> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/data-ingestion/palo-alto-networks-integrations/ingest-alerts-from-prisma-cloud.md).
# Ingest Alerts from Prisma Cloud
{% hint style="info" %}
### Notice
Ingestion of logs and data requires a Cortex XDR Pro per GB license.
{% endhint %}
To receive alerts from Prisma Cloud, first configure the Collection Integrations settings in Cortex XDR. After you set up collection integration, Cortex XDR begins to receive alerts from Prisma Cloud every 30 seconds.
Cortex XDR then groups these alerts into incidents and adds them to the Alerts table. When Cortex XDR begins receiving the alerts, it creates a new Cortex Query Language (XQL) dataset (`prisma_cloud_raw`), which you can use to initiate XQL Search queries and create Correlation Rules. The in-app XQL Library contains sample search queries.
You can also configure Cortex XDR to collect data directly from other cloud providers using an applicable collector. For more information on the cloud collectors, see External Data Ingestion Vendor Support. The Prisma Cloud alerts are stitched to this data.
Complete the following tasks before you begin configuring Cortex XDR to receive alerts from Prisma Cloud.
* Create an **Access Key** and **Secret Key** as explained in the [Create and Manage Access Keys](https://docs.prismacloud.io/en/enterprise-edition/content-collections/administration/create-access-keys) section of the \[Prisma Cloud Administrator’s Guide]. Prisma Cloud System Admin privileges are required for this task.
* Copy or download the **Access Key ID** and **Secret Key** as you will need them when configuring the Prisma Cloud Collector in Cortex XDR.
Configure Cortex XDR to receive alerts from Prisma Cloud.
1. Select **Settings** → **Configurations** → **Data Collection** → **Collection Integrations**.
2. In the **Prisma Cloud Collector** configuration, click **Add Instance**.
3. Set the following parameters.
* Specify a **Name** to identify the connection.
* Specify the **Domain URL** for Prisma Cloud.
* Specify the Prisma Cloud **Access Key Id** that you received when you created an Access Key.
* Specify the Prisma Cloud **Secret Key** that you received when you created an Access Key.
4. To create Cortex XDR alerts from the ingested Prisma Cloud alerts, click **Advanced Settings**, and select the desired options:
* **Incidents**: Create Cortex XDR alerts for runtime alerts detected by Prisma Cloud.
* **Risks**: Create Cortex XDR alerts for Prisma Cloud findings and vulnerabilities that could be exploited by threat actors.
5. Click **Test** to validate the connection, and then click **Enable**.
In Cortex XDR, once alerts start to come in, a green check mark appears underneath the Prisma Cloud Collector configuration with the amount of data received.
6. (Optional) Manage your Prisma Cloud Collector.
After you enable the Prisma Cloud Collector, you can make additional changes, as needed.
To modify a configuration, select any of the following options.
* **Edit** the Prisma Cloud Collector settings.
* **Disable** the Prisma Cloud Collector.
* **Delete** the Prisma Cloud Collector.
7. After Cortex XDR begins receiving data from Prisma Cloud, you can use XQL Search to search for specific data, using the `prisma_cloud_raw` dataset and to view alerts in the Alerts table. In the Cortex XDR Alerts table, the **Prisma Cloud** alerts are listed as **Prisma Cloud** in the **ALERT SOURCE** column.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/data-ingestion/palo-alto-networks-integrations/ingest-alerts-from-prisma-cloud.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.