Palo Alto Networks Prisma AIRS - AI Red Teaming

Discover and remediate AI application vulnerabilities with Palo Alto Networks Prisma AIRS AI Red Teaming: manage targets and adapters, run and monitor red-team scans, review attack reports and remediation guidance, and curate prompt sets and custom attacks.
This integration was integrated and tested with the Palo Alto Networks Prisma AIRS AI Red Teaming API as of June 2026.

Supported Capabilities

• Targets & Adapters: Register, profile, and validate red-team targets and their protocol adapters
• Scans: Launch, list, monitor, and abort red-team scans
• Attack Reports: Review attack outcomes, multi-turn transcripts, remediation, and runtime policy guidance
• Prompt Sets & Prompts: Create, version, and curate custom prompt sets and prompts
• Custom Attacks & Properties: Manage custom-attack reports, properties, and network broker channels

Configure Palo Alto Networks Prisma AIRS - AI Red Teaming in Cortex

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

prisma-airs-redteam-targets-list

List all Red Team targets.

Base Command

prisma-airs-redteam-targets-list

Input

Context Output

Command example

!prisma-airs-redteam-targets-list

Context Example

[
    {
        "active": true,
        "api_endpoint_type": "PRIVATE",
        "auth_type": null,
        "connection_type": "CUSTOM",
        "created_at": "2026-05-29T14:45:35.612826Z",
        "created_by_user_id": "59087f43-bd63-4d7d-940d-2ff5dd9382b3",
        "description": "",
        "name": "example-app-3",
        "response_mode": "REST",
        "session_supported": false,
        "status": "ACTIVE",
        "target_type": "APPLICATION",
        "tsg_id": "1234567",
        "updated_at": "2026-06-18T08:48:37.181752Z",
        "updated_by_user_id": "59087f43-bd63-4d7d-940d-2ff5dd9382b3",
        "uuid": "c5503ac6-321c-4ae0-bf0b-3dc81907972a",
        "validated": true
    },
    {
        "active": true,
        "api_endpoint_type": "PRIVATE",
        "auth_type": null,
        "connection_type": "CUSTOM",
        "created_at": "2026-05-08T18:50:08.580115Z",
        "created_by_user_id": "59087f43-bd63-4d7d-940d-2ff5dd9382b3",
        "description": "",
        "name": "example-app-4",
        "response_mode": "REST",
        "session_supported": false,
        "status": "ACTIVE",
        "target_type": "APPLICATION",
        "tsg_id": "1234567",
        "updated_at": "2026-06-18T08:48:36.480068Z",
        "updated_by_user_id": "59087f43-bd63-4d7d-940d-2ff5dd9382b3",
        "uuid": "8ecef265-89db-4f75-a322-2853f068647d",
        "validated": true
    }
]

Human Readable Output

Prisma AIRs Red Team Targets

Uuid	Name	Target Type	Status	Active	Validated	Created At
c5503ac6-321c-4ae0-bf0b-3dc81907972a	example-app-3	APPLICATION	ACTIVE	true	true	2026-05-29T14:45:35.612826Z
8ecef265-89db-4f75-a322-2853f068647d	example-app-4	APPLICATION	ACTIVE	true	true	2026-05-08T18:50:08.580115Z

prisma-airs-redteam-targets-create

Create a new Red Team target.

Base Command

prisma-airs-redteam-targets-create

Input

Context Output

prisma-airs-redteam-targets-get

Get Red Team target details by UUID.

Base Command

prisma-airs-redteam-targets-get

Input

Context Output

prisma-airs-redteam-targets-update

Update an existing Red Team target.

Base Command

prisma-airs-redteam-targets-update

Input

Context Output

prisma-airs-redteam-targets-delete

Delete a Red Team target.

Base Command

prisma-airs-redteam-targets-delete

Input

Context Output

prisma-airs-redteam-targets-probe

Probe a Red Team target to validate connectivity and gather profiling data.

Base Command

prisma-airs-redteam-targets-probe

Input

Context Output

prisma-airs-redteam-targets-profile

Get Red Team target profile (background, context, profiling status). View detailed profiling information including background context and AI-generated fields.

Base Command

prisma-airs-redteam-targets-profile

Input

Context Output

prisma-airs-redteam-targets-update-profile

Update Red Team target profile (background and additional context). Modify target background information or add additional context like model details and supported languages.

Base Command

prisma-airs-redteam-targets-update-profile

Input

Context Output

prisma-airs-redteam-targets-metadata

Get Red Team target field metadata. Returns field definitions (types, requirements, constraints) for all available target configuration fields. Useful for understanding what fields can be configured when creating or updating targets.

Base Command

prisma-airs-redteam-targets-metadata

Input

There are no input arguments for this command.

Context Output

prisma-airs-redteam-targets-validate-auth

Validate authentication credentials for a Red Team target provider without creating or modifying a target. Useful for verifying credentials before creating a target. The server proxies the credentials against the target provider’s endpoint, so valid live credentials (and typically a target_id) are required for a successful validation.

Base Command

prisma-airs-redteam-targets-validate-auth

Input

Context Output

Command example

!prisma-airs-redteam-targets-validate-auth auth_type="HEADERS" auth_config=`{"headers":{"Authorization":"Bearer sk-your-api-key"}}` target_id="1b127819-8e52-4b38-aaab-4a967e107fe9"

Human Readable Output

Red Team Target Auth Validation

Auth Type	Validated	Token Preview	Expires In
HEADERS	true	sk-***xyz	3600

prisma-airs-redteam-targets-templates

List Red Team target configuration templates per provider. Each template describes the connection fields expected for that target provider type. Read-only.

