[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M71CRDPCT8V5WW8722153HSH":3,"skill-same:01M71CRDPCT8V5WW8722153HSH":89},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":39,"linkOnly":40,"markdownContent":41,"markdownBody":42,"frontMatter":43,"refName":62,"commitSha":63,"skillDirectory":64,"forksCount":14,"repositoryHtmlUrl":65,"repositoryHomepageUrl":6,"ownerHtmlUrl":66,"ownerBlogUrl":6,"ownerDescription":67,"updatedAt":68,"install":69,"resources":82},"01M71CRDPCT8V5WW8722153HSH","zerotrust-prisma-exploit",null,"Deploying Palo Alto Networks Prisma Access for SASE-based zero trust network access using GlobalProtect agents, ZTNA Connectors, security policy enforcement, and integration with Strata Cloud Manager for unified security management.","DCx7C5\u002Fai-marketplace","DCx7C5","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42419559?v=4","01M71C01G2AZV3NTNGWAWSHJPP","DC","01M71C01GQW6G50S2BYMS7PP3E",0,"MIT","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fcloud\u002Fzerotrust\u002Fprisma\u002Fexploit\u002FSKILL.md",[],[19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38],"exploit","zerotrust prisma exploit","prisma","zero trust","security","manager","network","sase","read","strata-cloud-manager","security management","globalprotect","palo-alto","prisma-access","ztna","zero-trust","architecture","Bash","access","cybersecurity","2026-11-10 10:12:30",false,"---\nname: zerotrust-prisma-exploit\ndescription: Deploying Palo Alto Networks Prisma Access for SASE-based zero trust network access using GlobalProtect agents, ZTNA Connectors, security policy enforcement, and integration with Strata Cloud Manager for unified security management.\ndomain: cybersecurity\nsubdomain: zero-trust-architecture\ntags:\n- prisma-access\n- palo-alto\n- ztna\n- sase\n- globalprotect\n- strata-cloud-manager\n- zero-trust\nnist_ai_rmf:\n- GOVERN-1.1\n- MEASURE-2.7\n- MANAGE-3.1\nnist_csf:\n- PR.AA-01\n- PR.AA-05\n- PR.IR-01\n- GV.PO-01\nmodel: sonnet\nmaxTurns: 20\ntools: [Read, Bash, Glob, Grep]\ncapec: []\n---\n\n# Deploying Palo Alto Prisma Access Zero Trust\n\n## When to Use\n\n- When implementing enterprise-grade SASE with integrated ZTNA, SWG, CASB, and FWaaS\n- When replacing both VPN and branch office firewalls with cloud-delivered security\n- When needing advanced threat prevention (WildFire, DNS Security) for remote access traffic\n- When deploying zero trust for both mobile users and remote network (branch) connections\n- When integrating ZTNA with existing Palo Alto NGFW infrastructure via Strata Cloud Manager\n\n**Do not use** for small organizations (\u003C 200 users) where simpler ZTNA solutions suffice, for environments requiring only web application access without full network security, or when budget constraints preclude enterprise SASE licensing.\n\n## Prerequisites\n\n- Prisma Access license (Business Premium or equivalent)\n- Strata Cloud Manager (SCM) tenant configured\n- GlobalProtect agent for endpoint deployment\n- ZTNA Connector VM: 4 vCPU, 8GB RAM, 128GB disk (VMware, AWS, Azure, or GCP)\n- Identity provider: Okta, Entra ID, Ping Identity (SAML 2.0)\n- Palo Alto Cortex Data Lake for log storage\n\n## Workflow\n\n### Step 1: Configure Prisma Access Infrastructure in Strata Cloud Manager\n\nSet up the cloud infrastructure for mobile user and remote network connections.