>
    Strata Copilot
    Targets
    Focus
    Download PDF
    Focus
    1. Home
    2. Prisma AIRS
    3. AI Red Teaming
    4. Identify AI System Risks with AI Red Teaming
    5. Get Started with Prisma AIRS AI Red Teaming
    6. Targets
    Download PDF
    Prisma AIRS

    Targets

    Table of Contents

    Targets

    Learn how to add a AI Red Teaming target in Prisma AIRS.
    Where Can I Use This?What Do I Need?
    • Prisma AIRS (AI Red Teaming)
    • Prisma AIRS AI Red Teaming License
    • Prisma AIRS AI Red Teaming Deployment Profile
    Before running any scan, you need to add a Target that you want to test. Prisma AIRS AI Red Teaming supports REST, streaming APIs, and WebSocket as targets. If you are using a model hosted on Hugging Face or a model served by OpenAI there are pre-configured connection methods also available which will make it easier for you to configure your target. Each of these connection methods are described on this page. If your target uses a non-standard protocol or requires a custom integration, use a custom target adapters.
    AI Red Teaming delivers text-based attacks to all targets by default. For targets that also accept file uploads, you can select Supports File Upload during target configuration to add file-based attacks on top of your existing text coverage.
    AI Red Teaming includes a dedicated x-airs-red-teaming-trace-id header in every outbound request. This header enables you to distinguish AI Red Teaming traffic, add rich context to observability and analytics, and make monitoring more accurate and scalable.

    Add a New Target

    Use Strata Cloud Manager to add a AI Red Teaming target.
    The connection method for a target endpoint varies based on the chosen method. For example, for a Databricks connection method, you'll specify additional configuration options like authentication method and connection details. Each connection method is described separately below.
    Creating a new target comprises the following:
    You can save your configuration changes without applying updates at any time using the Save for Later option. A temporary version of the target configuration appears in the list of available targets with the status appearing as Draft.
    1. Log in to Strata Cloud Manager.
    2. Navigate to AI SecurityAI Red TeamingTargets.
    3. Select + New Target.
      If target endpoints were previously configured, they'll show up as a list of available targets. You can edit these existing targets, or, remove them.
    4. In the Add a new target screen, first specify Target Details:
      1. In the Target Description section, include a Target Name (for example, OpenAI GPT 3.5 Turbo).
      2. Select the Target Type: Model, Application, or Agent.
        (Agent Only) This screen displays when you select Agent as the target type.
        The on-screen message reminds you to choose Agent as your target only if your application needs autonomous decision-making capabilities and tool calling functionality. An Agent is designed for applications where the AI needs to independently determine which tools or functions to invoke, decide the sequence of actions, and adapt its approach based on results while working towards a defined objective. This configuration is appropriate when your use case goes beyond simple question-answering and requires the AI to actively interact with external APIs, databases, or services to complete multi-step tasks autonomously.
      3. Specify the Connection Method for connecting to the target endpoint. Supported connection methods include OpenAI, Hugging Face, Databricks, AWS Bedrock, REST API or Streaming or WebSocket, and Custom Target Adapter.
        Each of these connection methods are described below.
        The connection method for a target endpoint varies based on the chosen method. See the following sections for details for each connection method. Rest API, Streaming, WebSocket, and Custom Target Adapter are considered custom connection methods. For these connection methods, you'll need to determine if the endpoint is public or private. See Rest API or Streaming or WebSocket Connection Method and Custom Target Adapter below. For targets that require a non-standard protocol or a custom integration, use a Custom Target Adapter.

    Connection Methods

    You can add a target using the following connection methods.
    • Open AI and Hugging Face Connection Method
    • Databricks Connection Method
    • AWS Bedrock Connection Method
    • Rest API or Streaming or WebSocket Connection Method
    • Custom Target Adapter
    • (For Agent Only) Microsoft Copilot Studio Connection Method

