---
sourceDocument: Brazil Security Management
sourceDocumentLink: https://www.servicenow.com/docs/r/security-management

 Release :

    - brazil

ft:locale :

    - en-US

ft:publication_title :

    - Brazil Security Management

ft:clusterId :

    - security

bundleId :

    - security

workflow :

    - Technology


---

# Palo Alto Prisma AIRS Integration for AI Security Exposure Management

# Palo Alto Prisma AIRS integration {#ariaid-title1}

Release version: Brazil  
Updated September 30, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 2 minutes to read  
The Vulnerability Response Integration with Palo Alto Prisma AIRS imports AI security scan results, posture findings, and model validation data into your ServiceNow AI Platform instance. Use the data to help you detect security risks, drive remediation workflows, and verify compliance with AI security requirements.

## Prisma AI Runtime Security (AIRS) {#prisma-airs-integration__what-is-prisma-airs}

Palo Alto Networks' Prisma AIRS (AI Runtime Security) is a security platform that discovers, monitors, and protects AI models, APIs, and data pipelines across an organization. It provides risk assessment, data leakage
prevention, prompt injection defense, and runtime anomaly detection for AI deployments.

## Prisma AIRS AI Red Teaming {#prisma-airs-integration__what-is-ai-red-teaming}

AI Red Teaming is a Prisma AIRS capability that automatically simulates adversarial attacks against AI models --- including prompt injection, jailbreaks, bias, toxicity, and hallucination --- and maps findings to frameworks such
as OWASP LLM Top 10 and MITRE ATLAS. It helps organizations proactively identify and fix AI security weaknesses before attackers can exploit them.

## The ServiceNow AI Platform Prisma AIRS integration {#prisma-airs-integration__servicenow-integration}

This integration, developed by ServiceNow engineering, enables you to import current Palo Alto Prisma AIRS data into your ServiceNow AI Platform instance. With this imported data, you can see how AI security scans and model validation results are tracked so you can evaluate your exposure to AI-related vulnerabilities.

## How it works {#prisma-airs-integration__how-it-works}

* A user with the required role configures the connection to Prisma AIRS through a dedicated configuration UI. The user provides the API URL, Client ID, Client Secret, TSG ID, and Auth URL. These credentials are validated and then securely saved in the instance parameters for future use by the integration.
* The integration can be executed manually or scheduled to run automatically to pull scan results and model validation data from Prisma AIRS into your ServiceNow AI Platform instance.
* After the data is imported, it is validated and processed automatically through transform maps.
* You view the processed data mapped to records in modules created for this integration under AI Security.
{#prisma-airs-integration__ul_kpp_4tf_tkc}

## Data retrieved from the integration {#prisma-airs-integration__retrieved-data-types}

This integration retrieves three types of data from the Palo Alto Prisma AIRS integration:

AI Security Scans
:   Detects vulnerabilities in AI model files, such as malicious code in serialized models including Keras Lambda layers with dangerous patterns.

Model Validation Results
:   Tests performed on AI models against various attack scenarios to identify weaknesses, including prompts, responses, and threat signatures.

Red Team Scan Guardrails
:   Guardrail policy configuration applied during Red Team scans, including the policy identifier, name, and configuration for each guardrail.

Scan findings, posture findings, and validation findings are stored in the AI Security Exposures module.

## Prerequisites {#prisma-airs-integration__prerequisites}

ServiceNow plugins required:

* Vulnerability Response Integration Framework (sn_vul_int_fw)
* AI Security (sn_sec_ai)

{#prisma-airs-integration__ul_lpp_4tf_tkc}

Prisma AIRS account requirements:

* Active Prisma AIRS subscription
* Client ID
* Client Secret
* API base URL
* Authorization URL
* Palo Alto Prisma tenant service group (TSG) ID
{#prisma-airs-integration__ul_mpp_4tf_tkc}