\n\n```text\nStrata Cloud Manager > Prisma Access > Infrastructure Settings:\n\nMobile Users Configuration:\n  - Service Connection: Auto-selected based on user location\n  - DNS Servers: 10.1.1.10, 10.1.1.11 (corporate DNS)\n  - IP Pool for Mobile Users: 10.100.0.0\u002F16\n  - Authentication: SAML with Okta (Primary), Entra ID (Secondary)\n  - GlobalProtect Portal: portal.company.com\n  - GlobalProtect Gateway: Auto (nearest Prisma Access location)\n\nInfrastructure Subnet:\n  - Range: 172.16.0.0\u002F16\n  - Allocation: \u002F24 per Prisma Access location\n```\n\n### Step 2: Deploy ZTNA Connectors for Private Application Access\n\nInstall ZTNA Connectors to provide secure access to internal applications.\n\n```bash\n# Deploy ZTNA Connector on VMware (OVA)\n# Download OVA from Strata Cloud Manager > Prisma Access > ZTNA Connectors\n\n# AWS deployment via CloudFormation\naws cloudformation create-stack \\\n  --stack-name prisma-ztna-connector \\\n  --template-url https:\u002F\u002Fprisma-access-connector-templates.s3.amazonaws.com\u002Fztna-connector-aws.yaml \\\n  --parameters \\\n    ParameterKey=VpcId,ParameterValue=vpc-PROD \\\n    ParameterKey=SubnetId,ParameterValue=subnet-PRIVATE \\\n    ParameterKey=InstanceType,ParameterValue=m5.xlarge \\\n    ParameterKey=TenantServiceGroup,ParameterValue=TSG_ID \\\n    ParameterKey=ConnectorName,ParameterValue=dc-east-connector-01\n\n# Verify connector registration\n# Strata Cloud Manager > Prisma Access > ZTNA Connectors\n# Status should show \"Connected\" with nearest Prisma Access location\n\n# Deploy second connector for HA\n# ZTNA Connector auto-discovers nearest Prisma Access location\n# IPSec tunnel uses: ecp384\u002Faes256\u002Fsha512 for IKE and ESP\n# Bandwidth: up to 2 Gbps per connector\n```\n\n### Step 3: Define Application Definitions and Access Policies\n\nCreate application definitions pointing to internal applications via ZTNA Connectors.\n\n```text\nStrata Cloud Manager > Prisma Access > Applications:\n\nApplication 1: Internal Wiki\n  - FQDN: wiki.internal.corp\n  - Port: TCP 443\n  - ZTNA Connector: dc-east-connector-01\n  - Protocol: HTTPS\n  - Health Check: Enabled (HTTP GET \u002Fhealth)\n\nApplication 2: Source Code Repository\n  - FQDN: git.internal.corp\n  - Ports: TCP 22, 443\n  - ZTNA Connector: dc-east-connector-01, dc-east-connector-02\n  - Protocol: HTTPS, SSH\n\nApplication 3: Finance ERP\n  - FQDN: erp.internal.corp\n  - Port: TCP 443\n  - ZTNA Connector: dc-east-connector-01\n  - Protocol: HTTPS\n  - User Authentication: Required (re-auth every 2h)\n\nStrata Cloud Manager > Policies > Security Policy:\n\nRule 1: Engineering Access to Dev Tools\n  Source: User Group \"Engineering\" (from Okta SAML)\n  Destination: Application \"Source Code Repository\", \"Internal Wiki\"\n  HIP Profile: \"Managed Device with CrowdStrike\"\n  Action: Allow\n  Logging: Enabled\n  Threat Prevention: Best Practice profile\n\nRule 2: Finance Access to ERP\n  Source: User Group \"Finance\"\n  Destination: Application \"Finance ERP\"\n  HIP Profile: \"Compliant Device - High Security\"\n  Action: Allow\n  SSL Decryption: Forward Proxy\n  DLP Profile: \"Financial Data Protection\"\n\nRule 3: Default Deny Private Apps\n  Source: Any\n  Destination: Any Private App\n  Action: Deny\n  Logging: Enabled\n```\n\n### Step 4: Configure Host Information Profile (HIP) for Device Posture\n\nDefine device posture requirements using HIP checks.\n\n```text\nStrata Cloud Manager > Objects > GlobalProtect > HIP Objects:\n\nHIP Object: \"CrowdStrike Running\"\n  - Vendor: CrowdStrike\n  - Product: Falcon Sensor\n  - Is Running: Yes\n  - Minimum Version: 7.10\n\nHIP Object: \"Disk Encryption Enabled\"\n  - Windows: BitLocker = Encrypted\n  - macOS: FileVault = Encrypted\n\nHIP Object: \"OS Patch Level\"\n  - Windows: >= 10.0.22631\n  - macOS: >= 14.0\n\nHIP Profile: \"Managed Device with CrowdStrike\"\n  - Match: \"CrowdStrike Running\" AND \"Disk Encryption Enabled\"\n\nHIP Profile: \"Compliant Device - High Security\"\n  - Match: \"CrowdStrike Running\" AND \"Disk Encryption Enabled\" AND \"OS Patch Level\"\n```\n\n### Step 5: Deploy GlobalProtect Agent to Endpoints\n\nRoll out the GlobalProtect agent for secure connectivity.