    Open AI and Hugging Face Connection Method

    Use Open AI and Hugging Face connection method for adding targets.
    Use this information in this section to configure target endpoints for Open AI and Hugging Face.
    1. After specifying Target Details, set the Connection Method to Open AI or Hugging Face.
    2. Click Next: Add/Verify Parameters.
    3. In the Add/Verify Parameters page, you'll need to set the authentication mechanism and additional connection details:
      1. In the API Details section, enter the API key.
      2. Enter the API endpoint. For example, https://api.openai.com/v1/chat/completions.
      3. Specify Model Details.
        • Enter a Model name (for example, gpt 3.5 turbo).
        • Configure Model Streaming by enabling or disabling it.
    4. Select Next: Verify & Edit JSON.
    5. In the Verify & Edit JSON page, specify the JSON structure of the request.
    6. Click Next: Advanced Configurations.
      In the Advanced Configurations page you'll configure Rate Limits and set Guardrails/Content Filters.
    7. (Optional) Enable Rate Limits for applications on the target endpoint.
      1. Specify the Endpoint Rate Limit. This value represents the maximum number of allowed requests per minute for the specified endpoint.
      2. Specify the Endpoint Rate Limit Error Code. This field represents the error code your system uses for rate limiting violations.
      3. Provide a Sample Exception JSON.
    8. (Optional) Enable Guardrails/Content Filters. These fields are used for output guardrails or content filters applicable on the target endpoint.
      1. Specify the Error code for Guardrails or Content Filters. This field represents the error code your system uses when a response is prevented by filters or safeguards.
      2. Provide a Sample Exception JSON.
      3. Select Validate Target.
        Only after a target is successfully validated, you can add target background information.
    9. (Mandatory) Configure Target Background.
      AI Red Teaming collects and organizes the Target background information about your target endpoint. Target background encompasses mandatory elements such as, industry classification, use case definition, and competitive landscape analysis, along with optional documentation uploads including company policy documents and other relevant materials.
      Target background information is mandatory for all the target types.
      1. Add Industry information.
      2. Add Use Case, that is specific role of the target such as customer service or additional comments.
      3. (Optional) Select Add Competitor to add the list of Competitors.
      4. Enable Agentic Profiling.
        Agentic Profiling in AI Red Teaming helps gather all relevant context about a target endpoint such as its business use case, background, key capabilities, technical architecture and other critical information. This is carried out by an autonomous agent probing the target endpoint with the right prompts. All information gathered through this exercise is presented as the Target's profile and is used downstream in AI Red Teaming Scans using the Agent.
    10. Select Submit.
      Once the target is created you can start a scan, or view previously created targets:

    Databricks Connection Method

    Use Databricks connection method for adding targets.
    Databricks connection methods use the Databricks Connect client library for IDEs, the JDBC/ODBC drivers for BI tools like Excel, and, HTTP connections for connecting to external services (for example, IBM's Watsonx). When you use the Databricks connection method you set the authentication method and additional details about the connection.
    1. After specifying Target Details, set the Connection Method to Databricks.
    2. Select Next: Add/Verify Parameters.
    3. In the Add/Verify Parameters page, you'll need to set the authentication mechanism and additional connection details. In the Databricks Authentication Mechanism section, select the Authentication Type (either an Access Token, or a Service Principal):
      1. Select Access Token to authenticate using a personal Databricks access token.
      2. Enter an Access Token.
      3. Alternately, you can use a OAuth as the Authentication Type for the connection. In this scenario, you'll authenticate using service principals for programmatic access.
      4. For the OAuth authentication type, specify the Client ID and enter the corresponding Secret.
    4. In the Databricks Connection Details section:
      1. Specify the API Endpoint (for example, www.google.co.in).
      2. Enter a Model Name (for example, gpt-3.5-turbo).
    5. Click Next: Verify & Edit JSON.
    6. In the Verify & Edit JSON page, specify the JSON structure of the request.
    7. Click Next: Advanced Configurations.
      In the Advanced Configurations page you'll configure Rate Limits and set Guardrails/Content Filters.
    8. (Optional) Enable Rate Limits for applications on the target endpoint.
      1. Specify the Endpoint Rate Limit. This value represents the maximum number of allowed requests per minute for the specified endpoint.
      2. Specify the Endpoint Rate Limit Error Code. This field represents the error code your system uses for rate limiting violations.
      3. Provide a Sample Exception JSON.
    9. (Optional) Enable Guardrails/Content Filters. These fields are used for output guardrails or content filters applicable on the target endpoint.
      1. Specify the Error code for Guardrails or Content Filters. This field represents the error code your system uses when a response is prevented by filters or safeguards.
      2. Provide a Sample Exception JSON.
      3. Select Validate Target.
        Only after a target is successfully validated, you can add target background information.
    10. (Mandatory) Configure Target Background.
      AI Red Teaming collects and organizes the Target background information about your target endpoint. Target background encompasses mandatory elements such as, industry classification, use case definition, and competitive landscape analysis, along with optional documentation uploads including company policy documents and other relevant materials.
      Target background information is mandatory for all the target types.
      1. Add Industry information.
      2. Add Use Case, that is specific role of the target such as customer service or additional comments.
      3. (Optional) Select Add Competitor to add the list of Competitors.
      4. Enable Agentic Profiling.
        Agentic Profiling in AI Red Teaming helps gather all relevant context about a target endpoint such as its business use case, background, key capabilities, technical architecture and other critical information. This is carried out by an autonomous agent probing the target endpoint with the right prompts. All information gathered through this exercise is presented as the Target's profile and is used downstream in AI Red Teaming Scans using the Agent.
    11. Select Submit.
      Once the target is created you can start a scan, or view previously created targets:

    AWS Bedrock Connection Method

    Use AWS Bedrock connection method for adding targets.
    An AWS Bedrock connection method leverages the fully managed service provided by Amazon Web Services to facilitate the ability to build and scale generative AI applications. When you use the AWS Bedrock connection method you configure AWS authentication and model details.
    1. After specifying Target Details, set the Connection Method to AWS Bedrock.
    2. Select Next: Add/Verify Parameters.
    3. In the Add/Verify Parameters page, you'll need to set the authentication mechanism and additional connection details. In the AWS Authentication Details section:
      1. Specify the Region.
      2. Enter the IAM Access ID.
      3. Enter the IAM Access Secret.
      4. Optionally enter the Session Token.
    4. In the Model Details section:
      1. Enter a Model Name. For example, gpt 3.5 turbo.
      2. Enable or disable Model Streaming.
    5. Select Next: Verify & Edit JSON.
    6. In the Verify & Edit JSON page, specify the JSON structure of the request.
    7. Click Next: Advanced Configurations.
      In the Advanced Configurations page you'll configure Rate Limits and set Guardrails/Content Filters.
    8. (Optional) Enable Rate Limits for applications on the target endpoint.
      1. Specify the Endpoint Rate Limit. This value represents the maximum number of allowed requests per minute for the specified endpoint.
      2. Specify the Endpoint Rate Limit Error Code. This field represents the error code your system uses for rate limiting violations.
      3. Provide a Sample Exception JSON.
    9. (Optional) Enable Guardrails/Content Filters. These fields are used for output guardrails or content filters applicable on the target endpoint.
      1. Specify the Error code for Guardrails or Content Filters. This field represents the error code your system uses when a response is prevented by filters or safeguards.
      2. Provide a Sample Exception JSON.
      3. Select Validate Target.
        Only after a target is successfully validated, you can add target background information.
    10. (Mandatory) Configure Target Background.
      AI Red Teaming collects and organizes the Target background information about your target endpoint. Target background encompasses mandatory elements such as, industry classification, use case definition, and competitive landscape analysis, along with optional documentation uploads including company policy documents and other relevant materials.
      Target background information is mandatory for all the target types.
      1. Add Industry information.
      2. Add Use Case, that is specific role of the target such as customer service or additional comments.
      3. (Optional) Select Add Competitor to add the list of Competitors.
      4. Enable Agentic Profiling.
        Agentic Profiling in AI Red Teaming helps gather all relevant context about a target endpoint such as its business use case, background, key capabilities, technical architecture and other critical information. This is carried out by an autonomous agent probing the target endpoint with the right prompts. All information gathered through this exercise is presented as the Target's profile and is used downstream in AI Red Teaming Scans using the Agent.
    11. Select Submit.
      Once the target is created you can start a scan, or view previously created targets:

