To answer this question, let’s analyze each Cloud-Delivered Security Service (CDSS) subscription and
its role in inline machine learning (ML). Palo Alto Networks leverages inline ML capabilities across
several of its subscriptions to provide real-time protection against advanced threats and reduce the
need for manual intervention.
A . Enterprise DLP (Data Loss Prevention)
Enterprise DLP is a Cloud-Delivered Security Service that prevents sensitive data from being exposed.
Inline machine learning is utilized to accurately identify and classify sensitive information in real-
time, even when traditional data patterns or signatures fail to detect them. This service integrates
seamlessly with Palo Alto firewalls to mitigate data exfiltration risks by understanding content as it
passes through the firewall.
B . Advanced URL Filtering
Advanced URL Filtering uses inline machine learning to block malicious URLs in real-time. Unlike
legacy URL filtering solutions, which rely on static databases, Palo Alto Networks' Advanced URL
Filtering leverages ML to identify and stop new malicious URLs that have not yet been categorized in
static databases. This proactive approach ensures that organizations are protected against emerging
threats like phishing and malware-hosting websites.
C . Advanced WildFire
Advanced WildFire is a cloud-based sandboxing solution designed to detect and prevent zero-day
malware. While Advanced WildFire is a critical part of Palo Alto Networks’ security offerings, it
primarily uses static and dynamic analysis rather than inline machine learning. The ML-based
analysis in Advanced WildFire happens after a file is sent to the cloud for processing, rather than
inline, so it does not qualify under this question’s scope.
D . Advanced Threat Prevention
Advanced Threat Prevention (ATP) uses inline machine learning to analyze traffic in real-time and
block sophisticated threats such as unknown command-and-control (C2) traffic. This service replaces
the traditional Intrusion Prevention System (IPS) approach by actively analyzing network traffic and
blocking malicious payloads inline. The inline ML capabilities ensure ATP can detect and block threats
that rely on obfuscation and evasion techniques.
E. IoT Security
IoT Security is focused on discovering and managing IoT devices connected to the network. While
this service uses machine learning for device behavior profiling and anomaly detection, it does not
leverage inline machine learning for real-time traffic inspection. Instead, it operates at a more
general level by providing visibility and identifying device risks.
Key Takeaways:
Enterprise DLP, Advanced URL Filtering, and Advanced Threat Prevention all rely on inline machine
learning to provide real-time protection.
Advanced WildFire uses ML but not inline; its analysis is performed in the cloud.
IoT Security applies ML for device management rather than inline threat detection.
Reference:
Palo Alto Networks Documentation: Cloud-Delivered Security Services Overview
Palo Alto Networks Technical Specifications for CDSS Subscriptions
Best Practices for Implementing Inline Machine Learning Features