\n\n```bash\n# Deploy GlobalProtect via Intune (Windows)\n# MSI download from Strata Cloud Manager > GlobalProtect > Agent Downloads\n\n# GlobalProtect pre-deployment configuration\n# pre-deploy.xml for automated portal connection:\ncat > pre-deploy.xml \u003C\u003C 'EOF'\n\u003CGlobalProtect>\n  \u003CSettings>\n    \u003Cportal>portal.company.com\u003C\u002Fportal>\n    \u003Cconnect-method>pre-logon\u003C\u002Fconnect-method>\n    \u003Cauthentication-override>\n      \u003Cgenerate-cookie>yes\u003C\u002Fgenerate-cookie>\n      \u003Ccookie-lifetime>24\u003C\u002Fcookie-lifetime>\n    \u003C\u002Fauthentication-override>\n  \u003C\u002FSettings>\n\u003C\u002FGlobalProtect>\nEOF\n\n# Verify GlobalProtect connection status\n# GlobalProtect system tray > Settings > Connection Details\n# Should show: Connected to nearest Prisma Access gateway\n# IPSec tunnel established with full threat prevention\n```\n\n### Step 6: Configure Logging and Monitoring\n\nSet up Cortex Data Lake integration and monitoring dashboards.\n\n```text\nStrata Cloud Manager > Prisma Access > Monitoring:\n\nLog Forwarding:\n  - Cortex Data Lake: Enabled (all log types)\n  - SIEM Forwarding: Splunk HEC (https:\u002F\u002Fsplunk-hec.company.com:8088)\n  - Log Types: Traffic, Threat, URL, WildFire, GlobalProtect, HIP Match\n\nDashboard Monitoring:\n  - Mobile Users: Active connections, locations, bandwidth\n  - ZTNA Connectors: Health, latency, tunnel status\n  - Security Events: Threats blocked, DLP violations, HIP failures\n  - Application Usage: Top apps, top users, denied access attempts\n\nAlerting:\n  - ZTNA Connector down: Email + PagerDuty\n  - HIP failure rate > 10%: Email to IT\n  - Threat detected on mobile user: SOC alert\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| Prisma Access | Palo Alto's cloud-delivered SASE platform providing FWaaS, SWG, CASB, DLP, and ZTNA from a single architecture |\n| ZTNA Connector | VM-based connector establishing IPSec tunnels from internal networks to Prisma Access for private application access |\n| GlobalProtect | Endpoint agent providing secure connectivity to Prisma Access with HIP checks and always-on VPN |\n| Host Information Profile (HIP) | Device posture checks evaluating endpoint security state (EDR, encryption, patches) before granting access |\n| Strata Cloud Manager | Unified management console for Prisma Access, NGFW, and Prisma Cloud security policy |\n| Cortex Data Lake | Cloud-based log storage and analytics platform for Palo Alto security telemetry |\n\n## Tools & Systems\n\n- **Prisma Access**: Cloud-delivered SASE with integrated ZTNA, SWG, CASB, DLP, FWaaS\n- **Strata Cloud Manager (SCM)**: Unified policy management across Palo Alto security products\n- **GlobalProtect Agent**: Endpoint connectivity agent with HIP data collection\n- **ZTNA Connector**: Outbound-only tunnel connector for internal application access\n- **Cortex Data Lake**: Centralized log storage with analytics and threat detection\n- **WildFire**: Cloud-based malware analysis and prevention integrated with Prisma Access\n\n## Common Scenarios\n\n### Scenario: Enterprise SASE Migration for 5,000-User Organization\n\n**Context**: A manufacturing company with 5,000 users across 15 offices is consolidating VPN, SWG, and branch firewalls into Prisma Access SASE. Users access 50+ internal applications and need consistent security regardless of location.