Base Command

prisma-airs-redteam-targets-templates

Input

There are no input arguments for this command.

Context Output

Command example

!prisma-airs-redteam-targets-templates

Human Readable Output

Red Team Target Templates

Provider	Fields
OPENAI	id, name, is_custom, url, request_json, file_request_json, response_json
HUGGING_FACE	id, name, is_custom, url, request_json, response_json
DATABRICKS	id, name, is_custom, url, request_json, response_json
BEDROCK	id, name, is_custom, url, request_json, file_request_json, response_json
REST	id, name, is_custom, url, request_json, file_request_json, response_json
STREAMING	id, name, url, is_custom, request_json, file_request_json, response_json
WEBSOCKET	id, name, is_custom, url, request_json, file_request_json, response_json, streaming_request_json, streaming_response_json
MS_COPILOT_STUDIO	id, name, is_custom
CUSTOM_TARGET_ADAPTER	id, name, is_custom

prisma-airs-redteam-targets-error-logs

List target-profile (profiling) error logs for a Red Team target. Returns the failures recorded while Prisma AIRS was probing or profiling the target (for example, connection, probe, or authentication errors).

Base Command

prisma-airs-redteam-targets-error-logs

Input

Context Output

Command example

!prisma-airs-redteam-targets-error-logs target_id=550e8400-e29b-41d4-a716-446655440000 limit=10

Human Readable Output

Red Team Target-Profile Error Logs: 550e8400-e29b-41d4-a716-446655440000 (1 total)

Created At	Error Type	Error Source	Error Message	Job Id	Attack Id
2026-01-01T00:00:00Z	PROBE	profiler	connection refused

prisma-airs-redteam-scan-error-logs

List job-level error logs for a Red Team scan. Returns the per-attack probe failures recorded while a scan job was running (for example, timeouts or target connection or authentication errors), scoped to a single scan job.

Base Command

prisma-airs-redteam-scan-error-logs

Input

Context Output

Command example

!prisma-airs-redteam-scan-error-logs job_id=16c3d68d-95ba-43fd-b3f3-7de463ac051f limit=10

Human Readable Output

Red Team Scan Error Logs: 16c3d68d-95ba-43fd-b3f3-7de463ac051f (9 total)

Created At	Error Type	Error Source	Error Message	Attack Id	Target Id
2026-08-19T18:59:13.501823Z	UNKNOWN	JOB	Empty output received from target	fd9fe836-c938-4df4-ace8-54b60065350c	1b127819-8e52-4b38-aaab-4a967e107fe9
2026-08-19T18:58:48.585288Z	UNKNOWN	JOB	Empty output received from target	1c7e8bf1-3e91-48c1-a227-a861ccb2486f	1b127819-8e52-4b38-aaab-4a967e107fe9

prisma-airs-redteam-dashboard-scan-statistics

Get Red Team scan statistics and risk profile (dashboard telemetry). Returns aggregate scan counts and, when available, breakdowns by target type, scan status, and risk rating.

Base Command

prisma-airs-redteam-dashboard-scan-statistics

Input

Context Output

Command example

!prisma-airs-redteam-dashboard-scan-statistics

Human Readable Output

Red Team Scan Statistics

Total Scans	Targets Scanned
79	20

Scan Status

Name	Count
IN_PROGRESS	1
COMPLETED	78

Risk Profile

Risk Rating	Total
CRITICAL	0
HIGH	0
MEDIUM	0
LOW	20

prisma-airs-redteam-dashboard-score-trend

Get the Red Team risk score trend for a target (dashboard telemetry). Returns time-bucketed labels plus one or more data series showing how the target’s score changed over time.

Base Command

prisma-airs-redteam-dashboard-score-trend

Input

Context Output

Command example

!prisma-airs-redteam-dashboard-score-trend target_id=1b127819-8e52-4b38-aaab-4a967e107fe9

Human Readable Output

Red Team Score Trend: 1b127819-8e52-4b38-aaab-4a967e107fe9

series	2026-04	2026-05
risk	42	38

prisma-airs-redteam-metering-quota

Get the Red Team metering quota summary. Returns the allocated, consumed, and unlimited flags for each quota bucket (static, dynamic, and custom).

Base Command

prisma-airs-redteam-metering-quota

Input

There are no input arguments for this command.

Context Output

Command example

!prisma-airs-redteam-metering-quota

Human Readable Output

Red Team Metering Quota

Quota Type	Allocated	Consumed	Unlimited
static	100	5	false
dynamic	50	2	false
custom	0	0	true

prisma-airs-redteam-dashboard-overview

Get the Red Team management dashboard overview. Returns the total target count and, when available, a breakdown of targets by type.

Base Command

prisma-airs-redteam-dashboard-overview

Input

There are no input arguments for this command.

Context Output

Command example

!prisma-airs-redteam-dashboard-overview

Human Readable Output

Red Team Dashboard Overview

Total Targets
24

Targets by Type

Name	Count
AGENT	0
APPLICATION	24
MODEL	0

prisma-airs-redteam-instances-create

Create a new Red Team tenant instance.

Base Command

prisma-airs-redteam-instances-create

Input

Context Output

Command example

!prisma-airs-redteam-instances-create tsg_id=tsg-12345 tenant_id=tn-67890 app_id=app-abcde region=us tenant_instance_name="Production Instance"

Human Readable Output

Red Team Instance Created: tn-67890

Tenant Id	Tsg Id	App Id	Is Success
tn-67890	tsg-12345	app-abcde	true

prisma-airs-redteam-instances-get

Get a Red Team tenant instance by tenant ID.