    REST API or Streaming or WebSocket Connection Method

    Use Rest API or Streaming or WebSocket connection method for adding targets.
    Use this information in this section to configure a custom method for connecting to the endpoint, either Rest API or Streaming or WebSocket.
    About Rest API and Streaming Connection Methods
    AI Red Teaming supports REST and streaming APIs as targets. If you are using a model hosted on Hugging Face or a model served by OpenAI there are pre-configured connection methods also available which will make it easier for you to configure your target.
    If you are adding a REST or streaming API endpoint, you need to select if it is a public endpoint that can be accessed over the internet or a private endpoint. If you are using a private endpoint, you can select either:
    • IP Allowlist—A static IP address is shown that will be used by AI Red Teaming to access your target. Make a note of this IP address as it will have to be allowed by your infrastructure or IT team to be able to access the Target.
    • Network Channels—Private channels for endpoint connectivity.
    WebSocket Connection Method
    AI Red Teaming supports WebSocket as a connection method for AI targets, enabling you to scan real-time, streaming, and full-duplex AI applications with the same automated AI Red Teaming capabilities available for REST API targets. The WebSocket connection method provides AI Red Teaming connectivity to AI applications that communicate exclusively over WebSocket protocols. This native integration eliminates the need to create custom wrapper APIs or proxy services to translate between REST API and WebSocket communications.
    WebSocket connection method is available for all AI Red Teaming target types: Models, Applications, and Agents.
    WebSocket does not support:
    • Support Sessions
    • Multi-Turn Configuration
    Supported Authentication Methods
    AI Red Teaming supports multiple authentication methods to securely connect to target APIs during red teaming scans. You can configure authentication using one of three methods:
    • Using Headers—Static header-based authentication for APIs that accept long-lived credentials such as API keys or bearer tokens.
    • Using Payload—Credentials included directly in the JSON request body alongside the prompt, for APIs that expect username and password fields in the request payload.
    • OAuth 2.0—OAuth 2.0 client credentials flow for APIs that issue short-lived access tokens, with automatic token refresh to ensure uninterrupted scan execution.
    1. After specifying Target Details, set the Connection Method to Rest API or Streaming or WebSocket.
    2. Configure Endpoint Accessibility. This field indicates if your endpoint is Public or Private (secured within a private network).
      1. Select IP Allowlist. To establish a successful connection, certain IP addresses must be allowed by your firewall. These IP addresses are region-specific, so you should allow the specific IP addresses shown in the tooltip within your interface.
      2. Select Network Channels to configure private channels for endpoint connectivity. If a network channel was previously configured, it appears as an option in a drop-down menu.
    3. (Rest API and Streaming connections only) Select Next: Choose Method. Use this page to select whether you want to import a cURL string, or enter the details manually.
      To configure the API request, you can use a cURL to import a sample request, or manually configure the request:
      • Using a cURL to import sample Request—The easiest method to import the request format is to use a cURL string that captures all the necessary headers for your request. Once you click next AI Red Teaming will extract all the necessary information from the cURL string.
      • Manually configure all headers—You can configure the API endpoint and all necessary headers by selecting the Manual Entry option.
      1. Configure the input request JSON based on the requirement of your application. Make sure the value where the user prompt is expected is replaced with {INPUT}. This is the value where AI Red Teaming will add its attack prompts and send to the target application.
        For example, if your cURL string is as follows:
        
