Copy page

Palo Alto

Data Security Alerts

Collects and ingests data security alerts from the Palo Alto Data Security API.

Details

This input collects data security alerts from the Palo Alto Data Security API. It supports incremental sync and handles pagination automatically. On the first sync, it fetches all available alerts. Key features include:

• Incremental sync with state management
• Fetches detailed alert information

Prerequisites

1. A Palo Alto Data Security account with API access.
2. API Key for authentication.
3. Base URL for the Palo Alto Data Security API (e.g., https://api.use1.dig.security).

Setup Instructions

1. Obtain your API Key from the Palo Alto Data Security console. Refer to this page for instructions.
2. Note down the Base URL for the API (varies by region). Refer to this page for more information.
3. Configure the input using the API Key and Base URL.

Related Articles

• Palo Alto Data Security API Documentation
• API Management
• List Alerts

Configuration

Settings

Field	Description	Type	Required
base_url	Base URL for the Palo Alto Data Security API	string	Yes
backfill start time	string	No	The date to start fetching data from. If not specified, no past records will be fetched.
API Rate Limit	Optional limit on the connector's outbound request rate to the source API. Leave blank to use the connector's default behavior. See API Rate Limiting for the field format, limits, and how to choose a value.	object	No

Secrets

Field	Description	Type	Required
api_key	API Key for access	string	Yes

Note on Collection Behavior

The input follows an incremental collection pattern:

• First run: Collects all available alerts
• Subsequent runs: Collects only new alerts since the last successful run
• Implements state management to track the last collection timestamp

Troubleshooting

Common issues and their solutions:

1. Authentication failures

   • Verify API Key and Base URL are correct
   • Ensure the API key has not expired

2. Connection issues

   • Verify the Base URL is correct for your region
   • Check network connectivity and firewall rules
   • Ensure proper SSL/TLS configuration

Sample Record

Code
{
  "id": "623196645",
  "detectionTime": "2025-08-11T23:46:48.848879Z",
  "policyName": "Suspicious database configuration change",
  "assetName": "production-database",
  "assetLabels": [
    {
      "label": {
        "id": 841960369,
        "name": "PII",
        "description": "Confidential company data",
        "color": "F39C12",
        "prettyName": "Financial"
      },
      "connectedBy": "AUTOMATION"
    }
  ],
  "cloudProvider": "Azure",
  "destinationProjects": {},
  "projectName": "Production",
  "projectId": "123412341234",
  "cloudEnvironment": "DEVELOPMENT",
  "policySeverity": "CRITICAL",
  "policyCategoryType": "ATTACK",
  "status": "CLOSED",
  "eventActor": "analyst@company.com",
  "eventUserAgent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36",
  "eventActionMedium": "API",
  "eventSource": "67.198.104.112",
  "policyFrameWorks": [
    "MITRE-T1578"
  ],
  "eventRawData": "{}",
  "assetId": "arn:aws:rds:us-east-2:001122334455:bucket:production-database"
}

Sync frequency

By default this input polls approximately every 10 seconds, with each sync beginning after the previous one completes. A cron schedule configured on the pipeline overrides this cadence. See Input Sync Frequency for details.