Base Command

prisma-airs-redteam-instances-get

Input

Context Output

Command example

!prisma-airs-redteam-instances-get tenant_id=tn-67890

Human Readable Output

Red Team Instance: Production Instance

Tenant Id	Tsg Id	App Id	Region	Tenant Instance Name	Created By
tn-67890	tsg-12345	app-abcde	us	Production Instance	admin@example.com

prisma-airs-redteam-instances-update

Update an existing Red Team tenant instance.

Base Command

prisma-airs-redteam-instances-update

Input

Context Output

Command example

!prisma-airs-redteam-instances-update tenant_id=tn-67890 tenant_instance_name="Renamed Instance"

Human Readable Output

Red Team Instance Updated: tn-67890

Tenant Id	Tsg Id	App Id	Is Success
tn-67890	tsg-12345	app-abcde	true

prisma-airs-redteam-instances-delete

Delete a Red Team tenant instance. This permanently removes the instance and cannot be undone.

Base Command

prisma-airs-redteam-instances-delete

Input

Context Output

Command example

!prisma-airs-redteam-instances-delete tenant_id=tn-67890

Human Readable Output

Red Team Instance Deleted: tn-67890

Tenant Id	Tsg Id	App Id	Is Success
tn-67890	tsg-12345	app-abcde	true

prisma-airs-redteam-devices-create

Create one or more devices on a Red Team tenant instance. Provide a single device with serial_number, or a batch with the devices JSON array (maximum 5). The parent instance’s app_id/region/tsg_id are resolved automatically from the tenant_id when not supplied.

Base Command

prisma-airs-redteam-devices-create

Input

Context Output

Command example

!prisma-airs-redteam-devices-create tenant_id=tn-67890 serial_number=SN-0001 device_name="Edge GW 1"

Human Readable Output

Red Team Devices Created: tn-67890

Serial Number	Status
SN-0001	CREATED

prisma-airs-redteam-devices-update

Update one or more devices on a Red Team tenant instance. Provide a single device with serial_number, or a batch with the devices JSON array (maximum 5).

Base Command

prisma-airs-redteam-devices-update

Input

Context Output

Command example

!prisma-airs-redteam-devices-update tenant_id=tn-67890 serial_number=SN-0001 device_name="Edge GW 1 (renamed)"

Human Readable Output

Red Team Devices Updated: tn-67890

Serial Number	Status
SN-0001	UPDATED

prisma-airs-redteam-devices-delete

Delete one or more devices from a Red Team tenant instance by serial number. This permanently removes the devices and cannot be undone.

Base Command

prisma-airs-redteam-devices-delete

Input

Context Output

Command example

!prisma-airs-redteam-devices-delete tenant_id=tn-67890 serial_numbers=SN-0001,SN-0002

Human Readable Output

Red Team Devices Deleted: tn-67890

Serial Number	Status
SN-0001	DELETED
SN-0002	DELETED

prisma-airs-redteam-adapters-list

List Red Team custom target adapters. List rows carry no script, description, or variables - use prisma-airs-redteam-adapters-get for the full record.

Base Command

prisma-airs-redteam-adapters-list

Input

Context Output

Command example

!prisma-airs-redteam-adapters-list search=keycloak

Human Readable Output

Prisma AIRs Red Team Adapters

Uuid	Name	Status	Target Count	Created At	Updated At
3073d369-12e2-46c9-a45a-5697041fcbbf	keycloak-agent	ACTIVE	2	2026-08-10T12:00:00Z	2026-08-12T09:30:00Z

prisma-airs-redteam-adapters-get

Get a single Red Team custom target adapter by UUID, including its script, variables, and configuration.

Base Command

prisma-airs-redteam-adapters-get

Input

Context Output

Command example

!prisma-airs-redteam-adapters-get uuid=3073d369-12e2-46c9-a45a-5697041fcbbf

Human Readable Output

Red Team Adapter: keycloak-agent

Uuid	Name	Status	Description	Network Broker Channel Uuid	Target Count	Created At
3073d369-12e2-46c9-a45a-5697041fcbbf	keycloak-agent	ACTIVE	Keycloak-fronted agent	550e8400-e29b-41d4-a716-446655440000	2	2026-08-10T12:00:00Z

prisma-airs-redteam-adapters-create

Create a new Red Team custom target adapter. By default the script is run end-to-end during save (validate=true) and the adapter is saved as ACTIVE on success or DRAFT on failure. Provide the script via either the script or script_b64 argument.

Base Command

prisma-airs-redteam-adapters-create

Input

Context Output

Command example

!prisma-airs-redteam-adapters-create name="keycloak-agent" prompt="What is the capital of France?" script="print('hi')" network_broker_channel_uuid=550e8400-e29b-41d4-a716-446655440000 variables=`[{"key":"endpoint","value":"http://agent.svc:8080","type":"VAR"},{"key":"api_key","value":"s3cret","type":"SECRET"}]`

Human Readable Output

Red Team Adapter Created: keycloak-agent

Uuid	Name	Status	Network Broker Channel Uuid	Target Count	Created At
3073d369-12e2-46c9-a45a-5697041fcbbf	keycloak-agent	ACTIVE	550e8400-e29b-41d4-a716-446655440000	0	2026-08-17T12:00:00Z

prisma-airs-redteam-adapters-update

Update a Red Team custom target adapter. The upstream update is a full replacement, so the prompt argument is always required, and the variables argument (when provided) defines the complete desired variable set (omitted keys are deleted). Fields not provided are preserved from the current record; stored secrets are kept when their variables are resent unchanged.