\n\n**Approach**:\n1. Deploy ZTNA Connectors at 3 data centers (2 per DC for HA) for internal application access\n2. Configure GlobalProtect with pre-logon connection for always-on security\n3. Define 50+ application definitions in SCM with FQDN and port mappings\n4. Create HIP profiles: Standard (encryption + AV), Enhanced (+ CrowdStrike + patches)\n5. Build security policies mapping user groups to applications with HIP requirements\n6. Enable threat prevention profiles (Anti-Spyware, Anti-Virus, WildFire, URL Filtering)\n7. Deploy GlobalProtect agent via SCCM to all 5,000 endpoints in phases\n8. Configure Cortex Data Lake forwarding to Splunk for SOC monitoring\n9. Decommission VPN concentrators and branch firewall appliances\n\n**Pitfalls**: ZTNA Connector requires minimum 4 vCPU and 8GB RAM; under-provisioning causes latency. GlobalProtect pre-logon requires machine certificates for authentication before user login. HIP check intervals should be 60 seconds minimum to avoid performance impact. Plan for a 4-6 week pilot before full deployment.\n\n## Output Format\n\n```\nPrisma Access ZTNA Deployment Report\n==================================================\nOrganization: ManufactureCorp\nDeployment Date: 2026-02-23\n\nINFRASTRUCTURE:\n  ZTNA Connectors: 6 (2x DC-East, 2x DC-West, 2x DC-EU)\n  Prisma Access Locations: 8 (auto-selected)\n  GlobalProtect Portal: portal.manufacturecorp.com\n\nAPPLICATION ACCESS:\n  Defined Applications: 52\n  Active ZTNA Connections: 3,247\n  Average Latency: 12ms\n\nENDPOINT DEPLOYMENT:\n  GlobalProtect Deployed: 4,812 \u002F 5,000 (96.2%)\n  HIP Compliant: 4,567 \u002F 4,812 (94.9%)\n  HIP Failures: 245 (top: missing patches 120, encryption 85)\n\nSECURITY (last 30 days):\n  Threats Blocked: 1,234\n  DLP Violations: 89\n  URL Blocked: 45,678\n  WildFire Submissions: 2,345\n```\n","# Deploying Palo Alto Prisma Access Zero Trust\n\n## When to Use\n\n- When implementing enterprise-grade SASE with integrated ZTNA, SWG, CASB, and FWaaS\n- When replacing both VPN and branch office firewalls with cloud-delivered security\n- When needing advanced threat prevention (WildFire, DNS Security) for remote access traffic\n- When deploying zero trust for both mobile users and remote network (branch) connections\n- When integrating ZTNA with existing Palo Alto NGFW infrastructure via Strata Cloud Manager\n\n**Do not use** for small organizations (\u003C 200 users) where simpler ZTNA solutions suffice, for environments requiring only web application access without full network security, or when budget constraints preclude enterprise SASE licensing.\n\n## Prerequisites\n\n- Prisma Access license (Business Premium or equivalent)\n- Strata Cloud Manager (SCM) tenant configured\n- GlobalProtect agent for endpoint deployment\n- ZTNA Connector VM: 4 vCPU, 8GB RAM, 128GB disk (VMware, AWS, Azure, or GCP)\n- Identity provider: Okta, Entra ID, Ping Identity (SAML 2.0)\n- Palo Alto Cortex Data Lake for log storage\n\n## Workflow\n\n### Step 1: Configure Prisma Access Infrastructure in Strata Cloud Manager\n\nSet up the cloud infrastructure for mobile user and remote network connections.\n\n```text\nStrata Cloud Manager > Prisma Access > Infrastructure Settings:\n\nMobile Users Configuration:\n  - Service Connection: Auto-selected based on user location\n  - DNS Servers: 10.1.1.10, 10.1.1.11 (corporate DNS)\n  - IP Pool for Mobile Users: 10.100.0.0\u002F16\n  - Authentication: SAML with Okta (Primary), Entra ID (Secondary)\n  - GlobalProtect Portal: portal.company.com\n  - GlobalProtect Gateway: Auto (nearest Prisma Access location)\n\nInfrastructure Subnet:\n  - Range: 172.16.0.0\u002F16\n  - Allocation: \u002F24 per Prisma Access location\n```\n\n### Step 2: Deploy ZTNA Connectors for Private Application Access\n\nInstall ZTNA Connectors to provide secure access to internal applications.