casb.paloalto

Introduction

The tags beginning with casb.paloalto identify events generated by Paloalto.

The full tag must have 4 levels. The first two are fixed as casb.paloalto. The third level identifies the type of events sent.

Technology	Brand	Type	Subtype

Technology	Brand	Type	Subtype
casb	paloalto	prisma	activity_monitoring admin_audit incident invalid other policy_violation prismaBasic remediation

These are the valid tags and corresponding data tables that will receive the parsers' data:

Tag	Data table

Tag	Data table
casb.paloalto.prisma.activity_monitoring	casb.paloalto.prisma.activity_monitoring
casb.paloalto.prisma.admin_audit	casb.paloalto.prisma.admin_audit
casb.paloalto.prisma.incident	casb.paloalto.prisma.incident
casb.paloalto.prisma.invalid	casb.paloalto.prisma.invalid
casb.paloalto.prisma.other	casb.paloalto.prisma.other
casb.paloalto.prisma.policy_violation	casb.paloalto.prisma.policy_violation
casb.paloalto.prisma.remediation	casb.paloalto.prisma.remediation
casb.paloalto.prisma-basic	casb.paloalto.prismaBasic