Base Command

prisma-airs-redteam-adapters-update

Input

Context Output

Command example

!prisma-airs-redteam-adapters-update uuid=3073d369-12e2-46c9-a45a-5697041fcbbf prompt="What is the capital of France?" description="points at staging now"

Human Readable Output

Red Team Adapter Updated: keycloak-agent

Uuid	Name	Status	Network Broker Channel Uuid	Target Count	Updated At
3073d369-12e2-46c9-a45a-5697041fcbbf	keycloak-agent	ACTIVE	550e8400-e29b-41d4-a716-446655440000	2	2026-08-17T13:00:00Z

prisma-airs-redteam-adapters-delete

Delete a Red Team custom target adapter by UUID. This permanently removes the adapter and cannot be undone.

Base Command

prisma-airs-redteam-adapters-delete

Input

Context Output

Command example

!prisma-airs-redteam-adapters-delete uuid=3073d369-12e2-46c9-a45a-5697041fcbbf

Human Readable Output

Red Team Adapter Deleted: 3073d369-12e2-46c9-a45a-5697041fcbbf

Uuid	Is Success
3073d369-12e2-46c9-a45a-5697041fcbbf	true

prisma-airs-redteam-adapters-validate

Validate a Red Team custom target adapter script end-to-end through a network broker channel without saving anything. Returns the execution outcome (validated plus stdout/stderr/traceback), not an adapter record. The channel must be ONLINE.

Base Command

prisma-airs-redteam-adapters-validate

Input

Context Output

Command example

!prisma-airs-redteam-adapters-validate network_broker_channel_uuid=550e8400-e29b-41d4-a716-446655440000 prompt="Hello" script="print('hi')"

Human Readable Output

Red Team Adapter Validation

Validated	Stdout
true	ok

prisma-airs-redteam-scan-create

Create a new Red Team scan job. This command submits the scan and returns immediately without polling. Use prisma-airs-redteam-scan-get to check status.

Base Command

prisma-airs-redteam-scan-create

Input

Context Output

prisma-airs-redteam-scans-list

List all Red Team scans.

Base Command

prisma-airs-redteam-scans-list

Input

Context Output

Command example

!prisma-airs-redteam-scans-list

Context Example

[
    {
        "completed_at": null,
        "completed_prompts": null,
        "created_at": "2026-06-25T20:38:45.952083Z",
        "error_message": null,
        "failed_prompts": null,
        "job_type": "STATIC",
        "progress": null,
        "started_at": null,
        "status": "COMPLETED",
        "target_name": null,
        "target_uuid": null,
        "total_prompts": null,
        "tsg_id": "1234567",
        "updated_at": "2026-06-25T23:46:48.539865Z",
        "uuid": "61bac5ed-86a0-434e-bea9-79a191327e72"
    },
    {
        "completed_at": null,
        "completed_prompts": null,
        "created_at": "2026-06-22T20:01:00.197521Z",
        "error_message": null,
        "failed_prompts": null,
        "job_type": "STATIC",
        "progress": null,
        "started_at": null,
        "status": "COMPLETED",
        "target_name": null,
        "target_uuid": null,
        "total_prompts": null,
        "tsg_id": "1234567",
        "updated_at": "2026-06-22T20:17:23.809673Z",
        "uuid": "86c3cef3-768d-4438-9550-6a2188173369"
    }
]

Human Readable Output

Prisma AIRs Red Team Scans

Uuid	Job Type	Status	Target Name	Progress	Created At
61bac5ed-86a0-434e-bea9-79a191327e72	STATIC	COMPLETED			2026-06-25T20:38:45.952083Z
86c3cef3-768d-4438-9550-6a2188173369	STATIC	COMPLETED			2026-06-22T20:01:00.197521Z

prisma-airs-redteam-scan-get

Get Red Team scan status and details by job ID.

Base Command

prisma-airs-redteam-scan-get

Input

Context Output

prisma-airs-redteam-scan-abort

Abort a running Red Team scan.

Base Command

prisma-airs-redteam-scan-abort

Input

Context Output

prisma-airs-redteam-categories-list

List all Red Team attack categories and subcategories.

Base Command

prisma-airs-redteam-categories-list

Input

There are no input arguments for this command.

Context Output

Command example

!prisma-airs-redteam-categories-list

Context Example

[
    {
        "description": "Select categories for adversarial testing of security vulnerabilities and potential exploits.",
        "display_name": "Security",
        "id": "SECURITY",
        "preselect": true,
        "sub_categories": [
            {
                "active": true,
                "description": "Adversarial suffix attacks",
                "display_name": "Adversarial Suffix",
                "id": "ADVERSARIAL_SUFFIX",
                "preselect": true
            },
            {
                "active": true,
                "description": "Evasion techniques",
                "display_name": "Evasion",
                "id": "EVASION",
                "preselect": true
            },
            {
                "active": true,
                "description": "Indirect prompt injection attacks",
                "display_name": "Indirect Prompt Injection",
                "id": "INDIRECT_PROMPT_INJECTION",
                "preselect": false
            },
            {
                "active": true,
                "description": "Jailbreak attempts",
                "display_name": "Jailbreak",
                "id": "JAILBREAK",
                "preselect": true
            },
            {
                "active": false,
                "description": "Multi-turn conversation exploits",
                "display_name": "Multi-turn",
                "id": "MULTI_TURN",
                "preselect": false
            },
            {
                "active": true,
                "description": "Direct prompt injection attacks",
                "display_name": "Prompt Injection",
                "id": "PROMPT_INJECTION",
                "preselect": true
            },
            {
                "active": true,
                "description": "Remote code execution attempts",
                "display_name": "Remote Code Execution",
                "id": "REMOTE_CODE_EXECUTION",
                "preselect": true
            },
            {
                "active": true,
                "description": "System prompt extraction",
                "display_name": "System Prompt leak",
                "id": "SYSTEM_PROMPT_LEAK",
                "preselect": true
            },
            {
                "active": true,
                "description": "Tool information leakage",
                "display_name": "Tool Leak",
                "id": "TOOL_LEAK",
                "preselect": false
            },
            {
                "active": true,
                "description": "Malware generation requests",
                "display_name": "Malware Generation",
                "id": "MALWARE_GENERATION",
                "preselect": true
            }
        ],
        "sub_category_count": 10
    },
    {
        "description": "Select categories for testing harmful or toxic content and ethical misuse scenarios.",
        "display_name": "Safety",
        "id": "SAFETY",
        "preselect": true,
        "sub_categories": [
            {
                "active": true,
                "description": "Bias-related content",
                "display_name": "Bias",
                "id": "BIAS",
                "preselect": true
            },
            {
                "active": true,
                "description": "Chemical, Biological, Radiological, Nuclear content",
                "display_name": "CBRN",
                "id": "CBRN",
                "preselect": true
            },
            {
                "active": true,
                "description": "Cybercrime-related content",
                "display_name": "Cybercrime",
                "id": "CYBERCRIME",
                "preselect": true
            },
            {
                "active": true,
                "description": "Drug-related content",
                "display_name": "Drugs",
                "id": "DRUGS",
                "preselect": true
            },
            {
                "active": true,
         