curl \
-X POST \
-H "Authorization: <api_token>" \
-H "Content-Type: application/json" \
-d '{
    "messages": [
        {
            "role": "system",
            "content": "You are a helpful assistant."
        },
        {
            "role": "user",
            "content": "<prompt>"
        }
    ],
    "temperature": 0.7
}' \
https://<model_endpoint_url>
        Replace the <prompt> with {INPUT}.
        To accommodate testing with different system prompts and hyperparameters without modifying the original request, the following approach can be implemented:
        • Multiple Targets with Different System Prompts. When testing different system prompts on the same model, you can create multiple target configurations with identical settings except for the system prompt. This allows for direct comparison of the impact of different system prompts while keeping other variables constant.
        • Hyperparameter Testing. For testing other hyperparameters:
          1. Create separate target configurations for each set of hyperparameters you want to test.
          2. Keep all other settings identical across these targets, changing only the specific hyperparameter(s) you're evaluating.
    4. Select Next: Add/Verify Parameters.
      1. In the Add/Verify Parameters page, enter API Details. This URL represents the API endpoint. For example, https://api.openai.com/v1/chat/completions.
      2. (For WebSocket Connection Only) Enable Supports Streaming to allow WebSocket targets to send streamed responses (that complies with OpenAI standard of streaming over websocket connections).
      3. (For Manual Entry method only) (Rest API and Streaming connections only) Configure the Multi-Turn session parameters. The Multi-Turn session enables sophisticated AI Red Teaming scenarios by maintaining conversation context across multiple turns for LLM target types. Unlike single-turn attacks that send isolated prompts, multi-turn attacks simulate real-world conversational interactions, allowing security teams to test how LLMs handle context, memory, and state across multiple conversation turns. Configure Supports Sessions option to specify whether the API end point supports session management for maintaining conversation context.
        This Multi-Turn session supports two distinct operational modes: stateless mode and stateful mode.
        • To enable stateful mode where session IDs maintain context across requests with the API managing conversation history server-side, set Supports Sessions to Yes. When configured as Yes, you must edit the Multi-Turn Session Configuration settings in Verify & Edit JSON step.
        • To enable stateless mode where the full conversation history is sent with each request, set Supports Sessions to No. When configured as No, you must add the Multi-Turn Configuration settings in Verify & Edit JSON step.
      4. Next, determine if you want to enable HTTP Headers. Use this option to enter any custom HTTP headers required for connection or authentication. Once enabled, a list of configured HTTP Headers appears.
        You can delete an existing header, or, click Add New for a new HTTP header.
      5. (Optional) Configure authentication for the target.
        You can configure authentication for AI Red Teaming to connect to the target API using header-based credentials, payload credentials, or OAuth 2.0.
    5. In the Verify & Edit JSON page, configure the API Response.
      Specify the JSON structure of the request and response.
      The easiest way to configure the Response is to first get a sample response from your target and paste the entire JSON here. Then replace the LLM output with {RESPONSE}. This is the value that will be used to determine if the response was a successful attack or a failed attack. For example, if the response structure is as follows:
      
{
  "id": "",
  "object": "chat.completion",
  "created": 1732070187,
  "model": "meta-llama-3.1",
  "choices": [
    {
      "index": 0,
      "message": {
        "role": "assistant",
        "content": "It seems like you haven't provided any input yet. Could you please provide more context or information about what you need help with?"
      },
      "finish_reason": "stop",
      "logprobs": null
    }
  ]
}
      Paste the payload as it and replace the value for the key content with {RESPONSE}, like as follows:
      