\n\n```bash\n# Deploy ZTNA Connector on VMware (OVA)\n# Download OVA from Strata Cloud Manager > Prisma Access > ZTNA Connectors\n\n# AWS deployment via CloudFormation\naws cloudformation create-stack \\\n  --stack-name prisma-ztna-connector \\\n  --template-url https:\u002F\u002Fprisma-access-connector-templates.s3.amazonaws.com\u002Fztna-connector-aws.yaml \\\n  --parameters \\\n    ParameterKey=VpcId,ParameterValue=vpc-PROD \\\n    ParameterKey=SubnetId,ParameterValue=subnet-PRIVATE \\\n    ParameterKey=InstanceType,ParameterValue=m5.xlarge \\\n    ParameterKey=TenantServiceGroup,ParameterValue=TSG_ID \\\n    ParameterKey=ConnectorName,ParameterValue=dc-east-connector-01\n\n# Verify connector registration\n# Strata Cloud Manager > Prisma Access > ZTNA Connectors\n# Status should show \"Connected\" with nearest Prisma Access location\n\n# Deploy second connector for HA\n# ZTNA Connector auto-discovers nearest Prisma Access location\n# IPSec tunnel uses: ecp384\u002Faes256\u002Fsha512 for IKE and ESP\n# Bandwidth: up to 2 Gbps per connector\n```\n\n### Step 3: Define Application Definitions and Access Policies\n\nCreate application definitions pointing to internal applications via ZTNA Connectors.\n\n```text\nStrata Cloud Manager > Prisma Access > Applications:\n\nApplication 1: Internal Wiki\n  - FQDN: wiki.internal.corp\n  - Port: TCP 443\n  - ZTNA Connector: dc-east-connector-01\n  - Protocol: HTTPS\n  - Health Check: Enabled (HTTP GET \u002Fhealth)\n\nApplication 2: Source Code Repository\n  - FQDN: git.internal.corp\n  - Ports: TCP 22, 443\n  - ZTNA Connector: dc-east-connector-01, dc-east-connector-02\n  - Protocol: HTTPS, SSH\n\nApplication 3: Finance ERP\n  - FQDN: erp.internal.corp\n  - Port: TCP 443\n  - ZTNA Connector: dc-east-connector-01\n  - Protocol: HTTPS\n  - User Authentication: Required (re-auth every 2h)\n\nStrata Cloud Manager > Policies > Security Policy:\n\nRule 1: Engineering Access to Dev Tools\n  Source: User Group \"Engineering\" (from Okta SAML)\n  Destination: Application \"Source Code Repository\", \"Internal Wiki\"\n  HIP Profile: \"Managed Device with CrowdStrike\"\n  Action: Allow\n  Logging: Enabled\n  Threat Prevention: Best Practice profile\n\nRule 2: Finance Access to ERP\n  Source: User Group \"Finance\"\n  Destination: Application \"Finance ERP\"\n  HIP Profile: \"Compliant Device - High Security\"\n  Action: Allow\n  SSL Decryption: Forward Proxy\n  DLP Profile: \"Financial Data Protection\"\n\nRule 3: Default Deny Private Apps\n  Source: Any\n  Destination: Any Private App\n  Action: Deny\n  Logging: Enabled\n```\n\n### Step 4: Configure Host Information Profile (HIP) for Device Posture\n\nDefine device posture requirements using HIP checks.\n\n```text\nStrata Cloud Manager > Objects > GlobalProtect > HIP Objects:\n\nHIP Object: \"CrowdStrike Running\"\n  - Vendor: CrowdStrike\n  - Product: Falcon Sensor\n  - Is Running: Yes\n  - Minimum Version: 7.10\n\nHIP Object: \"Disk Encryption Enabled\"\n  - Windows: BitLocker = Encrypted\n  - macOS: FileVault = Encrypted\n\nHIP Object: \"OS Patch Level\"\n  - Windows: >= 10.0.22631\n  - macOS: >= 14.0\n\nHIP Profile: \"Managed Device with CrowdStrike\"\n  - Match: \"CrowdStrike Running\" AND \"Disk Encryption Enabled\"\n\nHIP Profile: \"Compliant Device - High Security\"\n  - Match: \"CrowdStrike Running\" AND \"Disk Encryption Enabled\" AND \"OS Patch Level\"\n```\n\n### Step 5: Deploy GlobalProtect Agent to Endpoints\n\nRoll out the GlobalProtect agent for secure connectivity.