Cortex XDR & Prisma Browser integration

[D.Bengian]

Hi Team,

We’ve just finished deploying Cortex XDR and Prisma Browser across all endpoints for a customer.

I’ve seen a few blogs mentioning an integration between the two that provides enhanced security event visibility, including browser data.

Has anyone implemented this integration? Is it available, and if so, how can it be set up?

Regards and thanks,

David.

Cortex XDR Prisma Browser 

[susekar]

Hello @D.Bengian ,

Greetings for the day.

The integration between Cortex XDR and Prisma Access Browser (PAB) is supported and enables centralized visibility of browser security events and alerts within Cortex XDR.

Prerequisites:

• A valid Cortex XDR Pro per GB license and the required logging entitlements.
• Cortex XDR and Prisma Access Browser must be associated with the same CSP account, with compatible regional configurations.
• Only one Prisma Access Browser integration instance is supported per Cortex XDR tenant.
  
  

Configuration Steps:

1. Navigate to Settings → Configurations → Data Collection → Collection Integrations in Cortex XDR.
2. Locate Prisma Access Browser and click Add Instance.
3. Select the connection checkbox and click Connect.
4. Verify the connection status after setup.

Validation: Run the following XQL query in Cortex XDR to confirm data ingestion:

dataset = panw_prisma_access_browser_raw
| limit 50

This integration enables security teams to investigate browser events and perform threat hunting using XQL.

If you feel this has answered your query, please let us know by clicking like and on "mark this as a Solution".

Thanks & Regards,
S. Subashkar Sekar