Databricks Software / SaaS United States

Palo Alto Networks

Real-time Analytics · Risk Management · Security and Compliance

Palo Alto Networks needed a better way to support unified cloud security analytics, governance, and real-time recommendations for Prisma Cloud because separate module-level data models and governance practices blocked cross-product threat visibility and slowed reusable analytics development.

3x reduction in time required for data preparation and movement
40% helping businesses keep their customers safe from cyberthreats

Reported impact

Business outcome

Palo Alto Networks improved unified cloud security analytics, governance, and real-time recommendations for Prisma Cloud with measurable results including 40% helping businesses keep their customers safe from cyberthreats and 3x reduction in time required for data preparation and movement, while giving teams a faster path from governed data to production decisions.

  • Compliance
  • Productivity Improvement
  • Risk Reduction

Solution

Palo Alto Networks uses Databricks Data + AI Platform to support unified cloud security analytics, governance, and real-time recommendations for Prisma Cloud. The implementation replaced a legacy state where separate module-level data models and governance practices blocked cross-product threat visibility and slowed reusable analytics development. Prisma cloud module data and security alerts move through Spark Declarative Pipelines and land in Delta Lake, giving teams one trusted data foundation. Unity Catalog governs access, lineage, and compliance across sensitive datasets. Databricks SQL and Agent Bricks operationalize models, agents, and analytics that deliver real-time security recommendations and shared analytics tools.

Data flow

Prisma cloud module data and security alerts land on a shared platform, pipeline services clean and standardize them, governance controls enforce trusted access, and AI, model-serving, and analytics services deliver real-time security recommendations and shared analytics tools.

Solution architecture

6 components · 5 layers
  1. Ingest
    • Spark Declarative Pipelines Spark Declarative Pipelines standardizes Prisma Cloud module data and security alerts into production-grade tables and features.
  2. Compute
    • Databricks Data + AI Platform Databricks Data + AI Platform unifies engineering, analytics, governance, and AI workloads for unified cloud security analytics, governance, and real-time recommendations for Prisma Cloud.
  3. Storage
    • Delta Lake Delta Lake stores curated Prisma Cloud module data and security alerts so every team works from one trusted data foundation.
  4. Serving
    • Databricks SQL Databricks SQL serves curated dashboards and ad hoc analysis to real-time security recommendations and shared analytics tools.
    • Agent Bricks Agent Bricks packages domain-specific agents that automate parts of unified cloud security analytics, governance, and real-time recommendations for Prisma Cloud.
  5. Governance
    • Unity Catalog Unity Catalog applies centralized access controls, lineage, and auditability across sensitive datasets.

Architecture clues

  • 40% helping businesses keep their customers safe from cyberthreats
  • Automated ingestion and transformation pipelines keep source data synchronized for downstream analytics and AI.
  • Centralized governance, lineage, and access controls are enforced through Unity Catalog.
  • Delta Lake provides the shared storage layer for curated lakehouse datasets.
  • Operational AI workflows are deployed directly beside governed data and analytics assets.

Evidence from the source

Faster iterations on AI/ML features shipped on Databricks compared with prior solution
Operating in silos limited our ability to see the full picture and respond quickly to threats,
Palo Alto Networks is committed to advancing cybersecurity, with a vision to create a safer world every day. Driving digital transformation through best-in-class platforms, intelligence and services, the company aims to
We needed a unified platform to break down barriers between modules, streamline data access and enable our teams to develop reusable tools without the bottlenecks caused by disconnected systems.
Transparency Evidence & methodology 100/100 reference value · 89% confidence · 1 source

Review how this reference was scored and trace each normalized claim back to its documented source.

01

Scoring methodology

How scores are calculated

Customer Reference Value measures usefulness as a customer reference. Evidence Confidence measures the quality and traceability of available evidence, not independent verification.

Customer reference value100/100
  • Problem clarity20/20
    Measures whether the customer's operational problem is specific enough to compare.
  • Implementation depth25/25
    Rewards named components, data flow, integrations, and architecture detail.
  • Outcome specificity20/20
    Measures whether the reported benefit is concrete rather than a generic claim.
  • Quantified impact25/25
    2 metrics describe measurable impact.
  • Deployment scale10/10
    Rewards evidence of a live or scaled deployment and meaningful integration scope.
Evidence confidence89%
  • Source authority20/25
    The main evidence is an official vendor-published customer story.
  • Claim traceability21/25
    10 of 12 key fields link to a named source.
  • Direct evidence20/20
    4 direct source quotes retained.
  • Date provenance10/10
    The publication date comes from the source page or publisher.
  • Source transparency8/10
    1 source reference document publisher, URL, authority, retrieval, and supported fields.
  • Implementation specificity10/10
    Rewards source-backed components, data flow, quantified impact, and a specific outcome.
02

Traceability

Sources & provenance

Field coverage shows which facts each source supports. Dates are shown only when documented by the source.

  1. Databricks

    Palo Alto Networks customer story

    First-party
    https://www.databricks.com/customers/palo-alto-networks
    Source type
    Vendor-published customer story
    Published
    Jan 14, 2025
    Supports
    • Customer
    • Business problem
    • Solution
    • Products
    • Solution components
    • Data flow
    • Integrations
    • technical area
    • use case category
    • Business outcome
    • outcome category
    • Metrics
    • Architecture
    • evidence quotes
    • Publication date

Date evidence

  • Published on source page Jan 14, 2025 · Databricks · First-party
    Open date source
Not separately sourced Industry, Region, Company size. Treat these normalized attributes as lower-confidence until a dedicated source is added.