{
  "id": "",
  "object": "chat.completion",
  "created": 1732070187,
  "model": "meta-llama-3.1",
  "choices": [
    {
      "index": 0,
      "message": { "role": "assistant", "content": "{RESPONSE}" },
      "finish_reason": "stop",
      "logprobs": null
    }
  ]
}
      (Optional) (Rest API and Streaming connections only) Multi-Turn Configuration
      (When Supports Sessions is configured as No) Configure the Multi-Turn Configuration parameters optionally. You can enable or disable Multi-Turn Configuration.
      Refer the relevant target API documentation to determine the appropriate roles for each specific target. Below are sample targets with their corresponding roles provided as examples.
      • For OpenAI target types, edit the Multi-Turn Configuration by setting the "assistant_role" field to "assistant" in the JSON configuration.
      • For Gemini target types, edit the Multi-Turn Configuration by setting the "assistant_role" field to "model" in the JSON configuration.
      (Optional) (Rest API and Streaming connections only) Multi-Turn Session Configuration
      (When Supports Sessions is configured as Yes) Configure the Multi-Turn Session Configuration optionally. This configuration enables AI Red Teaming capabilities for the target Interactions API endpoint with session management and streaming response support. You can enable or disable Multi-Turn Session Configuration.
      Refer the relevant target API documentation to determine the appropriate session fields for each specific target. Below are sample targets with their corresponding session fields provided as examples.
      The below example configuration is provided for Gemini and OpenAI target types.
      Multi-Turn Session ConfigurationDescription
      response_id_fieldThe unique identifier for the response.
      request_id_fieldThe ID of the previous interaction (if any).
    6. (Optional) Enable Supports File Upload if your target accepts file uploads and to perform file-based attack Testing. It enables AI Red Teaming to deliver documents with malicious prompts alongside text-based attacks when running an Attack Library scan against this target. PDF and Markdown (MD) file formats are supported.
      File-based Attack Testing is supported for REST API, Streaming, and WebSocket connection methods on Application and Agent target types.
      When you enable Supports File Upload, configure how AI Red Teaming delivers file content in the API request body. The configuration section expands below the Request JSON body.
      1. (If you used cURL import) Review the auto-detected file field mapping. AI Red Teaming detects the file content field and MIME type field from your cURL command and displays them for confirmation. Select Edit Mapping to adjust the detected field names if the auto-detection result is incorrect.
      2. (If you used Manual Entry) Configure the file delivery fields manually in the the Request JSON body:
        Request JSON FieldDescription
        files
        The JSON key in your request body where AI Red Teaming places the file content.
        It is an array of file objects that AI Red Teaming delivers to the target as part of a file-based attack. When a scan runs with Supports File Upload enabled, AI Red Teaming populates this array with malicious documents from its curated library (PDFs or MD files).
        mime_typeThe JSON key in your request body where AI Red Teaming places the file MIME type. The {mime_type} placeholder is replaced with the appropriate type at scan time.
        dataThe actual content of the file with malicious prompts that is base64-encoded. The {data} placeholder is replaced at scan time with the base64-encoded contents of the attack document.
      3. Review the request JSON preview to confirm how a file attack will be formatted in the API request body before saving.
    7. Click Next: Advanced Configurations.
      In the Advanced Configurations page you'll configure Rate Limits and set Guardrails/Content Filters.
      For WebSocket connections, only endpoint rate limiting can be configured. Rate limits and content guardrails error handling are not currently supported.
    8. (Optional) Enable Rate Limits for applications on the target endpoint.
      1. Specify the Endpoint Rate Limit. This value represents the maximum number of allowed requests per minute for the specified endpoint.
      2. (Rest API and Streaming Connection Method only) Specify the Endpoint Rate Limit Error Code. This field represents the error code your system uses for rate limiting violations.
      3. (Rest API and Streaming Connection Method only) Provide a Sample Exception JSON.
    9. (Optional) (Rest API and Streaming Connection Method only) Enable Guardrails/Content Filters. These fields are used for output guardrails or content filters applicable on the target endpoint.
      1. (Rest API and Streaming Connection Method only) Specify the Error code for Guardrails or Content Filters. This field represents the error code your system uses when a response is prevented by filters or safeguards.
      2. (Rest API and Streaming Connection Method only) Provide a Sample Exception JSON.
      3. Select Validate Target.
        Only after a target is successfully validated, you can add target background information.
    10. (Mandatory) Configure Target Background.
      AI Red Teaming collects and organizes the Target background information about your target endpoint. Target background encompasses mandatory elements such as, industry classification, use case definition, and competitive landscape analysis, along with optional documentation uploads including company policy documents and other relevant materials.
      Target background information is mandatory for all the target types.
      1. Add Industry information.
      2. Add Use Case, that is specific role of the target such as customer service or additional comments.
      3. (Optional) Select Add Competitor to add the list of Competitors.
      4. Enable Agentic Profiling.
        Agentic Profiling in AI Red Teaming helps gather all relevant context about a target endpoint such as its business use case, background, key capabilities, technical architecture and other critical information. This is carried out by an autonomous agent probing the target endpoint with the right prompts. All information gathered through this exercise is presented as the Target's profile and is used downstream in AI Red Teaming Scans using the Agent.
    11. Select Submit.
      Once the target is created you can start a scan, or view previously created targets:

