# Prisma Access MCP for AI Agents AI Agent Connect

> Prisma Access MCP lets you link your Prisma Access environment to any AI client. It gives your agent the ability to pull threat logs, audit security policies, and monitor network traffic in real-time. You can stop hunting through complex dashboards and start asking your AI to do the heavy lifting for you.

## Overview
- **Category:** other
- **Price:** Free
- **Endpoint:** https://edge.vinkius.com/vk_preview_oXGH8TL9IXDhirIHXNMrl9ouF3bOokKy1yPnq16F/ai-agent-connect

## Description

This Connector connects your AI agent directly to your Prisma Access environment so you can manage your SASE infrastructure through natural conversation. Instead of logging into a separate console to hunt for specific security events or check if a tunnel is down, you just ask your agent to do it for you. It handles the heavy lifting of querying logs and listing active users, giving you a clear picture of your network's health without the tab-switching. You can use it to spot anomalies in traffic patterns or verify that your security policies are actually hitting the right targets. By bringing this data into your existing AI workflow via Vinkius, you turn a manual auditing process into a quick conversation. It's about getting answers faster, whether you're investigating a potential breach or just trying to figure out why a remote user can't reach a specific app.

## Tools

### get_service_endpoints
Use this to list Prisma Access service endpoints (PoPs). It helps you verify regional connectivity or configure DNS routing quickly.

### get_threat_logs
Retrieve recent threat detection logs from Prisma Access. This lets you investigate attacks against remote endpoints with details on severity and actions taken.

### get_traffic_logs
Pull recent network traffic logs from Prisma Access. You can use this to analyze usage patterns or debug specific access issues for your users.

### get_tunnels
List SD-WAN and network tunnels in Prisma Access. This is useful for monitoring connectivity and troubleshooting tunnel drops in real time.

### get_users
List remote users connected to Prisma Access. Use this to audit remote work access or quickly identify inactive accounts.

### get_locations
List mobile user locations and remote networks. This helps you review network topology or troubleshoot routing issues for remote workers.

### get_policies
List security policies enforced in Prisma Access. Use this to audit your SASE policies and ensure your security rules are correct.

## Prompt Examples

**Prompt:** 
```
Show me the threat logs from the last 2 hours.
```

**Response:** 
```
Here are the high-severity threat detections from the last 2 hours:

| Severity | Attack Detail | Action Taken |
| :--- | :--- | :--- |
| **High** | SQL Injection Attempt | Blocked |
| **Medium** | Brute Force Login | Blocked |
| **High** | Malware Callback | Blocked |

All high-severity threats were successfully blocked by the security policy.
```

**Prompt:** 
```
Which users are connected from outside the US right now?
```

**Response:** 
```
I found 3 users currently connected from outside the United States:

*   **j.doe@company.com** - Location: London, UK
*   **a.smith@company.com** - Location: Tokyo, Japan
*   **m.garcia@company.com** - Location: Madrid, Spain
```

**Prompt:** 
```
Are my security policies for the finance app active?
```

**Response:** 
```
Yes, I've verified the security policies for the finance application. Here are the active rules:

*   **Finance_Access_Rule**: Allows traffic from Finance Group to Finance Server.
*   **Finance_MFA_Enforcement**: Requires MFA for all finance app access.
*   **Finance_Geo_Block**: Blocks access from non-approved countries.
```

## Capabilities

### Investigate threat detections
Pull recent threat logs to see severity levels and attack details.

### Audit security policies
List all enforced security rules to verify your SASE configuration.

### Monitor network traffic
Retrieve traffic logs to analyze usage patterns and debug access issues.

### Track remote user connections
See which remote users are currently connected to your network.

### Verify regional connectivity
Check service endpoints to confirm regional availability and DNS routing.

### Monitor SD-WAN tunnels
List active tunnels to troubleshoot drops or monitor network stability.

### Map user locations
View mobile user locations to review network topology and routing.

## Use Cases

### Quick threat investigation
A SOC analyst gets a high-priority alert. They ask their agent to use `get_threat_logs` to pull the last 10 high-severity attacks and summarize the actions taken.

### Troubleshooting VPN lag
A user reports slow speeds. An engineer asks the agent to check the status of SD-WAN tunnels using `get_tunnels` and verify regional PoPs with `get_service_endpoints`.

### Compliance audit preparation
An auditor needs a list of all active security rules. They ask the agent to use `get_policies` to export a list of enforced SASE rules for the finance department.

### Remote worker mapping
An IT manager wants to see where remote staff are connecting from. They ask the agent to use `get_locations` to map current user locations and remote networks.

## Benefits

- Stop manual filtering by using `get_threat_logs` to see high-severity attacks instantly without clicking through nested menus.
- Audit your security posture faster with `get_policies` to see what rules are currently active across your entire environment.
- Identify connectivity issues quickly by checking SD-WAN status with `get_tunnels` during a network outage.
- Track remote work access easily with `get_users` to see who is currently on the network for quick auditing.
- Verify regional availability with `get_service_endpoints` to troubleshoot DNS or routing issues for global offices.
- Analyze usage patterns without manual exports by using `get_traffic_logs` to see real-time flow for your users.

## How It Works

The bottom line is you get a conversational interface for your entire Prisma Access security and network data.

1. Gather your Prisma Access API credentials and required permissions.
2. Connect this Connector to your AI client through the Vinkius platform.
3. Ask your agent to pull logs, list users, or check policy status.

## Frequently Asked Questions

**Can the Prisma Access MCP help me find blocked attacks?**
Yes, it can pull recent threat detection logs directly. You can ask your agent to show you specific attacks, including their severity and what action was taken to stop them.

**How does the Prisma Access MCP show me remote user locations?**
The Connector can list all mobile user locations and remote networks. This allows you to see where your team is connecting from in real time.

**Can I use the Prisma Access MCP to audit my SASE policies?**
Absolutely. You can ask your agent to list all security policies enforced in your environment to ensure everything is configured correctly.

**How does the Prisma Access MCP help with SD-WAN troubleshooting?**
It allows your agent to list SD-WAN and network tunnels. You can quickly check for tunnel drops or connectivity issues without manual navigation.

**Can the Prisma Access MCP list all my active network tunnels?**
Yes, it can retrieve a list of all active SD-WAN and network tunnels. This is great for monitoring your network stability.

**Does the Prisma Access MCP show me regional service endpoints?**
Yes, it can list Prisma Access service endpoints (PoPs). This helps you verify regional connectivity and check your DNS routing.