\n\n```bash\n# Deploy GlobalProtect via Intune (Windows)\n# MSI download from Strata Cloud Manager > GlobalProtect > Agent Downloads\n\n# GlobalProtect pre-deployment configuration\n# pre-deploy.xml for automated portal connection:\ncat > pre-deploy.xml \u003C\u003C 'EOF'\n\u003CGlobalProtect>\n  \u003CSettings>\n    \u003Cportal>portal.company.com\u003C\u002Fportal>\n    \u003Cconnect-method>pre-logon\u003C\u002Fconnect-method>\n    \u003Cauthentication-override>\n      \u003Cgenerate-cookie>yes\u003C\u002Fgenerate-cookie>\n      \u003Ccookie-lifetime>24\u003C\u002Fcookie-lifetime>\n    \u003C\u002Fauthentication-override>\n  \u003C\u002FSettings>\n\u003C\u002FGlobalProtect>\nEOF\n\n# Verify GlobalProtect connection status\n# GlobalProtect system tray > Settings > Connection Details\n# Should show: Connected to nearest Prisma Access gateway\n# IPSec tunnel established with full threat prevention\n```\n\n### Step 6: Configure Logging and Monitoring\n\nSet up Cortex Data Lake integration and monitoring dashboards.\n\n```text\nStrata Cloud Manager > Prisma Access > Monitoring:\n\nLog Forwarding:\n  - Cortex Data Lake: Enabled (all log types)\n  - SIEM Forwarding: Splunk HEC (https:\u002F\u002Fsplunk-hec.company.com:8088)\n  - Log Types: Traffic, Threat, URL, WildFire, GlobalProtect, HIP Match\n\nDashboard Monitoring:\n  - Mobile Users: Active connections, locations, bandwidth\n  - ZTNA Connectors: Health, latency, tunnel status\n  - Security Events: Threats blocked, DLP violations, HIP failures\n  - Application Usage: Top apps, top users, denied access attempts\n\nAlerting:\n  - ZTNA Connector down: Email + PagerDuty\n  - HIP failure rate > 10%: Email to IT\n  - Threat detected on mobile user: SOC alert\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| Prisma Access | Palo Alto's cloud-delivered SASE platform providing FWaaS, SWG, CASB, DLP, and ZTNA from a single architecture |\n| ZTNA Connector | VM-based connector establishing IPSec tunnels from internal networks to Prisma Access for private application access |\n| GlobalProtect | Endpoint agent providing secure connectivity to Prisma Access with HIP checks and always-on VPN |\n| Host Information Profile (HIP) | Device posture checks evaluating endpoint security state (EDR, encryption, patches) before granting access |\n| Strata Cloud Manager | Unified management console for Prisma Access, NGFW, and Prisma Cloud security policy |\n| Cortex Data Lake | Cloud-based log storage and analytics platform for Palo Alto security telemetry |\n\n## Tools & Systems\n\n- **Prisma Access**: Cloud-delivered SASE with integrated ZTNA, SWG, CASB, DLP, FWaaS\n- **Strata Cloud Manager (SCM)**: Unified policy management across Palo Alto security products\n- **GlobalProtect Agent**: Endpoint connectivity agent with HIP data collection\n- **ZTNA Connector**: Outbound-only tunnel connector for internal application access\n- **Cortex Data Lake**: Centralized log storage with analytics and threat detection\n- **WildFire**: Cloud-based malware analysis and prevention integrated with Prisma Access\n\n## Common Scenarios\n\n### Scenario: Enterprise SASE Migration for 5,000-User Organization\n\n**Context**: A manufacturing company with 5,000 users across 15 offices is consolidating VPN, SWG, and branch firewalls into Prisma Access SASE. Users access 50+ internal applications and need consistent security regardless of location.