[PRISMA] Prisma Access User Registered

alert any $HOME_NET any -> $HOME_NET any (msg:"[PRISMA] Prisma Access User Registered"; program:prisma; json_content:".LogType","USERID"; json_content:".Subtype","register-tag"; parse_src_ip:1; normalize; reference:url,https://docs.paloaltonetworks.com/prisma-access/administration/monitor/prisma-access-logs; classtype:user-activity; sid:5017148; rev:1; metadata:deployment Endpoint,affected_product NONE,affected_version NONE,mitigation NONE,deprecation_reason NONE,tag NONE, created_at 2025_07_28, updated_at 2025_07_28, mitre_tactic_id TA0001, mitre_technique_id T1078;)