---
sourceDocument: Australia Security Management
sourceDocumentLink: https://www.servicenow.com/docs/r/australia/security-management

 Release :

    - australia

ft:locale :

    - en-US

ft:publication_title :

    - Australia Security Management

ft:clusterId :

    - security

bundleId :

    - security

workflow :

    - Technology


---

# Palo Alto Prisma AIRS Integration for AI Security Exposure Management

# Palo Alto Prisma AIRS integration {#ariaid-title1}

Release version: Australia  
Updated September 30, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 2 minutes to read
Summarize  
![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI  
This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete.  

## Summary of Palo Alto Prisma AIRS integration

The Vulnerability Response Integration with Palo Alto Prisma AIRS enables ServiceNow customers to import AI security scan results, posture findings, and model validation data into their ServiceNow AI Platform instance.
This integration helps organizations detect AI-related security risks, drive remediation workflows, and verify compliance with AI security requirements by leveraging Prisma AIRS' capabilities to monitor and protect AI models, APIs, and data pipelines.
Show full answer Show less  

## Key Features

* **Palo Alto Prisma AIRS:** A security platform for discovering, monitoring, and protecting AI models, providing risk assessment, data leakage prevention, prompt injection defense, and runtime anomaly detection.
* **AI Red Teaming:** Automatically simulates adversarial attacks against AI models (e.g., prompt injection, jailbreaks, bias, toxicity, hallucination) and maps findings to security frameworks like OWASP LLM Top 10 and MITRE ATLAS.
* **Integration Setup:** Configuration via a dedicated UI where users input API URL, Client ID, Client Secret, TSG ID, and Auth URL, enabling secure credential storage and connection to Prisma AIRS.
* **Data Import:** Supports manual or scheduled execution to pull AI security data which is then validated and processed automatically, with results viewable under AI Security modules in ServiceNow.
* **Data Types Imported:**
  * AI Security Scans -- Detects vulnerabilities such as malicious code in AI model files.
  * Model Validation Results -- Tests AI models against attack scenarios to identify weaknesses.
  * Red Team Scan Guardrails -- Guardrail policies applied during adversarial testing.

## Prerequisites

* ServiceNow plugins: Vulnerability Response Integration Framework (snvulintfw) and AI Security (snsecai).
* Active Palo Alto Prisma AIRS subscription with necessary credentials: Client ID, Client Secret, API base URL, Authorization URL, and Prisma tenant Service Group (TSG) ID.

## Using the Integration

Once configured, the integration imports Prisma AIRS data into ServiceNow AI Platform, mapping findings to appropriate records and dashboards. This enables customers to monitor AI security exposures comprehensively, manage vulnerabilities, and facilitate remediation efforts effectively within their ServiceNow environment.  
The Vulnerability Response Integration with Palo Alto Prisma AIRS imports AI security scan results, posture findings, and model validation data into your ServiceNow AI Platform instance. Use the data to help you detect security risks, drive remediation workflows, and verify compliance with AI security requirements.

## Prisma AI Runtime Security (AIRS) {#prisma-airs-integration__what-is-prisma-airs}

Palo Alto Networks' Prisma AIRS (AI Runtime Security) is a security platform that discovers, monitors, and protects AI models, APIs, and data pipelines across an organization. It provides risk assessment, data leakage
prevention, prompt injection defense, and runtime anomaly detection for AI deployments.

## Prisma AIRS AI Red Teaming {#prisma-airs-integration__what-is-ai-red-teaming}

AI Red Teaming is a Prisma AIRS capability that automatically simulates adversarial attacks against AI models --- including prompt injection, jailbreaks, bias, toxicity, and hallucination --- and maps findings to frameworks such
as OWASP LLM Top 10 and MITRE ATLAS. It helps organizations proactively identify and fix AI security weaknesses before attackers can exploit them.

## The ServiceNow AI Platform Prisma AIRS integration {#prisma-airs-integration__servicenow-integration}

This integration, developed by ServiceNow engineering, enables you to import current Palo Alto Prisma AIRS data into your ServiceNow AI Platform instance. With this imported data, you can see how AI security scans and model validation results are tracked so you can evaluate your exposure to AI-related vulnerabilities.

## How it works {#prisma-airs-integration__how-it-works}

* A user with the required role configures the connection to Prisma AIRS through a dedicated configuration UI. The user provides the API URL, Client ID, Client Secret, TSG ID, and Auth URL. These credentials are validated and then securely saved in the instance parameters for future use by the integration.
* The integration can be executed manually or scheduled to run automatically to pull scan results and model validation data from Prisma AIRS into your ServiceNow AI Platform instance.
* After the data is imported, it is validated and processed automatically through transform maps.
* You view the processed data mapped to records in modules created for this integration under AI Security.
{#prisma-airs-integration__ul_kpp_4tf_tkc}

## Data retrieved from the integration {#prisma-airs-integration__retrieved-data-types}

This integration retrieves three types of data from the Palo Alto Prisma AIRS integration:

AI Security Scans
:   Detects vulnerabilities in AI model files, such as malicious code in serialized models including Keras Lambda layers with dangerous patterns.

Model Validation Results
:   Tests performed on AI models against various attack scenarios to identify weaknesses, including prompts, responses, and threat signatures.

Red Team Scan Guardrails
:   Guardrail policy configuration applied during Red Team scans, including the policy identifier, name, and configuration for each guardrail.

Scan findings, posture findings, and validation findings are stored in the AI Security Exposures module.

## Prerequisites {#prisma-airs-integration__prerequisites}

ServiceNow plugins required:

* Vulnerability Response Integration Framework (sn_vul_int_fw)
* AI Security (sn_sec_ai)

{#prisma-airs-integration__ul_lpp_4tf_tkc}

Prisma AIRS account requirements:

* Active Prisma AIRS subscription
* Client ID
* Client Secret
* API base URL
* Authorization URL
* Palo Alto Prisma tenant service group (TSG) ID
{#prisma-airs-integration__ul_mpp_4tf_tkc}
* **[Install the Vulnerability Response integration with Palo Alto Prisma AIRS](https://www.servicenow.com/docs/nBOANPpYJPRf8zW9zV8O8w)**   
  Use this task to set up the Vulnerability Response integration with Palo Alto Prisma AIRS and import AI security scan results, posture findings, and model validation data into your ServiceNow AI Platform® instance.
* **[Viewing imported data for the Vulnerability Response Integration with Palo Alto Prisma AIRS](https://www.servicenow.com/docs/DMP8RpiV1prZit1T5bQ~Jw)**   
  View and work with imported data from the Vulnerability Response Integration with Palo Alto Prisma AIRS integration on records and dashboards in your ServiceNow AI Platform instance.
* **[Field mapping for the Prisma AIRS integration](https://www.servicenow.com/docs/MtkYzLVnXKAqPkVs3M687g)**   
  These tables map Prisma AIRS payload fields to target tables and columns in your ServiceNow ServiceNow AI Platform instance.