    Attach a Custom Target Adapter to a Target

    After activating a custom target adapter, attach it to one or more targets by selecting Custom Adapter as the connection method and configuring the channel and optional overrides.
    Where Can I Use This?What Do I Need?
    • Prisma AIRS (AI Red Teaming)
    Before attaching a custom adapter to a target, complete the following:
    • Set up prerequisites—The Network Channel Helm chart must be at v1.4.0 or later, the adapter sidecar must be enabled, and a Network Channel must exist for the target's network.
      An active Network Channel is required to host and execute adapter code.
    • Build the Custom Adapter Code/Script—Write and test your Python adapter functions before uploading.
    • Test and activate the adapter—The adapter must be active in the Custom Adapters list before it can be selected here.
    You can point multiple targets at the same custom target adapter, each with its own overrides and channel. When you update and reactivate a shared adapter, every target using it picks up the change on its next scan. You do not need to edit each target individually. Scans in progress use the adapter version that was active when the scan started. Changes take effect from the next scan onward.
    Attaching the adapter to a target is the final step in the custom adapter setup. For an overview of the complete workflow, see Custom Target Adapters.
    1. In the AI Red Teaming, create a new target or open an existing target for editing.
    2. After specifying Target Details, set the Connection Method to Custom Adapter.
    3. Configure Endpoint Accessibility. This field indicates if your endpoint is Public or Private (secured within a private network).
      1. Select IP Allowlist. To establish a successful connection, certain IP addresses must be allowed by your firewall. These IP addresses are region-specific, so you should allow the specific IP addresses shown in the tooltip within your interface.
      2. Select Network Channels to configure private channels for endpoint connectivity. If a network channel was previously configured, it appears as an option in a drop-down menu.
        Network channel is required for both private endpoint accessibility and custom adapter code execution. Therefore the network channel you select for endpoint accessibility in this step, is automatically selected for custom adapter in the next step.
    4. Configure Custom Adapter.
      1. In Custom Adapter, select the adapter you activated.
      2. In Network Channel, select the channel for this target's network.
      3. (Optional) Configure per-target value overrides.
        In the Variable Overrides section, enter any variable or secret values that should replace the adapter's defaults for this specific target. For example, a different base_url for a staging environment or a different api_key for another account. Values you do not override fall back to the adapter's defaults at scan time.
      4. (Optional) Enable Supports Multi-Turn.
        Multi-turn support is disabled by default. Enable it only if your target supports multi-turn conversations and your adapter handles them. Enabling this setting allows scans to run multi-turn attacks against the target.
    5. (Optional) Select Next: Advanced Configurations.
      1. Enter the Successful Connection Message (test message) that the AI Red Teaming validation system sends to your adapter when you run Validate Target.
      2. Configure the endpoint Rate Limits. Enter the maximum number of allowed requests per minute for this endpoint.
      3. Enable Guardrails/Content Filters. These fields are used for output guardrails or content filters applicable on the target endpoint.
          • Specify the Error code for Guardrails or Content Filters. This field represents the error code your system uses when a response is prevented by filters or safeguards.
          • Provide a Sample Exception JSON.
    6. Select Validate Target.
      Only after a target is successfully validated, you can add target background information.
    7. (Mandatory) Configure Target Background.
      AI Red Teaming collects and organizes the Target background information about your target endpoint. Target background encompasses mandatory elements such as, industry classification, use case definition, and competitive landscape analysis, along with optional documentation uploads including company policy documents and other relevant materials.
      Target background information is mandatory for all the target types.
      1. Add Industry information.
      2. Add Use Case, that is specific role of the target such as customer service or additional comments.
      3. (Optional) Select Add Competitor to add the list of Competitors.
      4. Enable Agentic Profiling.
        Agentic Profiling in AI Red Teaming helps gather all relevant context about a target endpoint such as its business use case, background, key capabilities, technical architecture and other critical information. This is carried out by an autonomous agent probing the target endpoint with the right prompts. All information gathered through this exercise is presented as the Target's profile and is used downstream in AI Red Teaming Scans using the Agent.
    8. Select Submit.
      The target is now connected through the adapter and is available for scanning.

