1. Overview

The Prisma Cloud Intelligence Stream is a real-time threat feed delivered from the Prisma Cloud content delivery network (CDN) to our customers' installations. This service gathers, analyzes, and prepares threat data for distribution to the Console located on your network. Console pulls data down from the Threat Intelligence Stream using HTTPS requests. The Intelligence Stream is Console’s only required external dependency.

No customer data ever leaves your network or environment. Prisma Cloud does not gather data from our customers unless you choose to opt in and contribute.

If you operate in an air-gapped environment, data in the Intelligence Stream can be downloaded and transferred to Console using the *twistcli *tool we ship with the product using whatever operational processes you wish to put in place.