Which configuration needs to be done to perform user entity behavior analysis with Prisma Public Cloud?

Question

Options

• ACreate alert rules.
• BWhitelist IP addresses.
• CConfigure User-ID.
• DDefine enterprise settings.

• A
  2% (1)
• B
  7% (3)
• C
  2% (1)
• D
  89% (39)

Explanation

Defining enterprise settings in Prisma Cloud is the required step to enable and configure User and Entity Behavior Analytics (UEBA), as this is where you set the anomaly detection training period and sensitivity thresholds that drive the ML-based behavioral analysis engine.

• A (Alert rules) is wrong because alert rules control notification routing for policy violations - they don't activate or configure the UEBA feature itself.
• B (Whitelist IP addresses) is a related but downstream step - you can exclude trusted IPs from anomaly alerts after UEBA is configured, not as a prerequisite to enabling it.
• C (Configure User-ID) is a Palo Alto Networks firewall feature for IP-to-user mapping; it has no role in Prisma Public Cloud UEBA setup.

Memory tip: Think of Enterprise Settings as the "master control panel" for tenant-wide intelligence features - if a feature affects the whole organization's behavioral baseline (like UEBA), it lives there, not in per-policy or per-alert configs.

No community discussion yet for this question.