Threat Prevention Inline Cloud Analysis - Allow on Max Latency

[JoeKwok]

With the new feature - Advanced Threat Prevention in PAN-OS 10.2

There are Inline Cloud Analysis in PAN-OS 10.2

I found a new setup - Threat Prevention Inline Cloud Analysis under Device > Setup > Content-ID

I would like to know what is the different with enable or not on "Allow on Max Latency".

Is it means that exceed the Latency of Inline Cloud Analysis, the packet will be bypass or drop?

enable means bypass or drop? Where can I find the document related to this?

I take a look of below link, but no mention on this.

https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-web-interface-help/device/device-setup-content-...

[S.Cantwell]

Palo Alto Networks now operates a series of ML-based detection engines in the Advanced Threat Prevention cloud to analyze traffic for advanced C2 (command-and-control) and spyware threats in real-time to protect users against zero-day threats. By operating cloud-based detection engines, you can access a wide array of detection mechanisms that are updated and deployed automatically without requiring the user to download update packages or operate process intensive, firewall-based analyzers which can sap resources. The cloud-based detection engine logic is continuously monitored and updated using C2 traffic datasets from WildFire, with additional support through manual updates by Palo Alto Networks threat researchers, who provide human intervention for highly accurized detection enhancements. Inline cloud analysis supports five analysis engines for C2-based threats over HTTP, HTTP2, SSL, unknown-UDP, and unknown-TCP. Additional analysis models are delivered through content updates, however, enhancements to existing models are performed as a cloud-side update, requiring no firewall update. Inline cloud analysis is enabled and configured using the anti-spyware profile and requires an active Advanced Threat Prevention license.

[support_jmfo]

Per regulation, we must monitor the outgoing GW traffic. this undocumented feature is not clear for us too.

there are 2 "fail open" settings for URL & TP cloud analysis as mentioned above. when this is actually used? what is the flow of traffic in that case?

each http request (when we use aURLF) is going to palo alto for additional inspection?

[Sujanya]

Is there any license requirement that we should be on version 10.2 for ATP.