... (truncated)

Human Readable Output

Red Team Attack Categories

Id	Display Name	Description	Sub Category Count
SECURITY	Security	Select categories for adversarial testing of security vulnerabilities and potential exploits.	10
SAFETY	Safety	Select categories for testing harmful or toxic content and ethical misuse scenarios.	10
BRAND	Brand Reputation	Select categories for testing off-brand content.	4
COMPLIANCE	Compliance	Select framework to understand compliance across security and safety standards.	4

prisma-airs-redteam-network-channels-list

List Red Team network broker channels. Network channels are the data-plane relays that connect Red Team clients to targets.

Base Command

prisma-airs-redteam-network-channels-list

Input

Context Output

Command example

!prisma-airs-redteam-network-channels-list status=ONLINE,DRAFT limit=10

Context Example

[
    {
        "created_at": "2026-04-14T10:22:00Z",
        "description": "Production network broker channel",
        "last_online_at": "2026-04-20T18:03:11Z",
        "name": "prod-relay",
        "status": "ONLINE",
        "updated_at": "2026-04-20T18:03:11Z",
        "uuid": "550e8400-e29b-41d4-a716-446655440000"
    }
]

Human Readable Output

Prisma AIRs Red Team Network Channels

Uuid	Name	Status	Description	Last Online At	Created At
550e8400-e29b-41d4-a716-446655440000	prod-relay	ONLINE	Production network broker channel	2026-04-20T18:03:11Z	2026-04-14T10:22:00Z

prisma-airs-redteam-network-channels-create

Create a new Red Team network broker channel.

Base Command

prisma-airs-redteam-network-channels-create

Input

Context Output

Command example

!prisma-airs-redteam-network-channels-create name="prod-relay" description="Production network broker channel"

Context Example

{
    "created_at": "2026-04-14T10:22:00Z",
    "description": "Production network broker channel",
    "name": "prod-relay",
    "status": "DRAFT",
    "uuid": "550e8400-e29b-41d4-a716-446655440000"
}

Human Readable Output

Red Team Network Channel Created: prod-relay

Uuid	Name	Status	Description	Created At
550e8400-e29b-41d4-a716-446655440000	prod-relay	DRAFT	Production network broker channel	2026-04-14T10:22:00Z

prisma-airs-redteam-network-channels-stats

Retrieve Red Team network broker channel statistics and deployment info (broker domain, docker registry/image, helm chart, online/total counts).

Base Command

prisma-airs-redteam-network-channels-stats

Input

There are no input arguments for this command.

Context Output

Command example

!prisma-airs-redteam-network-channels-stats

Context Example

{
    "client_version": "1.4.0",
    "docker_image": "images/network-channels-client",
    "docker_registry": "registry.example.com",
    "helm_chart": "charts/network-channels-client",
    "network_channels_server_domain": "broker.example.com/tunnels",
    "online_channels": 3,
    "total_channels": 5
}

Human Readable Output

Prisma AIRs Red Team Network Channel Stats

Network Channels Server Domain	Online Channels	Total Channels	Docker Registry	Docker Image	Helm Chart	Client Version
broker.example.com/tunnels	3	5	registry.example.com	images/network-channels-client	charts/network-channels-client	1.4.0

prisma-airs-redteam-network-channels-get

Get a single Red Team network broker channel by UUID.

Base Command

prisma-airs-redteam-network-channels-get

Input

Context Output

Command example

!prisma-airs-redteam-network-channels-get channel_id="550e8400-e29b-41d4-a716-446655440000"

Context Example

{
    "connected_clients_count": 2,
    "created_at": "2026-04-14T10:22:00Z",
    "description": "Production network broker channel",
    "last_online_at": "2026-04-20T18:03:11Z",
    "name": "prod-relay",
    "outdated_clients_count": 0,
    "status": "ONLINE",
    "updated_at": "2026-04-20T18:03:11Z",
    "uuid": "550e8400-e29b-41d4-a716-446655440000"
}

Human Readable Output

Prisma AIRs Red Team Network Channel

Uuid	Name	Status	Description	Last Online At	Created At	Updated At
550e8400-e29b-41d4-a716-446655440000	prod-relay	ONLINE	Production network broker channel	2026-04-20T18:03:11Z	2026-04-14T10:22:00Z	2026-04-20T18:03:11Z

prisma-airs-redteam-network-channels-update

Update a Red Team network broker channel’s name and/or description. At least one of name or description is required.

