Palo Alto Networks Prisma Cloud (CWPP) Connector

Complete the following prerequisites before configuring the connector in Qualys ETM. Have these items ready before continuing.

Create a Role in Prisma Cloud

1. Sign in to the Prisma Cloud console at https://app.prismacloud.io or the applicable regional pod URL.
2. Navigate to Settings > Access Control > Roles
3. Click Add Role and provide a name (e.g., Qualys-ETM-Connector)
4. Set the Permission Group to Account Group Read Only
5. Under Account Groups, select All to allow the connector to fetch assets across your entire tenant, or choose specific groups if you want to limit the scope
6. Save the role

Generating Access Keys in Prisma Cloud

The connector uses an Access Key ID and Secret Key to authenticate with the Prisma Cloud API. Follow these steps to generate credentials.

1. Navigate to Settings > Access Control > Service Accounts tab.
2. Assign the role created in the previous step
3. Click Generate Access Keys
4. Copy and save the Access Key ID and Secret Key — the Secret Key is shown only once and cannot be retrieved later.

Permissions Required

The Prisma Cloud user account used to generate API credentials must hold the Prisma Cloud User Role for Cloud Security API requests with access to the Access Control section. Read more about Prisma Cloud administrator roles in the Prisma Cloud documentation.

Scope and Data Access

The connector queries the following Prisma Cloud API endpoints during each run:

• Authentication endpoint – https://api.prismacloud.io/login
• Resource scan endpoint – https://api.prismacloud.io/v2/resource/scan_info
• Asset details / vulnerability endpoint – https://api.prismacloud.io/uai/v1/asset
• Policy / misconfiguration endpoint – https://api.prismacloud.io/policy/

API rate limits apply at 5 requests per second with a default batch size of 100 records per request. Filters are expressed in JSON format, for example {"cloud.region":["AWS Oregon"]} or {"resource.type":["EC2 Instance"]}. Import of installed software and source tags is not supported.

Key Rotation

If the API key expires, regenerate a new key in Prisma Cloud under Settings > Access Control > Access Keys. Once the new Key ID and Key Secret are available, update the credentials in Qualys ETM by selecting the Edit Connector option for the affected connector.

Configure the connector's identity and authenticate with Prisma Cloud. Navigate to the connector setup wizard and complete the fields described below.

Connector Details

Authentication Details

Provide authentication credentials for the Prisma Cloud API. These values are obtained during the credential generation steps described in the Before You Begin section.

After entering all authentication details, click Test Connection to validate connectivity. The following checks are performed:

• Network Reachability — Verifies that the connector endpoint is reachable over HTTPS (port 443).
• TLS Handshake — Confirms that a secure TLS connection can be established with the remote endpoint.
• Authentication Credential Check — Validates the configured credentials against the source system's authentication endpoint.
• Authorization Scope Check — Confirms that the provided credentials have the required permissions to access the configured data scope.
• Data Fetch — Verifies that data can be successfully retrieved from the source system using the configured connection.

Define what data the connector imports and when it runs.

• Data to Sync – Select the data types to import: Assets (Host Asset Records), Vulnerability Findings (CVEs), and/or Misconfiguration Findings.
• Filters – Optionally restrict the scope of imported data using JSON filter expressions. Filters are applied against the Prisma Cloud API at query time. Example expressions:
  • {"cloud.region":["AWS Oregon"]}
  • {"resource.type":["EC2 Instance"]}
• Schedule – Configure when the connector runs. Options include a single-occurrence execution (specify exact date and time) or a recurring schedule (specify start date, end date, and recurrence interval).

Sampling Mode - Limit Sync to Top 1,000 Assets and Findings

Sampling Mode can restrict data ingestion to a targeted subset of up to 1,000 assets and their associated findings. You can quickly validate integration and review meaningful security data without a full environment sync.

You can select the Limit sync to top 1,000 assets and findings checkbox to limit the fetch 1000 assets using risk-based filter criteria. The assets, along with their associated findings, are discovered and shared with ETM. The connector applies risk-based filters during asset fetch to ensure the ingested subset represents the most relevant assets in your environment rather than a random or arbitrary sample. Assets are filtered by cloud service type. All findings associated with the fetched assets are ingested.

Review all configuration settings entered in the previous steps. Verify connector name, authentication type, Base URL, selected data types, filter expressions, and schedule before confirming. Click Save (or Confirm) to finalize the connector configuration and register it in Qualys ETM.

Maps vulnerability and host asset fields from the Prisma Cloud asset and vulnerability endpoints to Qualys ETM target attributes.

Maps misconfiguration and host asset fields from the Prisma Cloud policy endpoint to Qualys ETM target attributes.