# Source configuration for Palo Alto Prisma Cloud
<a name="paloalto-prismacloud-source-setup"></a>

## Integrating with Palo Alto Prisma Cloud
<a name="paloalto-prismacloud-integration"></a>

CloudWatch pipelines use the Prisma Cloud CSPM and Compute (CWPP) APIs to retrieve security alerts, vulnerability findings, asset inventories, compliance posture, audit logs, and workload data from your Prisma Cloud tenant. The APIs expose REST endpoints that allow fetching security data for monitoring and analysis.

To integrate CloudWatch Pipelines with Palo Alto Prisma Cloud, complete the following high-level steps:
+ Generate an Access Key and Secret Key in the Prisma Cloud Console.
+ Identify the CSPM API URL, Compute Console URL, and Compute API version.
+ Store the credentials in Amazon Secrets Manager.
+ Create a CloudWatch pipeline with Palo Alto Prisma Cloud as the data source.
+ Verify that data is flowing into the pipeline.

## Prerequisites
<a name="paloalto-prismacloud-prerequisites"></a>

Before you begin, make sure you have the following:
+ An active Palo Alto Prisma Cloud Enterprise tenant with API access
+ A Prisma Cloud user with System Admin or Account Group Read Only role
+ An Amazon account with permissions to create and manage CloudWatch Pipelines
+ An Amazon account with permissions to create, retrieve, and update secrets in Amazon Secrets Manager
+ An Amazon account with permissions to create and manage CloudWatch Logs log groups

## Authenticating with Palo Alto Prisma Cloud
<a name="paloalto-prismacloud-authentication"></a>

Palo Alto Prisma Cloud uses an Access Key and Secret Key for authentication. The pipeline sends these credentials to the CSPM login endpoint, which returns a JWT token for subsequent API access.

## Configure Authentication for Palo Alto Prisma Cloud
<a name="paloalto-prismacloud-configure-auth"></a>

To configure authentication credentials for the pipeline:

1. Log in to the Prisma Cloud Console and navigate to Settings > Access Control > Access Keys.

1. Choose **Add** > **Access Key**.

1. Note the Access Key ID and Secret Key.

1. Identify the CSPM API URL based on your tenant region (for example, `https://api.prismacloud.io`).

1. Identify the Compute Console URL by navigating to Compute > Manage > System > Utilities > Path to Console.

1. Identify the Compute API version (available from the bell icon in the Console).

1. Store the Access Key ID as `username` and Secret Key as `password` in Amazon Secrets Manager.

## Configuring the CloudWatch Pipeline
<a name="paloalto-prismacloud-pipeline-config"></a>

To configure the pipeline, choose Palo Alto Prisma Cloud as the data source. Provide the `cspm_base_url`, `compute_console_url`, `compute_api_version`, `access_key`, and `secret_key`. After you create and activate the pipeline, security data from Prisma Cloud will begin flowing into the selected CloudWatch Logs log group.

The following optional parameters are available:
+ **Page sizes** – Configure the number of records retrieved per API request page.
+ **Polling intervals** – Valid range is 10 minutes to 7 days. Uses ISO 8601 duration format.
+ **Backfill durations** – Valid range is 1 hour to 90 days. Uses ISO 8601 duration format.

## Supported Open Cybersecurity Schema Framework Event Classes
<a name="paloalto-prismacloud-ocsf-events"></a>

This integration supports the following OCSF event classes:
+ **Base Event [0]** – Applications
+ **Detection Finding [2004]** – Alerts
+ **Vulnerability Finding [2002]** – Vulnerabilities
+ **Cloud Resources Inventory Info [5023]** – Assets
+ **Entity Management [3004]** – Audit Logs
+ **Compliance Finding [2003]** – Compliances, Alerts
+ **Device Inventory Info [5001]** – Hosts
+ **Scan Activity [6007]** – Images, Containers