Base Command

prisma-airs-redteam-network-channels-update

Input

Context Output

Command example

!prisma-airs-redteam-network-channels-update channel_id="550e8400-e29b-41d4-a716-446655440000" description="Updated description"

Context Example

{
    "description": "Updated description",
    "name": "prod-relay",
    "status": "ONLINE",
    "updated_at": "2026-04-21T09:15:42Z",
    "uuid": "550e8400-e29b-41d4-a716-446655440000"
}

Human Readable Output

Red Team Network Channel Updated: 550e8400-e29b-41d4-a716-446655440000

Uuid	Name	Status	Description	Updated At
550e8400-e29b-41d4-a716-446655440000	prod-relay	ONLINE	Updated description	2026-04-21T09:15:42Z

prisma-airs-redteam-languages-list

List the tenant’s allowed languages for Red Team scans. Queries the data plane by default; set use_management=true to query the management plane. Both planes return the same shape (and, in practice, the same list).

Base Command

prisma-airs-redteam-languages-list

Input

Context Output

Command example

!prisma-airs-redteam-languages-list

Context Example

{
    "languages": [
        {"code": "en", "name": "English"},
        {"code": "fr", "name": "French"},
        {"code": "de", "name": "German"},
        {"code": "hi", "name": "Hindi"},
        {"code": "ja", "name": "Japanese"},
        {"code": "pt", "name": "Portuguese"},
        {"code": "es", "name": "Spanish"},
        {"code": "th", "name": "Thai"}
    ],
    "multilingual_enabled": true,
    "plane": "data",
    "supported_job_types": ["STATIC", "DYNAMIC", "CUSTOM"]
}

Human Readable Output

Prisma AIRs Red Team Supported Languages (multilingual_enabled: True; job types: STATIC, DYNAMIC, CUSTOM)

Code	Name
en	English
fr	French
de	German
hi	Hindi
ja	Japanese
pt	Portuguese
es	Spanish
th	Thai

prisma-airs-redteam-report-get

Get Red Team scan report with attack results and recommendations.

Base Command

prisma-airs-redteam-report-get

Input

Context Output

prisma-airs-redteam-report-attacks-list

List attacks for a Red Team static scan report.

Base Command

prisma-airs-redteam-report-attacks-list

Input

Context Output

prisma-airs-redteam-report-attack-get

Get attack details for a Red Team static scan report.

Base Command

prisma-airs-redteam-report-attack-get

Input

Context Output

prisma-airs-redteam-report-attack-multi-turn-get

Get multi-turn attack details for a Red Team static scan report.

Base Command

prisma-airs-redteam-report-attack-multi-turn-get

Input

Context Output

prisma-airs-redteam-report-remediation-get

Get remediation recommendations for a Red Team scan report.

Base Command

prisma-airs-redteam-report-remediation-get

Input

Context Output

prisma-airs-redteam-report-runtime-policy-get

Get the runtime security profile config derived from a Red Team scan report.

Base Command

prisma-airs-redteam-report-runtime-policy-get

Input

Context Output

prisma-airs-redteam-report-goals-list

List goals for a Red Team dynamic scan report.

Base Command

prisma-airs-redteam-report-goals-list

Input

Context Output

prisma-airs-redteam-report-goal-streams-list

List streams for a goal in a Red Team dynamic scan report.

Base Command

prisma-airs-redteam-report-goal-streams-list

Input

Context Output

prisma-airs-redteam-report-stream-get

Get stream details for a Red Team dynamic scan report.

Base Command

prisma-airs-redteam-report-stream-get

Input

Context Output

prisma-airs-redteam-report-download

Download a Red Team scan report and attach it to the War Room. The endpoint streams the report back as a ZIP archive bundling the report file(s) (for example report_summary.csv).

Base Command

prisma-airs-redteam-report-download

Input

Context Output

Command example

!prisma-airs-redteam-report-download job_id=7cd7dd0b-917a-44d1-8044-95f82a5a1032 file_format=ALL

Context Example

{
    "InfoFile": {
        "EntryID": "71@37335",
        "Extension": "zip",
        "Info": "application/zip",
        "Name": "report_7cd7dd0b-917a-44d1-8044-95f82a5a1032_all.zip",
        "Size": 4739584,
        "Type": "Zip archive data, at least v2.0 to extract, compression method=deflate"
    }
}

Human Readable Output

Returns the report as a downloadable ZIP file in the War Room. The archive contents depend on file_format:

• CSV — report_summary.csv, attacks.csv
• JSON — report_summary.json, attacks.json
• ALL — all four of the above

report_summary carries the per-job scorecard (ASR, risk score, per-category security/severity breakdowns, and the narrative summary); attacks carries the full per-attack detail rows.

prisma-airs-redteam-report-generate-partial

Unlock the partial report of a still-running Red Team scan. Consumes one quota credit of the job type and unlocks the report for viewing. The job must be in the PARTIALLY_COMPLETE state. Returns the updated job information.

Base Command

prisma-airs-redteam-report-generate-partial

Input

Context Output

Note: This command applies only to scans in the PARTIALLY_COMPLETE state and consumes one quota credit per call. Against jobs in other states (e.g. RUNNING, COMPLETED) the API currently returns HTTP 500 Internal Server Error rather than a clean validation error.

prisma-airs-redteam-eula-status

Get Red Team EULA acceptance status.

Base Command

prisma-airs-redteam-eula-status

Input

There are no input arguments for this command.

