Operations 28
Each operation below carries the questions people ask an LLM about it and the instructions they give an agent to run it. Generated by API Evangelist overlay
Ask an LLM
“How many alerts are open across all my Prisma Access tenants right now?”
“Can I get a single aggregated alert count for a parent tenant and its child tenants?”
Tell an agent
Give me the total alert count across all tenants in the {region} data lake region.
Count alerts across tenants matching filter {filter}.
POST
/mt/monitor/v1/agg/alerts/list
List alert counts by source across tenants · List alerts by source
#
Ask an LLM
“Which sources are generating the most alerts across my tenants?”
“Where are my multi-tenant alerts coming from, broken down by source?”
Tell an agent
Break down alert counts by source across tenants in region {region}.
List per-source alert counts for tenants matching {filter}.
POST
/mt/monitor/v1/agg/applicationUsage
List application usage by application type · List application usage by type
#
Ask an LLM
“What kinds of applications are my users consuming the most, grouped by application type?”
“Can I see application usage split by type across my Prisma Access tenants?”
Tell an agent
Show application usage grouped by application type for region {region}.
Report usage per application type using filter {filter}.
Ask an LLM
“How many distinct applications are seen across all my tenants?”
“Is there a way to get one aggregated application count for every child tenant?”
Tell an agent
Give me the total number of applications seen across tenants in {region}.
Count applications across tenants with filter {filter}.
POST
/mt/monitor/v1/agg/applications/list
List applications seen across tenants · List applications
#
Ask an LLM
“Which applications are actually in use across my tenants, listed out?”
“Can I pull the full aggregated list of applications for my parent and child tenants?”
Tell an agent
List every application observed across tenants in region {region}.
Pull the aggregated application list for tenants matching {filter}.
POST
/mt/monitor/v1/agg/applications/source
Count applications by source · List applications by source
#
Ask an LLM
“How many applications come from remote networks versus mobile users versus proxy nodes?”
“Which traffic source accounts for the most applications across my tenants?”
Tell an agent
Count applications by source (remote networks, mobile users, proxy nodes) in {region}.
Split the application count by traffic source using filter {filter}.
POST
/mt/monitor/v1/agg/applications/summary
Summarize risky applications across tenants · List app summary
#
Ask an LLM
“How many risky applications are showing up across my tenants?”
“Can I get a summary count of high-risk apps for all child tenants at once?”
Tell an agent
Summarize the count of risky applications across tenants in {region}.
Give me the risky-app summary for tenants matching {filter}.
POST
/mt/monitor/v1/agg/incidents/count
Count incidents by severity · Get incident count by severity
#
Ask an LLM
“How many critical versus warning incidents do my tenants have?”
“What does my incident count look like broken down by severity?”
Tell an agent
Count incidents by severity across tenants in {region}.
Give me incident totals per severity level for filter {filter}.
POST
/mt/monitor/v1/agg/incidents/impactedList
List objects impacted by incidents · Get list of impacted objects
#
Ask an LLM
“Which sites, users or objects are impacted by current incidents?”
“What is affected by the incidents open across my tenants?”
Tell an agent
List the objects impacted by incidents in region {region}.
Show impacted objects for incidents matching {filter}.
Ask an LLM
“What incidents are currently recorded across my tenants?”
“Can I pull the individual incident list for my parent tenant and its children?”
Tell an agent
List all incidents across tenants in {region}.
Fetch the incident list filtered by {filter}.
POST
/mt/monitor/v1/agg/incidents/tenants
Rank tenants by incident count · Get top tenants by incidents count
#
Ask an LLM
“Which of my tenants have the most open critical and warning incidents?”
“Who are my top tenants by incident count?”
Tell an agent
Rank the top tenants by open critical plus warning incidents in {region}.
Show which tenants lead in incidents for filter {filter}.
POST
/mt/monitor/v1/agg/incidents/trends
Chart incident trends over time · Get incident trends(open critical, open warning, closed incidents)
#
Ask an LLM
“How have open critical, open warning and closed incidents trended over time?”
“Can I get an incident histogram to see whether things are getting better or worse?”
Tell an agent
Build an incident trend histogram for region {region}.
Show the open critical, open warning and closed incident trend for filter {filter}.
Ask an LLM
“Which compute locations are available, with their latitude and longitude?”
“Where are the compute locations I could plot on a map?”
Tell an agent
List compute locations with latitude and longitude for region {region}.
Give me the map coordinates of every compute location.
POST
/mt/monitor/v1/agg/locationsTenants
Count tenants at a compute location · Get number of tenants at location
#
Ask an LLM
“How many tenants have assets at a particular compute location?”
“Which compute locations host the most tenants?”
Tell an agent
Count tenants with assets at the compute location in filter {filter}.
