• SEVERITY
  • RESPONSE
  • PATTERNS
  • HUMAN

How to investigate security threats with your AI

Connect Prisma Access to your AI client to pull live data. Once connected, your agent handles the log retrieval and analysis for you.

Ask AI about this page

Short answer

How can I use AI to investigate Prisma Access threats?

Your agent uses the get_threat_logs tool to pull real-time data from Prisma Access. It then analyzes the logs to determine attack severity and identifies the specific actions taken to mitigate the threat. You get a clear picture of your security posture immediately.

Threat analysis outcomes

What you'll discover

The AI turns raw log data into these specific insights.

SEVERITY

Attack impact levels

The AI categorizes threats by their danger level. You'll know which incidents need your immediate attention.

RESPONSE

Mitigation history

The agent identifies what Prisma Access did to stop the threat. This shows you which automated blocks actually worked.

PATTERNS

Recurring attack vectors

By scanning multiple logs, your agent spots repeated patterns. This helps you find specific weaknesses in your perimeter.

HUMAN

Manual triage needed

The AI flags high-risk anomalies that it cannot resolve. You decide if you need to manually update a policy or block an IP.

The workflow

What your AI does when a threat arrives.

The AI handles the data gathering so you can focus on the decision making.

  1. Fetch logs

    Your agent pulls the most recent security events from your Prisma Access environment.

    get_threat_logs

  2. Assess risk

    The AI examines the threat type and target to assign a severity score.

    get_threat_logs

  3. Audit actions

    The agent checks the logs to see if the threat was successfully mitigated by existing policies.

    get_threat_logs

  4. Summarize findings

    The AI condenses the log data into a clear summary of what happened.

    get_threat_logs

Try it

Copy these to start.

Paste these into your chat to begin.

Starting points

These are opening lines. Swap out the specific timeframes or threat types to match your current investigation.

Prisma Access Connector

You're all set. Choose your MCP client and follow the setup instructions.

Connector linkhttps://edge.vinkius.com/vk_preview_oXGH8TL9IXDhirIHXNMrl9ouF3bOokKy1yPnq16F/mcp

Claude Desktop

Follow the steps below to connect in seconds.

  1. 1In Claude Desktop, open Settings → Connectors.
  2. 2Click “Add custom connector” and paste the connector link above as the remote MCP server URL.
  3. 3Click Add and start a new chat — Prisma Access capabilities are ready to use.
Configuration · claude_desktop_config.jsonCopy
{
  "mcpServers": {
    "prisma-access-mcp": {
      "url": "https://edge.vinkius.com/vk_preview_oXGH8TL9IXDhirIHXNMrl9ouF3bOokKy1yPnq16F/mcp"
    }
  }
}
Copy into chat04

  • Get the latest threat logs from Prisma Access and tell me if there are any critical severity issues.

  • Show me the last 10 threat logs and explain what actions were taken for each.

  • Analyze the recent threat logs to find any patterns involving suspicious IP addresses.

  • Summarize the most recent security threats that were not automatically blocked.

  • Claude
  • ChatGPT
  • Cursor
  • VS Code
  • Windsurf
  • Claude Code
  • JetBrains
  • Cline

Start here

Connect Prisma Access once, then ask.

Connect your account once. Your credentials stay encrypted, and you can immediately start asking your AI about your security logs.

Connect Prisma Access to your AI

FAQ

How this task behaves

  • 01

    Can the AI block an IP address for me?

    No. The AI only reads and analyzes logs. You must use your security console to change policies or block IPs.

  • 02

    Does the AI delete any logs from Prisma Access?

    No. The AI only has read access through the get_threat_logs tool. It cannot modify or delete your data.

  • 03

    Can I ask about threats from last week?

    Yes, as long as those logs are available within the Prisma Access environment for the tool to pull.

  • 04

    Will the AI notify my team automatically?

    No. The AI provides the analysis to you in your chat interface. You decide if you need to alert anyone.

  • 05

    Can the AI create new security policies?

    No. The AI is limited to reading threat logs. All policy changes must be done by you in Prisma Access.

  • More questions about Prisma Access? The Connector page answers them. See everything the Prisma Access Connector can do

Connect Prisma Access to Claude, Cursor, ChatGPT & more