Context Output

Command example

!prisma-airs-redteam-eula-status

Context Example

{
    "accepted_at": "2025-10-31T12:56:37.659000Z",
    "accepted_by_user_id": "59087f43-bd63-4d7d-940d-2ff5dd9382b3",
    "is_accepted": true,
    "uuid": "b6b335cf-2109-45a9-a685-7c5f42838371"
}

Human Readable Output

Red Team EULA Status

Status: Accepted

Accepted At: 2025-10-31T12:56:37.659000Z

Accepted By: 59087f43-bd63-4d7d-940d-2ff5dd9382b3

prisma-airs-redteam-eula-content

Get Red Team EULA content (full legal text).

Base Command

prisma-airs-redteam-eula-content

Input

There are no input arguments for this command.

Context Output

Command example

!prisma-airs-redteam-eula-content

Context Example

{
    "content": "## END USER LICENSE AGREEMENT\n\n---\n\n**THIS END USER LICENSE AGREEMENT (“Agreement”) GOVERNS THE USE OF PALO ALTO\nNETWORKS PRODUCTS (as that term “Product” is defined below).**\n\nTHIS IS A LEGAL AGREEMENT BETWEEN YOU (REFERRED TO HEREIN AS “ **CUSTOMER** ” or “ **END\nUSER** ”) 
... (truncated)

Human Readable Output

Red Team EULA Content

Length: 42002 characters

Content Preview:

## END USER LICENSE AGREEMENT

---

**THIS END USER LICENSE AGREEMENT (“Agreement”) GOVERNS THE USE OF PALO ALTO
NETWORKS PRODUCTS (as that term “Product” is defined below).**

THIS IS A LEGAL AGREEMENT BETWEEN YOU (REFERRED TO HEREIN AS “ **CUSTOMER** ” or “ **END
USER** ”) AND (A) PALO ALTO NETWORKS, INC., 3000 TANNERY WAY, SANTA CLARA, CALIFORNIA

... (truncated, 41002 more characters)

Full content available in context output.

prisma-airs-redteam-eula-accept

Accept the Red Team EULA (required before running scans).

Base Command

prisma-airs-redteam-eula-accept

Input

Context Output

prisma-airs-redteam-prompts-create

Create a new prompt in a Red Team prompt set for custom attack scenarios.

Base Command

prisma-airs-redteam-prompts-create

Input

Context Output

prisma-airs-redteam-prompts-list

List prompts in a Red Team prompt set.

Base Command

prisma-airs-redteam-prompts-list

Input

Context Output

prisma-airs-redteam-prompts-get

Get details of a specific prompt in a Red Team prompt set.

Base Command

prisma-airs-redteam-prompts-get

Input

Context Output

prisma-airs-redteam-prompts-update

Update an existing prompt in a Red Team prompt set.

Base Command

prisma-airs-redteam-prompts-update

Input

Context Output

prisma-airs-redteam-prompts-delete

Delete a prompt from a Red Team prompt set.

Base Command

prisma-airs-redteam-prompts-delete

Input

Context Output

prisma-airs-redteam-prompt-sets-create

Create a new Red Team prompt set for organizing custom attack prompts.

Base Command

prisma-airs-redteam-prompt-sets-create

Input

Context Output

prisma-airs-redteam-prompt-sets-list

List Red Team prompt sets for custom attack scenarios.

Base Command

prisma-airs-redteam-prompt-sets-list

Input

Context Output

Command example

!prisma-airs-redteam-prompt-sets-list

Context Example

[
    {
        "active": true,
        "archive": false,
        "created_at": "2026-05-08T18:31:07.121412Z",
        "created_by_user_id": "59087f43-bd63-4d7d-940d-2ff5dd9382b3",
        "description": "https://github.com/scthornton/prompt-database",
        "name": "prompt-database-gt8",
        "property_names": [
            "Semantic Category",
            "Complexity"
        ],
        "stats": {
            "active_prompts": 250,
            "failed_prompts": 0,
            "inactive_prompts": 0,
            "total_prompts": 250,
            "validation_prompts": 0
        },
        "status": "VALIDATED",
        "updated_at": "2026-05-08T18:32:06.656700Z",
        "uuid": "adf6e1bd-61f1-4e57-9650-b40f26b981cb"
    },
    {
        "active": true,
        "archive": false,
        "created_at": "2025-12-14T01:04:00.293326Z",
        "created_by_user_id": "59087f43-bd63-4d7d-940d-2ff5dd9382b3",
        "name": "Customer1-AttackSet-Dec12",
        "property_names": [
            "Semantic Category",
            "Severity"
        ],
        "stats": {
            "active_prompts": 17,
            "failed_prompts": 0,
            "inactive_prompts": 0,
            "total_prompts": 17,
            "validation_prompts": 0
        },
        "status": "VALIDATED",
        "updated_at": "2025-12-14T01:34:46.863454Z",
        "uuid": "73eea776-ecbf-4a5d-9098-a37744441fca"
    }
]

Human Readable Output

Red Team Prompt Sets (Total: 6)

UUID	Name	Status	Active	Archive	Description
adf6e1bd-61f1-4e57-9650-b40f26b981cb	prompt-database-gt8	VALIDATED	True	False	https://github.com/scthornton/…
73eea776-ecbf-4a5d-9098-a37744441fca	Customer1-AttackSet-Dec12	VALIDATED	True	False	N/A
f9f8cd22-22b9-4754-8656-15b2e51b6952	HarmBench	VALIDATED	True	False	https://github.com/centerforai…
06d2a36e-49ac-4712-b7ca-e87e4ba9d9fe	Customer1-AttackSet-HateAndFairness	VALIDATED	True	False	N/A
a9731c3a-f989-40ff-8a7b-efadaf4a490b	Customer1-AttackSet-EnterpriseReputation	VALIDATED	True	False	N/A
84364729-1dc6-498a-a7d0-d26c4d5cf697	Customer1-AttackSet-Sexual	VALIDATED	True	False	N/A

prisma-airs-redteam-prompt-sets-get

Get details of a specific Red Team prompt set.