\n\n**Approach**:\n1. Deploy ZTNA Connectors at 3 data centers (2 per DC for HA) for internal application access\n2. Configure GlobalProtect with pre-logon connection for always-on security\n3. Define 50+ application definitions in SCM with FQDN and port mappings\n4. Create HIP profiles: Standard (encryption + AV), Enhanced (+ CrowdStrike + patches)\n5. Build security policies mapping user groups to applications with HIP requirements\n6. Enable threat prevention profiles (Anti-Spyware, Anti-Virus, WildFire, URL Filtering)\n7. Deploy GlobalProtect agent via SCCM to all 5,000 endpoints in phases\n8. Configure Cortex Data Lake forwarding to Splunk for SOC monitoring\n9. Decommission VPN concentrators and branch firewall appliances\n\n**Pitfalls**: ZTNA Connector requires minimum 4 vCPU and 8GB RAM; under-provisioning causes latency. GlobalProtect pre-logon requires machine certificates for authentication before user login. HIP check intervals should be 60 seconds minimum to avoid performance impact. Plan for a 4-6 week pilot before full deployment.\n\n## Output Format\n\n```\nPrisma Access ZTNA Deployment Report\n==================================================\nOrganization: ManufactureCorp\nDeployment Date: 2026-02-23\n\nINFRASTRUCTURE:\n  ZTNA Connectors: 6 (2x DC-East, 2x DC-West, 2x DC-EU)\n  Prisma Access Locations: 8 (auto-selected)\n  GlobalProtect Portal: portal.manufacturecorp.com\n\nAPPLICATION ACCESS:\n  Defined Applications: 52\n  Active ZTNA Connections: 3,247\n  Average Latency: 12ms\n\nENDPOINT DEPLOYMENT:\n  GlobalProtect Deployed: 4,812 \u002F 5,000 (96.2%)\n  HIP Compliant: 4,567 \u002F 4,812 (94.9%)\n  HIP Failures: 245 (top: missing patches 120, encryption 85)\n\nSECURITY (last 30 days):\n  Threats Blocked: 1,234\n  DLP Violations: 89\n  URL Blocked: 45,678\n  WildFire Submissions: 2,345\n```\n",{"name":5,"tags":44,"capec":45,"model":46,"tools":47,"domain":38,"maxTurns":51,"nist_csf":52,"subdomain":57,"description":7,"nist_ai_rmf":58},[32,31,33,26,30,28,34],[],"sonnet",[48,36,49,50],"Read","Glob","Grep",20,[53,54,55,56],"PR.AA-01","PR.AA-05","PR.IR-01","GV.PO-01","zero-trust-architecture",[59,60,61],"GOVERN-1.1","MEASURE-2.7","MANAGE-3.1","main","a91f1293287ffa9f4f1b8f486cd6e835a1568c84","skills\u002Fcloud\u002Fzerotrust\u002Fprisma\u002Fexploit","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace","https:\u002F\u002Fgithub.com\u002FDCx7C5","#Python","2026-09-01 11:21:00",{"source":8,"skillName":5,"commands":70,"prompt":80,"zipAvailable":81},[71,74,77],{"tool":72,"command":73},"npx","npx skills add DCx7C5\u002Fai-marketplace --skill zerotrust-prisma-exploit",{"tool":75,"command":76},"bunx","bunx skills add DCx7C5\u002Fai-marketplace --skill zerotrust-prisma-exploit",{"tool":78,"command":79},"pnpm","pnpm dlx skills add DCx7C5\u002Fai-marketplace --skill zerotrust-prisma-exploit","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fcloud\u002Fzerotrust\u002Fprisma\u002Fexploit\u002FSKILL.md",true,[83],{"path":84,"resourceType":85,"resourceTypeDesc":86,"sizeBytes":87,"sourceHtmlUrl":88},"index.json","REFERENCE","参考文档",683,"https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fcloud\u002Fzerotrust\u002Fprisma\u002Fexploit\u002Findex.json",[90,115,135,156,178,194],{"skillNo":91,"name":92,"nameZh":6,"description":93,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":94,"categories":95,"keywords":96,"publishedAt":39},"01M71HAPZ01KQ30RKTB0FFSQ05","services-wmi-persistence-detect","Detect WMI event subscription persistence by enumerating ActiveScriptEventConsumer, CommandLineEventConsumer, and permanent subscriptions in the WMI repository.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fpersistence\u002Fdetect\u002FSKILL.md",[],[97,98,99,100,101,102,103,104,105,106,107,108,109,110,111,112,113,38,114],"services","detect","services wmi persistence detect","wmi","persistence","de","cm","process","activescript","event","subscriptions","commandline-consumer","repository","subscription","event-subscription","t1546.003","forensics","process-forensics",{"skillNo":116,"name":117,"nameZh":6,"description":118,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":119,"categories":120,"keywords":121,"publishedAt":39},"01M71HAK6JTTTS229T17WJMMCG","services-wmi-exec-exploit","Perform lateral movement across Windows networks using WMI-based remote execution techniques including Impacket wmiexec.py, CrackMapExec, and native WMI commands for stealthy post-exploitation during red team engagements.