SSE Engineer key terms

A converged cloud-delivered security model that bundles secure web gateway, cloud access security broker, zero trust network access, and firewall-as-a-service capabilities to protect access to SaaS, internet, and private applications regardless of user location.

A control that inspects and filters user web traffic, enforcing URL category, threat, file, and content policies to block malicious or noncompliant browsing before it reaches the internet or the user.

An inline or API-based control that discovers sanctioned and unsanctioned SaaS usage, enforces data controls, and provides visibility into cloud application activity and shadow IT risk.

An access model that grants users least-privilege connectivity to specific private applications after identity and device checks, rather than placing them on a flat network segment.

Cloud-delivered Layer 3 through Layer 7 policy enforcement that applies App-ID, User-ID, and threat inspection to traffic egressing branch, mobile, and remote users without on-premises appliances.

Cloud applications and services used by employees without IT approval or oversight, creating data exposure and compliance risk that CASB discovery is designed to surface and control.

Continuous assessment of cloud application configurations, sharing settings, and tenant permissions to detect risky misconfigurations and data exposure inside sanctioned applications.

The practice of granting only the access rights and application permissions a user or device needs for a task, reducing lateral movement and blast radius if credentials are compromised.

Policy and inspection that detects sensitive content such as credit card numbers or personal identifiers in traffic and files, then blocks, alerts, or quarantines according to rule action.

A cloud-delivered security platform that runs Palo Alto Networks next-generation firewall and SSE capabilities from distributed service infrastructure, protecting remote users, branches, and cloud workloads.

An encrypted IPsec or GRE link between a customer's network or cloud environment and the Prisma Access infrastructure, carrying traffic that requires private application or egress security processing.

A branch or data center location onboarded to Prisma Access through a service connection so its users and devices receive consistent security policy and internet egress.

A remote worker whose endpoint runs GlobalProtect to establish an encrypted tunnel to a Prisma Access gateway, receiving policy enforcement wherever they connect.

The endpoint agent and gateway framework that authenticates users, checks device posture, and builds an encrypted tunnel so remote traffic is steered to Prisma Access security processing.

A Host Information Profile collects endpoint attributes such as disk encryption, patch level, and antivirus state, letting policy allow, block, or restrict access based on device compliance.

Palo Alto Networks traffic classification that identifies applications by signature and behavioral analysis regardless of port, protocol, or encryption, enabling precise allow and deny decisions.

Identity mapping that associates IP addresses with users and groups from directories, agents, or cloud identity providers so policy and logging can be written against people rather than addresses.

An ordered statement matching source, destination, user, application, and service that specifies allow or deny and which security profiles and logging options apply to matching traffic.

A named bundle of vulnerability, antispyware, antivirus, anti-phishing, URL filtering, file blocking, and data filtering profiles attached to a rule for consistent threat inspection.

Decryption mode where the firewall impersonates the destination server with a certificate signed by a trusted forward trust CA, allowing inspection of outbound encrypted sessions.

Decryption of traffic destined to an internal server using that server's own certificate and private key, commonly applied to protect published applications from encrypted attacks.

Rules that determine which encrypted sessions are decrypted, bypassed, or blocked based on URL category, source, destination, and certificate-pinning exceptions, placed before security rules.

Classification of web requests into categories and risk levels so policy can allow, block, continue, or warn, with inline logging and credential-submission controls for sensitive sites.

Cloud analysis of DNS queries that blocks domains associated with malware, phishing, and command-and-control infrastructure, including newly registered and algorithmically generated domains.

Inline detection of exploits, malware, and command-and-control traffic using signatures, behavioral analysis, and machine learning, including unknown threat detection for previously unseen attacks.

A cloud sandbox service that detonates suspicious files and links, derives signatures from malicious behavior, and shares verdicts with subscribed firewalls for prevention.

A standards-based encrypted connection using IKE and ESP that protects traffic between a customer gateway and Prisma Access, defined by proposals, keys, and selectors.

Configuration object defining the internet key exchange peer address, pre-shared key or certificate, version, and proposals used to negotiate an IPsec tunnel.

Rules and configurations that decide which user, application, or subnet traffic is sent to Prisma Access versus sent directly, typically via GlobalProtect split tunnel or routing policy.

A GlobalProtect setting that sends only specified routes or application traffic through the tunnel while other traffic goes directly to the internet, balancing security and performance.

A logical grouping of interfaces and subnets that share policy and trust characteristics, used as a match criterion in rules and to separate user, partner, and data center traffic.

The Prisma Access cloud locations and public addresses that terminate tunnels and process traffic; onboarding selects regions and compute locations that determine latency and egress geography.

A Prisma Access deployment choice determining where security processing and egress occur for mobile users or remote networks, affecting performance, content localization, and compliance.

The centralized management platform used to configure, push, and monitor Prisma Access policy, device groups, templates, and logs across cloud and on-premises firewalls.

Configuration that sends traffic, threat, URL, and decryption logs from Prisma Access to external destinations such as Cortex Data Lake, syslog, or an SIEM for retention and analysis.

A cloud logging and analytics service that stores Prisma Access logs and provides search, dashboards, and application visibility across the deployed estate.

Linking related events such as threat alerts, user activity, and traffic records across time and sources to reconstruct an incident and determine scope and impact.

The workflow that validates and deploys configuration changes from Panorama to Prisma Access infrastructure; incomplete or failed pushes leave cloud policy in its prior state.

Diagnosing connectivity by checking IKE and IPsec state, proposal mismatches, routing, and service connection health before assuming a policy problem.