> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/palo-alto-networks-integrations/prisma-access/ingest-data-from-prisma-access.md). # Ingest data from Prisma Access {% hint style="info" %} ### Notice Requires the Data Collection add-on. {% endhint %} You can forward data from Prisma Access to Cortex Cloud. When your Cortex Cloud tenant begins receiving detection data, it begins stitching logs with other Palo Alto Networks-generated logs to form stories. Use the XQL Search to query the data. Collection of data from multiple accounts is supported. Super User permissions on both the Cortex Cloud tenant accounts and the Prisma Access accounts are required for this use case. New tenants (and tenants upgraded from XDR to XSIAM) will work with the new direct integration of Next-Generation Firewall and Panorama into Cortex. For such tenants, there’s no option to use the Strata Logging Service integration. For tenants where customers have integrated directly with Strata Logging Service, the configured integrations, such as Next-Generation Firewall and Prisma Access, can be migrated to Cortex Cloud in either of the following ways before the license expires: * More than two weeks before the license for existing integrations with Strata Logging Service expires, manually migrate the integrations, using the corresponding **Migrate Devices** buttons on the **Data Sources & Integrations** page. Make sure you select all your devices to connect directly to Cortex Cloud. * Two weeks prior to the end of your Strata Logging Service license, Cortex Cloud will automatically migrate your integrations to your Strata Logging Service.

Note

Roll-back of Strata Logging Service integration migration is not supported.

{% hint style="warning" %} ### Prerequisite Configuration of data ingestion from multiple accounts requires Super User permissions in both Cortex Cloud tenant and Prisma Access accounts. {% endhint %} {% hint style="info" %} ### Note If you change a device region, you must first disconnect the device from Cortex Cloud and then reconnect it after the region change is complete. {% endhint %} The logs ingested by Prisma Access are the same as the logs ingested by Next-Generation Firewall. For more information, refer to [Ingest data from Next-Generation Firewall](/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/palo-alto-networks-integrations/next-generation-firewall/ingest-data-from-next-generation-firewall.md). To ingest detection data from Prisma Access: 1. Navigate to **Settings** → **Data Sources & Integrations**. 2. On the **Data Sources & Integrations** page, click **+ Add New**, search for **Prisma Access**, then hover over it and click **Add** or **Add Instance**.

Note

Cortex Cloud does not validate your Prisma Access account credentials. You must ensure the account has been deployed in order for data to stream.

3. In the **Connect Prisma Access** dialog box, you can choose to connect Prisma Access to this account or other accounts. * To connect Prisma Access to this account, click **Connect**. * To connect Prisma Access to other accounts, click **Connect Prisma Access from other accounts** and select the account from the accounts listed. Click **Connect**. Connection can take up to several minutes. On the **Data Sources & Integrations** page, expand Prisma Access to track the status of your instance. 4. Validate that your data is streaming. To ensure the data is streaming into your tenant, using XQL, query Next-Generation Firewall raw datasets `panw_ngfw_<*>_raw` using the field: `is_prisma_mobile`. 5. (Optional) Manage your Instance. After you create the Prisma Access instance, on the **Data Sources & Integrations** page, expand the Prisma Access integration to track the connection, or, if you want, to **Delete** the instance. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/palo-alto-networks-integrations/prisma-access/ingest-data-from-prisma-access.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.