Prisma Access

What is Prisma Access?

Palo Alto Networks Prisma Access is a cloud-delivered SASE platform that provides secure network access for all users, whether in the office, working remotely, or located in branch offices, without requiring traffic to be backhauled through a corporate data center. It combines Zero Trust Network Access for private application connectivity, a Secure Web Gateway for internet access inspection, a Cloud Access Security Broker for cloud application governance, and next-generation firewall capabilities, all delivered from Palo Alto's globally distributed cloud infrastructure. Prisma Access applies consistent security policies based on identity and device posture rather than network location, and generates detailed traffic logs that capture every connection made through the platform. These logs are a valuable source for detecting command-and-control communications, data exfiltration attempts, and policy violations across a distributed workforce.

How does Prisma Access work with Qevlar?

Qevlar integrates with Prisma Access to retrieve network traffic logs and security events during investigations. When an alert involves suspicious outbound connections or policy violations by a remote user, Qevlar can query Prisma Access logs to reconstruct the network activity and determine whether it is consistent with known threat actor infrastructure or data exfiltration behavior.