Show the number of tenants per compute location in {region}.
POST
/mt/monitor/v1/agg/locationsUsers
Count users at compute locations · Get number of users at location(s)
#
Ask an LLM
“How many users are connected at or across my compute locations?”
“Which compute location is serving the largest number of users?”
Tell an agent
Count users at the compute locations in filter {filter}.
Give me user counts per compute location for {region}.
POST
/mt/monitor/v1/agg/resource
Count network inventory across tenants · List network inventory count
#
Ask an LLM
“How much network inventory do I have across all tenants?”
“Can I see aggregated counts of my network resources for every child tenant?”
Tell an agent
Count network inventory across tenants in {region}.
Aggregate network inventory for tenants matching {filter}.
POST
/mt/monitor/v1/agg/serviceConnectivity
Count remote network and service connection status · List RN and SC site status count
#
Ask an LLM
“How many of my remote network and service connection sites are up versus down?”
“What is the status breakdown of RN and SC sites across tenants?”
Tell an agent
Count remote network and service connection sites by status in {region}.
Show RN and SC site status counts for filter {filter}.
POST
/mt/monitor/v1/agg/serviceConnectivity/cdlStatus
Check Cortex Data Lake connectivity status · List CDL connectivity status
#
Ask an LLM
“Are my tenants successfully connected to Cortex Data Lake?”
“Which tenants have CDL connectivity problems?”
Tell an agent
Show Cortex Data Lake connectivity status across tenants in {region}.
List CDL connection status for tenants matching {filter}.
POST
/mt/monitor/v1/agg/serviceConnectivity/gatewayStatus
Check mobile gateway connection status · List mobile gateway connection status
#
Ask an LLM
“Are my mobile user gateways connected across tenants?”
“What is the aggregated connection status of mobile gateways?”
Tell an agent
Show mobile gateway connection status across tenants in {region}.
List mobile gateway status returning properties {properties}.
GET
/mt/monitor/v1/agg/serviceConnectivity/licenseAllocated
Get GlobalProtect licenses allocated · Get total GP licenses allocated
#
Ask an LLM
“How many GlobalProtect licenses are allocated for mobile users, explicit proxy and remote networks?”
“What is my total GP license allocation across tenants?”
Tell an agent
Show total GlobalProtect licenses allocated across tenants in {region}.
Report GP license allocation for mobile users, explicit proxy, okyo and remote networks.
POST
/mt/monitor/v1/agg/serviceConnectivity/topOutliers
List sites exceeding allocated bandwidth · List top outliers
#
Ask an LLM
“Which sites are consuming more bandwidth than they were allocated?”
“Who are the top bandwidth outliers across my tenants?”
Tell an agent
List the top outlier sites over their bandwidth allocation in {region}.
Find sites exceeding allocated bandwidth for filter {filter}.
POST
/mt/monitor/v1/agg/serviceConnectivity/uniqueUsers
Count unique GlobalProtect users in 90 days · List unique GP users
#
Ask an LLM
“How many unique GlobalProtect users connected in the last 90 days?”
“Can I see distinct GP user counts across all my tenants?”
Tell an agent
Count unique GlobalProtect users from the last 90 days in {region}.
List unique GP users with properties {properties}.
Ask an LLM
“How many threats have been detected across all my tenants?”
“Can I get one aggregated threat total for the parent tenant and its children?”
Tell an agent
Give me the total threat count across tenants in {region}.
Count threats for tenants matching {filter}.
Ask an LLM
“Which specific threats were seen across my tenants?”
“What threats should I review, listed one by one?”
Tell an agent
List every threat observed across tenants in {region}.
Pull the aggregated threat list for filter {filter}.
Ask an LLM
“Are critical threats coming from remote networks, mobile users or proxy nodes?”
“Which source is responsible for the most critical threats?”
Tell an agent
Break down critical threats by source in {region}.
Count critical threats per source for filter {filter}.
Ask an LLM
“What does the overall threat picture look like across my tenants?”
“Can I get a high-level threat summary instead of the full list?”
Tell an agent
Summarize threats across tenants in region {region}.
Give me the threat summary for tenants matching {filter}.
Ask an LLM
“How many URLs are my users visiting across all tenants?”
“Is there a single summary count of URLs for every child tenant?”
Tell an agent
Summarize URL counts across tenants in {region}.
Give me the URL count summary for filter {filter}.
POST
/mt/monitor/v1/agg/urlLogs
Rank tenants by risky URL activity · List top tenants with risky URLs
#
Ask an LLM
“Which tenants have the most risky URL visits?”
“Who are my top tenants when it comes to risky web browsing?”
Tell an agent
Rank the top tenants with risky URLs in {region}.
Show tenants with the most risky URL hits for filter {filter}.