data activity is detected (such as asset upload, download, or exposed assets), and the number of assets allowed, blocked, quarantined, or with revoked sharing.

This view requires Data Security and AI Access subscriptions. Without these, sensitive data maps and GenAI visibility data do not populate.