Connect Qevlar to Prisma Access to investigate SASE telemetry — traffic, threat, URL filtering, and WildFire logs — for malicious network activity. This page lists the permissions Qevlar requires and how to grant them.
Overview
Qevlar authenticates to Prisma Access with a service account (OAuth 2.0 client credentials, scoped to your tenant). The Client ID and Client Secret are exchanged for a bearer token — no user account or interactive sign-in. Access is governed by the role assigned to the service account. The connector is read-only.
| API | Purpose | Auth |
|---|---|---|
| Prisma Access Insights (SASE API) | Read application, user, and firewall threat logs | OAuth 2.0 bearer token |
The API base is https://api.sase.paloaltonetworks.com.
Connection details
Enter these values when configuring the connector in Qevlar:
| Field | Where to find it | Required |
|---|---|---|
| Client ID | The service account, format <name>@<tsg-id>.iam.panserviceaccount.com | Yes |
| Client Secret | Shown once when the service account is created | Yes |
| Tenant Service Group ID (TSG ID) | Your tenant's TSG ID | Yes |
| Region | Your Prisma Access region (e.g. europe, americas, uk) | Yes |
Required permissions
Create a service account scoped to your tenant (TSG) and assign a role granting read access to Prisma Access Insights and the log viewer (application, user, and firewall threat/traffic logs). A view-only role is sufficient — no write or configuration permissions are required.
Setup
- Create a service account. In Common Services → Identity & Access → Service Accounts, create a service account scoped to your tenant.
- Assign a read-only role. Grant access to Prisma Access Insights and the log viewer (view only).
- Record the credentials. Copy the Client ID and Client Secret — the secret is shown only once. Note your TSG ID and region.
- Configure the connector. In Qevlar, add the Prisma Access connector and enter the connection details above.
Verify the connection
After saving, Qevlar runs a health check that acquires a token. If it fails, check, in order:
- The Client ID and Client Secret are correct and the secret has not been regenerated.
- The TSG ID and region match your tenant.
- The service account's role grants read access to Prisma Access Insights and the log viewer.
API reference
| Operation | HTTP | Endpoint |
|---|---|---|
| Token request | POST | https://auth.apps.paloaltonetworks.com/oauth2/access_token |
| Application details | POST | api.sase.paloaltonetworks.com/insights/v3.0/resource/query/applications/application_list |
| User details | POST | api.sase.paloaltonetworks.com/insights/v3.0/resource/query/users/all/user_list_all |
| Firewall threat logs | POST | api.sase.paloaltonetworks.com/insights/v3.0/resource/query/logviewer/firewall_threat |
Requests include the headers Prisma-Tenant: <TSG ID> and X-PANW-Region: <region>. Auth header: Authorization: Bearer <token>.