# US 2025/0097271 A1 · Security platform with external inline processing of assembled selected traffic > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2025/0097271 A1 - Document ID: US20250097271A1 - Status: Published application - Kind: A1 - Application number: 18/970,320 - Filed: 2024-12-05 - Published: 2025-03-20 - Earliest claimed: 2020-08-31 - Assignees: Palo Alto Networks, Inc. - Applicants: Palo Alto Networks, Inc. - Inventors: Suiqiang Deng; Jiangxia Liu - Web page: https://patentgrep.com/patent/US20250097271A1 ## CPC - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - G06F 21/16: Program or content traceability, e.g. by watermarking - G06F 21/554: {involving event detection and direct action} - G06F 21/566: {Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities} - H04L 63/0245: {Filtering by information in the payload} - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - H04L 63/1433: {Vulnerability analysis} - G06F 2221/2115: Third party - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract Techniques for a security platform with external inline processing of assembled selected traffic are disclosed. In some embodiments, a system/method/computer program product for providing a security platform with external inline processing of assembled selected traffic includes monitoring network traffic of a session at a security platform; selecting a subset of the monitored network traffic associated with the session to send to a cloud-based security service for analysis based on a security policy, wherein the selected subset of the monitored network traffic is proxied to the cloud-based security service; and receiving, from the cloud-based security service, results of the analysis based on the security policy, and performing a responsive action based on the results of the analysis based on the security policy. ## Claims ### Claim 1 A system comprising: a processor configured to: detect a file payload in a monitored session at a security platform; proxy a portion of the monitored session to assemble the file payload using an external processing unit; send the assembled file payload to a plurality of cloud-based security services for analysis based on a security policy; and perform a responsive action based on results of the analysis and based on the security policy; and a memory coupled to the processor and configured to provide the processor with instructions. ### Claim 2 (depends on 1) The system recited in claim 1, wherein the external processing unit is located in a cloud network of a security service provider. ### Claim 3 (depends on 1) The system recited in claim 1, wherein the external processing unit is located on-premises of an enterprise customer. ### Claim 4 (depends on 1) The system recited in claim 1, wherein the plurality of cloud-based security services perform a plurality of distinct types of security analysis on the assembled file payload. ### Claim 5 (depends on 1) The system recited in claim 1, wherein the plurality of cloud-based security services perform a plurality of distinct types of security analysis in parallel on the assembled file payload. ### Claim 6 (depends on 1) The system recited in claim 1, wherein the performing of the responsive action comprises to: block the assembled file payload to prevent the assembled file payload from being sent to an original destination. ### Claim 7 (depends on 1) The system recited in claim 1, wherein the performing of the responsive action comprises to: allow the assembled file payload to be sent to an original destination. ### Claim 8 (depends on 1) The system recited in claim 1, wherein the performing of the responsive action comprises to: send a modified version of the assembled file payload to an original destination. ### Claim 9 (depends on 1) The system recited in claim 1, wherein the performing of the responsive action comprises to: send a modified version of the assembled file payload to an original destination, wherein the modified version of the assembled file payload includes an added watermark. ### Claim 10 (depends on 1) The system recited in claim 1, wherein performing of the responsive action comprises to: send an encrypted version of the assembled file payload to an original destination. ### Claim 11 A method, comprising: detecting a file payload in a monitored session at a security platform; proxying a portion of the monitored session to assemble the file payload using an external processing unit; sending the assembled file payload to a plurality of cloud-based security services for analysis based on a security policy; and performing a responsive action based on results of the analysis and based on the security policy. ### Claim 12 (depends on 11) The method of claim 11, wherein the external processing unit is located in a cloud network of a security service provider. ### Claim 13 (depends on 11) The method of claim 11, wherein the external processing unit is located on-premises of an enterprise customer. ### Claim 14 (depends on 11) The method of claim 11, wherein the plurality of cloud-based security services perform a plurality of distinct types of security analysis on the assembled file payload. ### Claim 15 (depends on 11) The method of claim 11, wherein the plurality of cloud-based security services perform a plurality of distinct types of security analysis in parallel on the assembled file payload. ### Claim 16 A computer program product, the computer program product being embodied in a tangible non-transitory computer readable storage medium and comprising computer instructions for: detecting a file payload in a monitored session at a security platform; proxying a portion of the monitored session to assemble the file payload using an external processing unit; sending the assembled file payload to a plurality of cloud-based security services for analysis based on a security policy; and performing a responsive action based on results of the analysis and based on the security policy. ### Claim 17 (depends on 16) The computer program product recited in claim 16, wherein the external processing unit is located in a cloud network of a security service provider. ### Claim 18 (depends on 16) The computer program product recited in claim 16, wherein the external processing unit is located on-premises of an enterprise customer. ### Claim 19 (depends on 16) The computer program product recited in claim 16, wherein the plurality of cloud-based security services perform a plurality of distinct types of security analysis on the assembled file payload. ### Claim 20 (depends on 16) The computer program product recited in claim 16, wherein the plurality of cloud-based security services perform a plurality of distinct types of security analysis in parallel on the assembled file payload.