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fexec\u002Fexploit\u002FSKILL.md",[],[19,97,122,100,123,124,125,38,36,126,127,128,129,130,102,131,132,27,133,134],"services wmi exec exploit","exec","remote","traffic","analysis","team","across","crackmapexec","native","command","lateral movement","lateral-movement","Impacket",{"skillNo":136,"name":137,"nameZh":6,"description":138,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":139,"categories":140,"keywords":141,"publishedAt":39},"01M71HAG6MHKNQV8KDZKMT4886","registry-artifact-extract","Extract and analyze Windows Registry hives to uncover user activity, installed software, autostart entries, and evidence of system compromise.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fregistry\u002Fartifact\u002Fextract\u002FSKILL.md",[],[142,143,144,145,146,147,38,36,148,126,149,150,102,27,151,152,153,154,155,46],"artifact","registry","registry artifact extract","extract","evidence-collection","artifact-analysis","collection","analyze","uncover","software","activity","digital-forensics","windows-registry","regripper",{"skillNo":157,"name":158,"nameZh":6,"description":159,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":160,"categories":161,"keywords":162,"publishedAt":39},"01M71HACR4A8XTWTTSXK4124AA","processes-token-impersonate-detect","Detect Windows token impersonation and privilege abuse including SeImpersonatePrivilege exploitation via Potato attacks and token stealing techniques.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Ftoken\u002Fimpersonate\u002Fdetect\u002FSKILL.md",[],[98,163,164,165,166,167,168,103,169,38,114,170,171,172,173,174,175,176,177,102],"processes token impersonate detect","token","processes","attacks","windows","escalation","techniques","privilege-escalation","seimpersonate","token-impersonation","printspoofer","exploitation","potato","impersonation","via",{"skillNo":179,"name":180,"nameZh":6,"description":181,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":182,"categories":183,"keywords":184,"publishedAt":39},"01M71HAABSB4Z6QFSXEG00R4RK","processes-thread-injection-detect","Detect Windows thread injection techniques including CreateRemoteThread, QueueUserAPC, NtCreateThreadEx, and thread hijacking via process memory analysis.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fthread\u002Finjection\u002Fdetect\u002FSKILL.md",[],[185,186,98,187,165,167,188,103,189,169,38,114,126,190,191,192,193,177,102,104],"thread","processes thread injection detect","injection","memory","process-injection","api","apc-injection","thread-injection","nt-api",{"skillNo":195,"name":196,"nameZh":6,"description":197,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":198,"categories":199,"keywords":200,"publishedAt":39},"01M71HA7H311V5G14WMX58HQSS","processes-hollow-technique-detect","Detect process hollowing (RunPE) by identifying processes with mismatched image paths between PEB and VAD tree, or unmapped PE headers in memory.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fhollow\u002Ftechnique\u002Fdetect\u002FSKILL.md",[],[201,98,165,202,188,103,203,204,38,114,205,206,207,208,209,210,102,104,211,212],"processes hollow technique detect","tree","memory-forensics","process-hollow","peb","runpe","image","pe-header","in memory","with","mismatched","headers"]