[PRISMA] Prisma Access Malicious URL Access - Critical Severity

alert any $HOME_NET any -> $HOME_NET any (msg:"[PRISMA] Prisma Access Malicious URL Access - Critical Severity"; program:prisma; json_content:".LogType","THREAT"; json_content:".Subtype","url"; json_content:".VendorSeverity","Critical"; json_meta_content:".Action",alert,allow; parse_src_ip:1; parse_dst_ip:2; json_map:"username",".URL"; normalize; threshold: type suppress, track by_src&by_username, count 1, seconds 3600; reference:url,https://docs.paloaltonetworks.com/prisma-access/administration/monitor/prisma-access-logs; classtype:web-application-activity; sid:5017090; rev:2; metadata:deployment Endpoint,affected_product NONE,affected_version NONE,mitigation NONE,deprecation_reason NONE,tag NONE, created_at 2025_07_28, updated_at 2026_04_08, mitre_tactic_id TA0011, mitre_technique_id T1071;)