Prisma Browser Integration

Configure Palo Alto Networks data integration for Cortex XDR.

When Prisma Browser (PB) is installed on an endpoint, Cortex XDR correlates browser-layer telemetry from PB with OS-layer process events on managed endpoints. This integration provides unified visibility and forensic analysis across both web and system activity within the Cortex XDR console, and is displayed in the Issues card.

Data Flow

• Telemetry Ingestion: Prisma Browser streams endpoint browser telemetry directly into Cortex Data Lake (CDL).
• Causality Stitching: Cortex XDR correlates browser events with the Cortex XDR agent’s OS-level process causality chains, mapping user browser interactions directly to underlying system process executions.
• Incident Generation: Security-critical browser events—such as browser tampering, unauthorized modifications, or web-delivered malware—automatically trigger Cortex XDR alerts and incidents.
• Unified Forensics: Analysts can investigate the complete execution chain from initial browser interactions down to kernel-level process activities in a single timeline.