SaaS Security
SaaS Visibility and Controls
Table of Contents
Expand All
|
Collapse All
SaaS Security Docs
-
-
- Begin Scanning an Amazon S3 App
- Begin Scanning a Bitbucket App
- Begin Scanning a Box App
- Begin Scanning ChatGPT Enterprise App
- Begin Scanning a Cisco Webex Teams App
- Begin Scanning a Confluence App
- Begin Scanning a Confluence Data Center App
- Begin Scanning a Dropbox App
- Begin Scanning a GitHub App
- Begin Scanning a Gmail App
- Begin Scanning a Google Cloud Storage App
- Begin Scanning a Google Drive App
- Begin Scanning a Jira App
- Begin Scanning a Jira Data Center App
- Begin Scanning a Microsoft Azure Storage App
- Begin Scanning a Microsoft Exchange App
- Begin Scanning a Microsoft Teams App
- Begin Scanning Office 365 Apps
- Begin Scanning a Salesforce App
- Begin Scanning a ServiceNow App
- Begin Scanning a ShareFile App
- Begin Scanning a Slack Enterprise App
- Begin Scanning a Slack for Pro and Business App
- Begin Scanning a Workday App
- Begin Scanning a Zendesk App
- Begin Scanning a Zoom App
- Perform Actions on Sanctioned Apps
- API Throttling
- Configure Classification Labels
- Microsoft Labeling for Office 365
- Google Drive Labeling
- Configure Phishing Analysis
- Configure WildFire Analysis
- Fine-Tune Policy
-
- What is an Incident?
- Filter Incidents
- Configure Slack Notification Alerts on Data Security
- Security Controls Incident Details
- Track Down Threats with WildFire Report
- Customize the Incident Categories
- Close Incidents
- Download Assets for Incidents
- View Asset Snippets for Incidents
- Modify Incident Status
- Email Asset Owners
- Generate Reports on Data Security
- Integrate CIE with Data Security
- Search in Data Security
-
-
- View Usage Data for Unsanctioned SaaS Apps
- SaaS Visibility Application Attributes
- How SaaS Security Inline Determines an App's Risk Score
- Identify Risky Unsanctioned SaaS Apps and Users
- Generate the SaaS Security Report
- Filter Unsanctioned SaaS Apps
-
- SaaS Policy Rule Recommendations
- App-ID Cloud Engine
- Guidelines for SaaS Policy Rule Recommendations
- Apply Predefined SaaS Policy Rule Recommendations
- Create SaaS Policy Rule Recommendations
- Enable SaaS Policy Rule Recommendations
- Monitor SaaS Policy Rule Recommendations
- Delete SaaS Policy Rule Recommendations
- Modify Active SaaS Policy Rule Recommendations
- Manage Enforcement of Rule Recommendations on Strata Cloud Manager
- Manage Enforcement of Rule Recommendations on Panorama
- Tag Discovered SaaS Apps
- Apply Tag Recommendations to Sanctioned Apps
- Change Risk Score for Discovered SaaS Apps
- Troubleshoot Issues on SaaS Security Inline
-
-
- Onboarding Overview for Supported SaaS Apps
- Onboard an Aha.io App to SSPM
- Onboard an Alteryx Designer Cloud App to SSPM
- Onboard an Aptible App to SSPM
- Onboard an ArcGIS App to SSPM
- Onboard an Articulate Global App to SSPM
- Onboard an Atlassian App to SSPM
- Onboard a BambooHR App to SSPM
- Onboard a Basecamp App to SSPM
- Onboard a Bitbucket App to SSPM
- Onboard a Bito AI App to SSPM
- Onboard a BlueJeans App to SSPM
- Onboard a Box App to SSPM
- Onboard a Bright Security App to SSPM
- Onboard a Celonis App to SSPM
- Onboard a Cisco Meraki App to SSPM
- Onboard a Claude App to SSPM
- Onboard a ClickUp App to SSPM
- Onboard a Codeium App to SSPM
- Onboard a Cody App to SSPM
- Onboard a Confluence App to SSPM
- Onboard a Contentful App to SSPM
- Onboard a Convo App to SSPM
- Onboard a Couchbase App to SSPM
- Onboard a Coveo App to SSPM
- Onboard a Crowdin Enterprise App to SSPM
- Onboard a Customer.io App to SSPM
- Onboard a Databricks App to SSPM