Base Command

prisma-airs-redteam-prompt-sets-get

Input

Context Output

prisma-airs-redteam-prompt-sets-update

Update an existing Red Team prompt set.

Base Command

prisma-airs-redteam-prompt-sets-update

Input

Context Output

prisma-airs-redteam-prompt-sets-archive

Archive or unarchive a Red Team prompt set.

Base Command

prisma-airs-redteam-prompt-sets-archive

Input

Context Output

prisma-airs-redteam-registry-credentials-get

Get or create Red Team registry credentials for pulling scanner container images from the Prisma AIRs registry.

Base Command

prisma-airs-redteam-registry-credentials-get

Input

There are no input arguments for this command.

Context Output

prisma-airs-redteam-prompt-sets-download

Download CSV template for a Red Team prompt set. The template includes header row and sample data for bulk prompt uploads.

Base Command

prisma-airs-redteam-prompt-sets-download

Input

Context Output

There is no context output for this command.

prisma-airs-redteam-prompt-sets-upload

Upload CSV file with prompts to a Red Team prompt set. CSV must have ‘prompt’ and ‘goal’ columns (goal is optional).

Base Command

prisma-airs-redteam-prompt-sets-upload

Input

Context Output

prisma-airs-redteam-properties-list

List custom-attack property names. Property names (for example, category, severity) form the metadata vocabulary used to tag and filter custom attack prompts. Read-only.

Base Command

prisma-airs-redteam-properties-list

Input

There are no input arguments for this command.

Context Output

Command example

!prisma-airs-redteam-properties-list

Human Readable Output

Red Team Custom-Attack Property Names

Property Name
Complexity
Severity
Semantic Category
customer
type

prisma-airs-redteam-properties-values

Get the allowed values for one or more custom-attack property names. Provide either property_name (single) or property_names (comma-separated list for a batch lookup). Read-only.

Note: On the current API version the batch endpoint (property_names) honors only the last name supplied; to reliably retrieve values for several properties, call the command once per name using property_name.

Base Command

prisma-airs-redteam-properties-values

Input

Context Output

Command example

!prisma-airs-redteam-properties-values property_name="Severity"

Human Readable Output

Red Team Custom-Attack Property Values

Property Name	Value
Severity	Low
Severity	High
Severity	Medium

prisma-airs-redteam-properties-create

Create a new custom-attack property name.

Base Command

prisma-airs-redteam-properties-create

Input

Context Output

Command example

!prisma-airs-redteam-properties-create name="severity"

Human Readable Output

Red Team Custom-Attack Property Name Created: severity

Name
severity

prisma-airs-redteam-properties-add-value

Add an allowed value to an existing custom-attack property name.

Base Command

prisma-airs-redteam-properties-add-value

Input

Context Output

Command example

!prisma-airs-redteam-properties-add-value property_name="severity" property_value="critical"

Human Readable Output

Red Team Custom-Attack Property Value Added: severity

Property Name	Property Value	Message	Status
severity	critical	Property value ‘critical’ created successfully	200

prisma-airs-redteam-sentiment-get

Get the sentiment (up/down-vote) recorded for a Red Team scan report. Read-only.

Base Command

prisma-airs-redteam-sentiment-get

Input

Context Output

Command example

!prisma-airs-redteam-sentiment-get job_id="87dcf504-3e57-486a-b6a0-69a4ff896130"

Human Readable Output

Red Team Report Sentiment: 87dcf504-3e57-486a-b6a0-69a4ff896130

Job Id	Up Vote	Down Vote
87dcf504-3e57-486a-b6a0-69a4ff896130	true	false

prisma-airs-redteam-sentiment-update

Update the sentiment (up/down-vote) for a Red Team scan report.

Note: Up-vote and down-vote are mutually exclusive — recording one clears the other.

Base Command

prisma-airs-redteam-sentiment-update

Input

Context Output

Command example

!prisma-airs-redteam-sentiment-update job_id="87dcf504-3e57-486a-b6a0-69a4ff896130" vote="up"

Human Readable Output

Red Team Report Sentiment Updated: 87dcf504-3e57-486a-b6a0-69a4ff896130

Job Id	Up Vote	Down Vote
87dcf504-3e57-486a-b6a0-69a4ff896130	true	false

prisma-airs-redteam-prompt-sets-reference

Get the reference metadata for a single custom prompt set by UUID.

Base Command

prisma-airs-redteam-prompt-sets-reference

Input

Context Output

Command example

!prisma-airs-redteam-prompt-sets-reference uuid="adf6e1bd-61f1-4e57-9650-b40f26b981cb"

Human Readable Output

Red Team Prompt Set Reference

Uuid	Name	Status	Active	Version	Tsg Id	Created At	Updated At
adf6e1bd-61f1-4e57-9650-b40f26b981cb	prompt-database-gt8	VALIDATED	true	1778265136079904	1082076864	2026-05-08T18:31:07.121412Z	2026-05-08T18:32:06.656700Z

prisma-airs-redteam-prompt-sets-version-info

Get version information (status, latest flag, and prompt counts) for a custom prompt set.

Note: As of this release the upstream .../version-info endpoint returns an HTTP 500 (internal_error) for every prompt set queried, so this command currently surfaces that server error. The command is implemented to match the working reference/active-list contract and will function once the upstream endpoint is fixed.

Base Command

prisma-airs-redteam-prompt-sets-version-info

Input

Context Output