> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xdr/configure-cortex-xdr/cortex-xdr-data-sources/palo-alto-networks-integrations/strata-cloud-manager.md). # Strata Cloud Manager Use a dedicated Strata Cloud Manager connector to ingest AI Runtime Security API logs for Prisma AIRS and the dns log type for Advanced DNS Security Resolver. {% hint style="info" %} #### Licenses Requires a Data Collection add-on. {% endhint %} Cortex XDR supports the ingestion of AI Runtime Security API logs for Prisma AIRS and the dns log type for Advanced DNS Security Resolver (ADNSR) through a dedicated Strata Cloud Manager (SCM) connector. This integration enables the protection of enterprise AI and the correlation of security threats with other attack vectors by ingesting AIRS and ADNSR data for search, detection, investigation, and response. {% hint style="warning" %} #### Prerequisite To configure the Strata Cloud Manager connector, you must have the following permissions: * **Cortex XDR RBAC permissions**: Requires **View/Edit** permissions for **Data Sources** (under **Configurations** → **Data Collections**) * **Cloud Service Provider (CSP) account permissions**: Configuration of data ingestion from multiple accounts and regions requires Super User permissions on both the Cortex XDR tenant and on the device accounts.\ **Note**: Cross-CSP and cross-region support is limited to the same SFDC hierarchy; it does not extend to MSSP scenarios where the customer and provider own separate ends of the solution. {% endhint %} #### Supported log types The SCM connector utilizes a scalable framework to support a registry of logs. The connector supports: * **Prisma AIRS**: AI Runtime Security API logs. Provides visibility into AI-specific threats, such as prompt injections and sensitive data leakage. * **Advanced DNS Security Resolver (ADNSR)**: Cloud-native logging that captures DNS resolution data to detect network anomalies and potential data exfiltration. #### How to ingest logs via Strata Cloud Manager 1. Select **Settings** → **Data Sources & Integrations**. 2. On the **Data Sources & Integrations** page, click **+ Add New**, search for **Strata Cloud Manager**, then hover over and click **Add**. 3. Configure the connection through the dedicated SCM wizard: 1. On the **Accounts** tab, select the SCM accounts you want to connect. 2. To connect the account associated with your current tenant, switch the toggle to the right for the entry labeled **Current account**. 3. To connect other accounts, switch the toggle for the applicable account entry. For cross-account connections, you must have **Super User** permissions on both the CSP account and the device account.

Note

Cross-account support is limited to the same SFDC hierarchy; it does not extend to MSSP scenarios where the customer and provider own separate ends of the solution.

4. When cross-region is enabled, for each selected account, select the applicable region from the **Region** dropdown menu. 5. Click **Next**. 4. Configure the **Configuration** tab: 1. Click the **Configure (+)** icon for the product you wish to ingest, including **Advanced DNS Security Resolver** or **Prisma AIRS**. 2. For **Advanced DNS Security Resolver**, verify the accounts where it applies and select the **Log types** as **dns** from the dropdown menu. 3. For **Prisma AIRS**, verify the applicable accounts and select the **Log types** as **AI Runtime Security API Logs** from the dropdown menu. 4. Click **Done** for each product configuration. 5. Click **Next**. 5. Review the **Summary** tab: 1. Review the successfully configured instances and any partial configurations that may lack data. 2. Verify the **Account Name**, **Region**, and **Connected products**. 3. Click **Connect**. #### Verification and monitoring Once the connection is established, monitor the ingestion status: * **Data Inventory**: Use Cortex Query Language (XQL) to verify logs are appearing in the raw datasets: * Prisma AIRS: `panw_prisma_airs_raw` * ADNSR: `panw_advanced_dns_security_raw` * **Instance association**: For Prisma AIRS and ADNSR, the Instance ID is provided in the logs to help associate data with the correct instance in the environment. * **Audit logs**: Cortex XDR records an audit trail for SCM connector activities, including adding or removing accounts and changing log filters. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://cortex-docs.paloaltonetworks.com/cortex-xdr/configure-cortex-xdr/cortex-xdr-data-sources/palo-alto-networks-integrations/strata-cloud-manager.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.