- Onboard a Datadog App to SSPM
- Onboard a DocHub App to SSPM
- Onboard a DocuSign App to SSPM
- Onboard a Dropbox Business App to SSPM
- Onboard an Envoy App to SSPM
- Onboard an Expiration Reminder App to SSPM
- Onboard a Gainsight PX App to SSPM
- Onboard a GitHub Enterprise App to SSPM
- Onboard a GitLab App to SSPM
- Onboard a Google Analytics App to SSPM
- Onboard a Google Workspace App to SSPM
- Onboard a GoTo Meeting App to SSPM
- Onboard a Grammarly App to SSPM
- Onboard a Harness App to SSPM
- Onboard a Hellonext App to SSPM
- Onboard a Hugging Face App to SSPM
- Onboard an IDrive App to SSPM
- Onboard an Intercom App to SSPM
- Onboard a Jira App to SSPM
- Onboard a Kanbanize App to SSPM
- Onboard a Kanban Tool App to SSPM
- Onboard a Krisp App to SSPM
- Onboard a Kustomer App to SSPM
- Onboard a Lokalise App to SSPM
- Onboard a Microsoft 365 Copilot App to SSPM
- Onboard a Microsoft Azure AD App to SSPM
- Onboard a Microsoft Exchange App to SSPM
- Onboard a Microsoft OneDrive App to SSPM
- Onboard a Microsoft Outlook App to SSPM
- Onboard a Microsoft Power BI App to SSPM
- Onboard a Microsoft SharePoint App to SSPM
- Onboard a Microsoft Teams App to SSPM
- Onboard a Miro App to SSPM
- Onboard a monday.com App to SSPM
- Onboard a MongoDB Atlas App to SSPM
- Onboard a MuleSoft App to SSPM
- Onboard a Mural App to SSPM
- Onboard a Notta App to SSPM
- Onboard an Office 365 App to SSPM
- Onboard Office 365 Productivity Apps to SSPM
- Onboard an Okta App to SSPM
- Onboard an OpenAI App to SSPM
- Onboard a PagerDuty App to SSPM
- Onboard a Perplexity App to SSPM
- Onboard a Qodo App to SSPM
- Onboard a RingCentral App to SSPM
- Onboard a Salesforce App to SSPM
- Onboard an SAP Ariba App to SSPM
- Onboard a ServiceNow App to SSPM
- Onboard a Slack Enterprise App to SSPM
- Onboard a Snowflake App to SSPM
- Onboard a SparkPost App to SSPM
- Onboard a Tableau Cloud App to SSPM
- Onboard a Tabnine App to SSPM
- Onboard a Webex App to SSPM
- Onboard a Weights & Biases App to SSPM
- Onboard a Workday App to SSPM
- Onboard a Wrike App to SSPM
- Onboard a YouTrack App to SSPM
- Onboard a Zendesk App to SSPM
- Onboard a Zoom App to SSPM
- Onboarding an App Using Azure AD Credentials
- Onboarding an App Using Okta Credentials
- Register an Azure AD Client Application
- View the Health Status of Application Scans
- Delete SaaS Apps Managed by SSPM
-
-
-
- New Features Introduced in December 2024
- New Features Introduced in November 2024
- New Features Introduced in October 2024
- New Features Introduced in August 2024
- New Features Introduced in July 2024
- New Features Introduced in June 2024
- New Features Introduced in May 2024
- New Features Introduced in April 2024
- New Features Introduced in March 2024
- New Features Introduced in January 2024
-
- New Features Introduced in November 2023
- New Features Introduced in October 2023
- New Features Introduced in September 2023
- New Features Introduced in August 2023
- New Features Introduced in July 2023
- New Features Introduced in June 2023
- New Features Introduced in May 2023
- New Features Introduced in April 2023
- New Features Introduced in March 2023
- New Features Introduced in January 2023
-
- New Features Introduced in December 2021
- New Features Introduced in October 2021
- New Features Introduced in September 2021
- New Features Introduced in August 2021
- New Features Introduced in July 2021
- New Features Introduced in June 2021
- New Features Introduced in May 2021
- New Features Introduced in March 2021
- New Features Introduced in January 2021
SaaS Visibility and Controls
Use this workflow to onboard SaaS Security Inline.