    (For Agent Only) Microsoft Copilot Studio Connection Method

    This topic introduces Microsoft Copilot Studio agents and the components needed to configure red teaming assessments.
    Microsoft Copilot Studio is a low-code development platform that enables you to build conversational AI agents for your enterprise. These agents can interact with users through natural language, execute business workflows, and integrate with various Microsoft services and third-party applications. When you deploy Copilot Studio agents in your environment, they often have access to sensitive internal tools, data sources, and automation capabilities through Power Automate flows, making them potential targets for security vulnerabilities that require thorough assessment.
    When you configure a Microsoft Copilot Studio agent as a target in AI Red Teaming, the system establishes a native connection to your Copilot deployment through the Power Platform APIs. This connection enables the AI Red Teaming engine to interact with your agent in the same manner that end users would, sending conversational inputs and observing the agent's responses and tool invocations.
    When you connect to Microsoft Copilot Studio agents through AI Red Teaming, you must authenticate using delegated permissions as required by the Power Platform APIs. This authentication flow necessitates that you physically log in through Microsoft's login page to verify your identity and provide consent for the application to act on your behalf. Service-to-service authentication is not available for this integration, as support for this capability depends on Microsoft's own implementation roadmap and timeline for enabling application permissions in the Power Platform APIs. When adding a MS Copilot Studio agent as your target, you can use either No Authentication or Authenticate using Microsoft.
    Prerequisites
    Register your application in Microsoft Entra ID and configure Microsoft Copilot Studio authentication to enable AI Red Teaming to access and test protected resources.
    1. After specifying Target Details, set the Connection Method to Microsoft Copilot Studio.
    2. Get the Agent information.
      1. Login to https://copilotstudio.microsoft.com/.
      2. On the left panel, click on Agents.
      3. Search for your agent.
      4. Select your agent and then Settings.
      5. Navigate to AdvancedMetadata.
      6. Make a note of the Environment ID and Schema Name for future reference.
      7. Keep a record of the Tenant ID.
        The agent and application registration that you will create should be in the same tenant.
    3. Configure Endpoint Accessibility. This field indicates if your endpoint is Public or Private (secured within a private network).
    4. Select Add/Verify Parameters.
      Microsoft Copilot Studio agents currently utilize Power Platform APIs that exclusively support delegated permissions, requiring you to authenticate through Microsoft's login page to verify their identity and grant consent for the app to act on their behalf. Service-to-Service authentication is not currently supported and depends on Microsoft's future implementation roadmap.
      1. Configure Access Credentials.
        1. Client ID—The application identifier assigned to your registered application in Azure Active Directory. This ID uniquely identifies the AI Red Teaming application when it requests access to your Copilot Studio agent on your behalf. You obtain the Client ID when you register an application in the Azure Portal to enable API access.
        2. Secret—The confidential credential associated with your registered application that proves the application's identity during the authentication process. This secret works in combination with the Client ID to securely authenticate API requests to your Copilot Studio agent through the Power Platform APIs. You generate the Client Secret in the Azure Portal when configuring your application registration, and you should treat it as a password that must be kept secure.
        3. Tenant ID—The unique identifier for your Microsoft Azure Active Directory tenant. This ID specifies which organizational directory contains your Copilot Studio resources and determines the authentication boundary for accessing your agents. You can find your Tenant ID in the Azure Portal under Azure Active Directory properties.
      2. Add Agent Configuration.
        1. Schema Name—The unique identifier for your specific Copilot Studio agent within your Microsoft environment. This name corresponds to the schema name assigned to your copilot when it was created in Copilot Studio and is used to route API requests to the correct agent instance.
        2. Environment ID—The unique identifier for the Power Platform environment where your Copilot Studio agent is deployed. This ID specifies which organizational environment contains your copilot resources and ensures that Prisma AIRS connects to the correct deployment instance.
      Following message is displayed when the authentication is successful.
    5. Click Next: Advanced Configurations.
      In the Advanced Configurations page you'll configure Rate Limits and set Guardrails/Content Filters.
    6. (Optional) Enable Rate Limits for applications on the target endpoint.
      1. Specify the Endpoint Rate Limit. This value represents the maximum number of allowed requests per minute for the specified endpoint.
      2. Specify the Endpoint Rate Limit Error Code. This field represents the error code your system uses for rate limiting violations.
      3. Provide a Sample Exception JSON.
    7. (Optional) Enable Guardrails/Content Filters. These fields are used for output guardrails or content filters applicable on the target endpoint.
      1. Specify the Error code for Guardrails or Content Filters. This field represents the error code your system uses when a response is prevented by filters or safeguards.
      2. Provide a Sample Exception JSON.
      3. Select Validate Target.
        Only after a target is successfully validated, you can add target background information.
    8. (Mandatory) Configure Target Background.
      AI Red Teaming collects and organizes the Target background information about your target endpoint. Target background encompasses mandatory elements such as, industry classification, use case definition, and competitive landscape analysis, along with optional documentation uploads including company policy documents and other relevant materials.
      Target background information is mandatory for all the target types.
      1. Add Industry information.
      2. Add Use Case, that is specific role of the target such as customer service or additional comments.
      3. (Optional) Select Add Competitor to add the list of Competitors.
      4. Enable Agentic Profiling.
        Agentic Profiling in AI Red Teaming helps gather all relevant context about a target endpoint such as its business use case, background, key capabilities, technical architecture and other critical information. This is carried out by an autonomous agent probing the target endpoint with the right prompts. All information gathered through this exercise is presented as the Target's profile and is used downstream in AI Red Teaming Scans using the Agent.
    9. Select Submit.
      Once the target is created you can start a scan, or view previously created targets:

    © 2026 Palo Alto Networks, Inc. All rights reserved.