Palo Alto Traps Integration

Version: Palo Alto Traps

Palo Alto Traps advanced endpoint protection stops threats on the endpoint and coordinates enforcement with cloud and network security to prevent successful cyberattacks. Traps stands apart in its ability to protect endpoints. It blocks security breaches and successful ransomware attacks that leverage malware and exploits, known or unknown, before they can compromise endpoints.

Netsurion is an enterprise-class platform that seamlessly combines SIEM, Log Management, Threat detection and so forth.

Netsurion Data Source Integration for Palo Alto Traps allows you to monitor the following components: -

• Security – Threat detection.
• Operation- Agent activity, system activity and
• Compliance- User logons, policy changes and ESM configuration changes.

Once Palo Alto Traps is configured to deliver events to Netsurion Manager; alerts, dashboards and reports can be configured into Netsurion.

Some of the Data Source Integrations available in Netsurion are listed below.

Alerts

Type	Name	Description
Security	Palo Alto Traps - Threats detected	This alert is generated when any threat is detected.
Operations	Palo Alto Traps - Critical agent activity	This alert is generated when any critical agent activity is done.
Operations	Palo Alto Traps - Critical license usage	This alert is generated when any critical license is used.
Compliance	Palo Alto Traps - User logins	This alert is generated when any user logon is done.
Compliance	Palo Alto Traps - Policy changed	This alert is generated when any policy is changed.

Reports

Type	Name	Description
Security	Palo Alto Traps - Threats detected	This report gives information about all the threats that are detected by Palo Alto Traps.
Operations	Palo Alto Traps - Agent status	This report gives information about all the agent status such as client license invalid, client license request, enabled protection and so on.
Operations	Palo Alto Traps - Agent activities	This report gives information about all the agent activities such as agent content update, agent policy change and so on.
Operations	Palo Alto Traps - ESM system activities	This report gives information about all the system activities such as archived preventions, archived preventions failure, file upload failure and so on.
Compliance	Palo Alto Traps - ESM user logon activities	This report gives information about all the user logon activities.
Compliance	Palo Alto Traps - ESM configuration changes	This report gives the information about all the ESM configuration changes that are done.
Compliance	Palo Alto Traps - ESM policy changes	This report gives information about all the ESM policy changes that are done.

Documentation

The configurations detailed in this guide are consistent with Netsurion Enterprise version 8.x and later, and Palo Alto Traps.

Download Integration Guide for more information.