← All integrationsINTEGRATION · SECURITY OPERATIONS

Kapālins for Palo Alto Networks

Your SOC keeps working in Palo Alto Networks Cortex. Kapālins pushes every AI finding, block and incident there as the Cortex management logs API, with the person, the rule and the evidence on each one.

See it governed liveSetup in four steps

No new console for the SOC

Analysts triage AI findings in Palo Alto Networks, next to everything else, in its own field names.

AI-specific signal you do not have today

Prompt injection, sensitive data in prompts, unapproved models and agent tool calls, mapped to MITRE ATLAS before they arrive.

Every finding once

Deduplicated on the Kapālins event id, so a retry never doubles a ticket, and every attempt is in the push log.

WHAT ARRIVES

What lands in Palo Alto Networks.

Each incident carries its severity, the person, the rule that fired, what was stopped, and a link back to the evidence. "Ship to ITSM" on the card sends it on demand; findings you choose are pushed as they happen.

  • Sent as the Cortex management logs API
  • Credential: an API key, its id and your Cortex tenant URL
Kapālins incidents: sensitive data stopped before it left
Incidents in the pilot tenant: sensitive data stopped before it reached an AI service. Personal addresses masked.
CONTEXT

Mapped to the attack. Priced in dollars.

Every finding carries the MITRE ATLAS technique it belongs to and the plane that caught it. Click the technique and Kapālins shows its residual risk and a modelled annual loss, so the SOC can rank AI findings by what they could cost.

  • Bayesian FAIR on your own telemetry, labelled as modelled
  • Prompt injection, jailbreak, tool misuse, data exfiltration
Kapālins Threat Map: a MITRE ATLAS technique opened to its modelled loss exposure
Console replay · illustrative data
A replay of the Kapālins console: posture, the MITRE ATLAS matrix, then one technique opened to its residual risk and a modelled annual loss from Bayesian FAIR with sector priors. Loss figures are modelled; key names are illustrative.
SOURCE

Everything behind the finding.

The full record stays in Kapālins: the request, the verdict and the rule, so an analyst in your SIEM can pivot to the evidence.

  • Nothing is pulled from your SIEM
Kapālins Logs: one timeline of AI requests and policy verdicts
The Kapālins timeline in the pilot tenant on production. Personal addresses masked.
Setup

Four steps.

  1. Create the destination credentialAn API key, its id and your Cortex tenant URL, created in Palo Alto Networks.
  2. Add the destinationSecurity operations › Palo Alto Networks › paste the credential and endpoint.
  3. Choose what to pushFindings, blocks or incidents, with a minimum severity.
  4. Send a testKapālins pushes a test event and shows the response.
Request a briefing

See Palo Alto Networks governed in thirty minutes.

Bring the person who holds the credential. We connect it live and watch the first events land.

Request a briefing All integrations
FAQ

Questions buyers ask.

Does Kapālins read anything from Palo Alto Networks?

No. The integration is one-way: Kapālins pushes, nothing is pulled.

Can I limit what is pushed?

Yes. Choose the finding types and the minimum severity; the rest stays in Kapālins.

What if a push fails?

The attempt and the response are recorded in the push log and shown on the integration; the next attempt retries it.