Prisma Incidents Connector

Overview

Prisma Cloud is the industry's most comprehensive cloud native security platform (CNSP), with the industry's broadest security and compliance coverage for users, applications, data, and the entire cloud native technology stack throughout the development lifecycle and across hybrid and multi-cloud environments.

The Prisma Incidents Connector fetches the Incidents generated by Prisma Cloud. Prisma Cloud Compute analyzes individual audits and correlates them together to surface unfolding attacks. These chains of related audits are called incidents.

Reference: Prisma Cloud — Get Incident Audit Events

Prerequisites

• Username
• Password
• Prisma URI

ℹ Reference to create credentials: Prisma Cloud — Create Access Keys

Configure the Prisma Incidents Connector in Bloo

All connector configuration is done from the Datasource page in Bloo.

Field Name	Description
Connector Name	Enter a name for the connector.
Prisma URI	Enter address for Prisma Cloud Console.
Prisma Username	Enter Username/access key ID to access the API.
Prisma Password	Enter Password/secret key to access the API.

1. Click Save after entering all the required details.

2. Bloo will validate the configuration automatically.

3. Navigate to Collection Status and confirm the connector is listed with a status of Active. This signifies the connector is configured successfully and data is ready to ingest.

✓ When the connector appears in Collection Status with status Active, it is configured successfully and data is ready to ingest.

Related Links

Bloo — Collection Status | Bloo — Connector Validation | Prisma Cloud — Get Incident Audit Events | Prisma Cloud — Create Access Keys | Bloo — Troubleshooting Connector Validations