Threat Prevention Inline Cloud Analysis - Allow on Max Latency

Showing results for 
Show  only  | Search instead for 
Did you mean: 

Threat Prevention Inline Cloud Analysis - Allow on Max Latency

L2 Linker

With the new feature - Advanced Threat Prevention in PAN-OS 10.2


There are Inline Cloud Analysis in PAN-OS 10.2

I found a new setup - Threat Prevention Inline Cloud Analysis under Device > Setup > Content-ID



I would like to know what is the different with enable or not on "Allow on Max Latency".

Is it means that exceed the Latency of Inline Cloud Analysis, the packet will be bypass or drop?

enable means bypass or drop? Where can I find the document related to this?


I take a look of below link, but no mention on this.



Cyber Elite
Cyber Elite

Palo Alto Networks now operates a series of ML-based detection engines in the Advanced Threat Prevention cloud to analyze traffic for advanced C2 (command-and-control) and spyware threats in real-time to protect users against zero-day threats. By operating cloud-based detection engines, you can access a wide array of detection mechanisms that are updated and deployed automatically without requiring the user to download update packages or operate process intensive, firewall-based analyzers which can sap resources. The cloud-based detection engine logic is continuously monitored and updated using C2 traffic datasets from WildFire, with additional support through manual updates by Palo Alto Networks threat researchers, who provide human intervention for highly accurized detection enhancements. Inline cloud analysis supports five analysis engines for C2-based threats over HTTP, HTTP2, SSL, unknown-UDP, and unknown-TCP. Additional analysis models are delivered through content updates, however, enhancements to existing models are performed as a cloud-side update, requiring no firewall update. Inline cloud analysis is enabled and configured using the anti-spyware profile and requires an active Advanced Threat Prevention license.

Help the community: Like helpful comments and mark solutions

L0 Member


Per regulation, we must monitor the outgoing GW traffic. this undocumented feature is not clear for us too.

there are 2 "fail open" settings for URL & TP cloud analysis as mentioned above. when this is actually used? what is the flow of traffic in that case?

each http request (when we use aURLF) is going to palo alto for additional inspection?


Is there any license requirement that we should be on version 10.2 for ATP. 

  • 3 replies
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!