Where Can I Use This? | What Do I Need? |
---|---|
Data Security, SaaS Security Posture Management, and Behavior
Threats:
SaaS Security Inline:
|
One of the following SaaS Security licenses:
Or any of the following licenses that include one of the SaaS Security licenses:
|
SaaS Security Inline provides SaaS visibility so that you can identify
cloud‑based threats and risky user activity on sanctioned and unsanctioned SaaS
apps.
Getting started is quite simple. If your Strata Logging Service is configured
to receive logs from your Palo Alto Networks firewalls, after activation, SaaS Security Inline automatically discovers all SaaS apps and users and
analyzes users’ SaaS activity and usage data and presents risk analytics. After you
evaluate the data in the Dashboard, you’re ready to tag SaaS apps, configure risk
scores, and generate reports to better understand and respond to SaaS app usage of
sanctioned and unsanctioned SaaS apps.
Use the following workflow if you want to use SaaS visibility only. If you want to
use all the features of SaaS Security Inline, including SaaS visibility, ACE,
and policy rule recommendations to protect against cloud‑based threats, use the SaaS
Visibility and Controls for NGFWworkflow instead.
- Request that your firewall administrator forward logs to Strata Logging Service so that SaaS Security Inline discovers all SaaS apps and users, if you haven’t already.
- Add administrators to analyze SaaS visibility data.
SaaS Security Inline on
Prisma Access—Managed by Panorama or Strata Cloud Manager, SaaS Security Inline provides SaaS visibility so that you can identify
cloud‑based threats and risky user activity on sanctioned and unsanctioned SaaS
apps.
Getting started is quite simple. After activation, SaaS Security Inline
automatically discovers all SaaS apps and users and analyzes users’ SaaS activity
and usage data and presents risk analytics. After you evaluate the data in the
Dashboard, you’re ready to tag SaaS apps, configure risk scores, and generate usage,
risk, and compliance reports to audit, understand, and respond to SaaS app usage of
sanctioned and unsanctioned SaaS apps.
Use the following workflow if you want to use SaaS visibility only. If you want to
use all the features of SaaS Security Inline, including SaaS visibility, ACE,
and SaaS policy rule recommendations to protect against cloud‑based threats, use the
SaaS Visibility and Controls
workflow instead.
- Add administrators to analyze SaaS visibility data.
- NGFW (Managed by Panorama or Strata Cloud Manager)
- Prisma Access (Managed by Panorama)
- Prisma Access (Managed by Strata Cloud Manager)
SaaS Visibility and Controls for NGFW
Use this workflow to onboard both SaaS visibility and policy enforcement on SaaS Security Inline on NGFW.
With PAN-OS 10.1 or later, SaaS Security Inline protects
against cloud‑based threats by blocking traffic for unsanctioned SaaS apps and risky
user activity using Security policy. Use the following workflow if you want to use
all the features of SaaS Security Inline, including App-ID Cloud Engine (ACE), SaaS policy
rule recommendations, and SaaS visibility.
Step
1: Activation
Because SaaS Security Inline is tightly integrated with your NGFW, you
and your NGFW administrator will perform a few handoffs throughout
the activation process.
- Start the ACE deployment on your unmanaged NGFW or use a Panorama™ management server to deploy ACE on NGFW (Managed by Panorama). (NGFW administrator)
- Activate SaaS Security Inline to push the SaaS Security Inline license to your NGFW. (SaaS administrator)
Step 2: System Configuration
- Integrate with Azure Active Directory so that SaaS Security Inline can identify your AD groups. (SaaS administrator)
- Add administrators to manage Security policy. (SaaS administrator)
Step 3: Security Policy Configuration
- Review the guidelines for effective collaboration and rulebase management. (SaaS administrator and NGFW administrator)
- Verify log forwarding on all firewalls. (NGFW administrator)As part of your ACE deployment, you enabled log forwarding. SaaS Security Inline cannot display SaaS app visibility data and might not be able to enforce policy rule recommendations without logs for all NGFW.
