• CRITICAL
  • INVESTIGATE
  • ROUTINE
  • HUMAN

How to triage security alerts with your AI

Connect Prisma Cloud to your AI client to turn raw security data into actionable intelligence. Once connected, your agent handles the heavy lifting of scanning for threats.

Ask AI about this page

Short answer

How can I use AI to triage security alerts?

Your AI pulls live alerts and network anomaly data to find compromised workloads. You get a clear picture of which assets are under attack without manual searching. This breakdown shows how the agent identifies and categorizes these threats.

Where findings land.

The triage outcomes.

The AI organizes its findings into these specific categories.

CRITICAL

Confirmed compromises

The AI identifies workloads where network anomalies match active security alerts. You get a direct list of assets that need immediate isolation.

INVESTIGATE

Suspicious activity

The agent flags anomalies that don't have an active alert yet. This gives you a head start on potential zero-day threats.

ROUTINE

Low priority noise

The AI filters out alerts that don't show suspicious network behavior. This keeps your focus on real issues.

HUMAN

Manual review needed

When the AI finds conflicting data between alerts and network traffic, it flags the case for your direct inspection.

The workflow

What your AI does when the alerts arrive.

The AI acts as a first responder, scanning your environment to separate noise from real danger.

  1. Gathering alerts

    The agent pulls the current list of security issues from your Prisma Cloud environment.

    get_alerts

  2. Scanning traffic

    The AI checks for unusual patterns in your network to see if any workloads are behaving strangely.

    get_network_anomalies

  3. Correlating data

    The agent compares the active alerts against the detected anomalies to find matches.

    get_alertsget_network_anomalies

  4. Reporting findings

    The AI summarizes which specific workloads are likely compromised based on the combined data.

    get_alerts

Try it

Copy these to start.

Use these prompts to kick off your triage process.

Starting points

These are opening lines. Swap out the specific workload names or alert IDs to match your environment.

Prisma Cloud Connector

You're all set. Choose your MCP client and follow the setup instructions.

Connector linkhttps://edge.vinkius.com/vk_preview_x23kcdok2YsS8RTh2QLG6EDhErebwtERCnmJpprJ/mcp

Claude Desktop

Follow the steps below to connect in seconds.

  1. 1In Claude Desktop, open Settings → Connectors.
  2. 2Click “Add custom connector” and paste the connector link above as the remote MCP server URL.
  3. 3Click Add and start a new chat — Prisma Cloud capabilities are ready to use.
Configuration · claude_desktop_config.jsonCopy
{
  "mcpServers": {
    "prisma-cloud-mcp": {
      "url": "https://edge.vinkius.com/vk_preview_x23kcdok2YsS8RTh2QLG6EDhErebwtERCnmJpprJ/mcp"
    }
  }
}
Copy into chat04

  • Pull all active alerts from Prisma Cloud and tell me which ones look most urgent.

  • Check for network anomalies in the production cluster and compare them to recent alerts.

  • Are there any workloads showing both an active alert and suspicious network behavior?

  • List all network anomalies detected in the last hour and summarize the impact.

  • Claude
  • ChatGPT
  • Cursor
  • VS Code
  • Windsurf
  • Claude Code
  • JetBrains
  • Cline

Start here

Connect Prisma Cloud once, then ask.

Just provide your credentials through the secure connection link. Once it's live, your AI can immediately start pulling data.

Connect Prisma Cloud to your AI

FAQ

How this task behaves.

  • 01

    Can the AI fix the security issues for me?

    No. The AI only reads alert and anomaly data to help you identify problems. It cannot change your security configurations or remediate threats.

  • 02

    Does the AI delete any alerts?

    No. The AI is read-only. It can only pull data from Prisma Cloud, not modify or delete your existing records.

  • 03

    How does it know if a workload is actually compromised?

    The AI looks for a correlation between an active security alert and a detected network anomaly. If both exist for the same workload, it flags it as a likely compromise.

  • 04

    Can I use this with any AI client?

    Yes, as long as your client is MCP-compatible, like Claude, Cursor, or Windsurf.

  • 05

    Does the AI see all my network traffic?

    No. It only sees the specific network anomalies that Prisma Cloud has already detected and made available through the tool.

  • More questions about Prisma Cloud? The Connector page answers them. See everything the Prisma Cloud Connector can do

Connect Prisma Cloud to Claude, Cursor, ChatGPT & more