- Author and submit SaaS policy rule recommendations to your NGFW administrator, after adhering to prerequisites. (SaaS administrator)
- Import new SaaS policy rule recommendations. (NGFW administrator)
Step 4: Security Policy Maintenance
- Continuously monitor the SaaS policy rule recommendations to ensure they’re in sync. (SaaS administrator)
- Continuously monitor the SaaS policy rule recommendations for changes. (NGFW administrator)
SaaS Visibility and Controls for Prisma Access (Managed by Panorama)
Use this workflow to onboard both SaaS visibility and policy enforcement on SaaS Security Inline on Prisma Access (Managed by Panorama).
SaaS Security Inline protects against cloud‑based threats by blocking traffic for
unsanctioned SaaS apps and risky user activity using Security policy. Use the
following workflow if you want to use all the features of SaaS Security Inline, including App-ID Cloud Engine (ACE), SaaS policy
rule recommendations, and SaaS visibility.
Step
1: Activation
- ACE is enabled by default on Prisma Access (Managed by Panorama).
- Perform the prerequisites outlined in Prisma Access Administrator’s Guide, including log forwarding. Without data logs, SaaS Security Inline cannot display SaaS app visibility data and might not be able to enforce policy rule recommendations.
- Activate the SaaS Security Inline license. (SaaS administrator)
Step 2: System Configuration
- Integrate with Azure Active Directory so that SaaS Security Inline can identify your AD groups. (SaaS administrator)
- Add administrators to manage SaaS Security. (SaaS administrator)
Step 3: Security Policy Configuration
- Review the guidelines for effective collaboration and rulebase management. (SaaS administrator and Prisma Access administrator)
- Author and submit SaaS policy rule recommendations to your Prisma Access administrator. (SaaS administrator)
- Import new SaaS policy rule recommendations. (Prisma Access administrator)
Step 4: Security Policy Maintenance
- Continuously monitor the SaaS policy rule recommendations to ensure they’re in sync. (SaaS administrator)
- Continuously monitor the SaaS policy rule recommendations for changes. (Prisma Access administrator)
SaaS Visibility and Controls for Prisma Access (Managed by Strata Cloud Manager)
Use this workflow to onboard both SaaS visibility and policy enforcement on SaaS Security Inline on Prisma Access (Managed by Strata Cloud Manager).
SaaS Security Inline protects against cloud‑based threats by blocking traffic for
unsanctioned SaaS apps and risky user activity using Security policy. Use the
following workflow if you want to use all the features of SaaS Security Inline, including App-ID Cloud Engine (ACE), SaaS policy
rule recommendations, and SaaS visibility.
Step
1: Activation
- Learn about SaaS Security Inline. (All administrators)
- Learn about the Hub roles that enable administrators to collaborate on SaaS Security. (All administrators)
- Learn about ACE. (Web Security administrator)With a SaaS Security Inline license, ACE is enabled by default on Prisma Access (Managed by Strata Cloud Manager).
- Activate SaaS Security Inline on the Hub. (SaaS administrator)
Step 2: SaaS Security Configuration
- Enable Web Security. (Web Security administrator)
- Integrate with Azure Active Directory so that SaaS Security Inline can identify your AD groups. (SaaS administrator)
- Add administrators to manage SaaS Security. (Security administrator)
Step 3: Policy Rule Recommendation Enforcement
- Review the guidelines for effective collaboration and rulebase management. (All administrators)
- Author and submit SaaS policy rule recommendations to your Prisma Access administrator, after adhering to prerequisites. (SaaS administrator and Data Security administrator)
- Import and push new SaaS rule recommendations. (Web Security administrator)
- Push new SaaS rule recommendations. (Security administrator)
Step 4: Policy Rule Recommendation Management
- Continuously monitor the SaaS policy rule recommendations to ensure they’re in sync. (All administrators)
- Enable automatic updates and monitor the SaaS policy rule recommendations for changes. (Web Security administrator)
- Use Policy Optimizer on Prisma Access (Managed by Strata Cloud Manager) or Policy Optimizeron NGFW or Prisma Access (Managed by Strata Cloud Manager) to determine when and how many times traffic matches the Security policy rule to determine its effectiveness. (Security administrator)