Autonomous Digital Experience Management (ADEM) - Detailed Summary

What is ADEM?

Autonomous Digital Experience Management (ADEM) is a Palo Alto Networks capability integrated within its SASE solution (primarily Prisma Access and Strata Cloud Manager). It provides native, end-to-end visibility and actionable insights into the digital experience of users accessing applications, regardless of user location (office, home, remote) or application hosting location (SaaS, IaaS, data center).

ADEM continuously monitors the entire service delivery path, segment by segment: Device , WiFi , LAN , Internet (ISP) , Prisma Access , and the Application itself. It uses a variety of monitoring techniques (synthetic tests, real user monitoring, endpoint telemetry) to establish performance baselines, detect degradations, identify root causes, and provide suggestions for remediation.

ADEM functionality is built into the GlobalProtect Client for mobile users and can leverage agents on Prisma SD-WAN ION devices or NGFWs with an SD-WAN subscription for remote site monitoring.

Licensing & Management: Using ADEM requires appropriate licenses. This typically includes a base Prisma Access license plus an ADEM add-on (like ADEM Observability or AI-Powered ADEM) or Strata Cloud Manager Pro tier. ADEM data and configuration are primarily accessed and managed via Strata Cloud Manager (SCM) through the Palo Alto Networks Hub, even for Prisma Access deployments managed by Panorama.

ADEM Monitoring Capabilities

ADEM gathers performance and health data using several methods:

Monitoring for Mobile Users (via GlobalProtect Agent)

Monitoring for Remote Sites (via ION/NGFW Agent)

Monitored Paths from Remote Sites 

flowchart TD
    subgraph Remote_Site["Remote Site (ION/NGFW)"]
        Device(SD-WAN Device)
    end
    subgraph Paths
        PA(Prisma Access Path \n Standard VPN)
        SF(Secure Fabric Path \n DC VPN Tunnel)
        DA(Direct Access Path \n Local Internet)
    end
    subgraph Destinations
        App_PA(App via Prisma Access)
        App_DC(Internal App via DC)
        App_INET(SaaS/Internet App)
    end

    Device -- Synthetic/Real Traffic --> PA --> App_PA
    Device -- Synthetic/Real Traffic --> SF --> App_DC
    Device -- Synthetic/Real Traffic --> DA --> App_INET

    style Remote_Site fill:#e9ecef,stroke:#333
    style Destinations fill:#fff3cd,stroke:#333

Key Metrics & Experience Score Calculation

ADEM synthesizes diverse metrics into an Experience Score to gauge application performance quality for users and sites.

Experience Score Root Cause Segments 

flowchart TD
    A[User Interaction/Request] --> B(Device)
    B --> C(WiFi)
    C --> D(Local Network)
    D --> E(Internet/ISP)
    E --> F(Prisma Access)
    F --> G(Application)
    G --> H[Response/Experience]

    style B fill:#f8d7da,stroke:#dc3545
    style C fill:#f8d7da,stroke:#dc3545
    style D fill:#f8d7da,stroke:#dc3545
    style E fill:#f8d7da,stroke:#dc3545
    style F fill:#e7f3fe,stroke:#29abe2
    style G fill:#fff3cd,stroke:#ffc107

    %% note right of G
    %% ADEM analyzes performance across these segments to identify bottlenecks.

Configuration Highlights

Enabling ADEM

Application Tests (Synthetic Monitoring Setup)

Application tests simulate user interaction to proactively monitor application availability and performance.

  1. Navigate to Insights > Application Experience > Application Tests in Strata Cloud Manager.
  2. Click Create Application Test .
  3. Provide the Application Domain URL / Target IP Address . ADEM validates the target.
  4. Select the Source :
    • Mobile Users: Choose 'All Users' (default for licensed users) or 'Custom' to select specific users/groups.
    • Remote Networks: Select specific licensed remote sites (ION/NGFW).
    • Prisma Access Locations: Select specific Prisma Access locations to run tests from the cloud infrastructure itself.
  5. Configure Advanced Options :
    • Network Test Options: Primarily for TCP tests. Port defaults to 443. Critical setting: Split Tunnel checkbox – select this *only* if the application is configured to be split tunneled in the corresponding GlobalProtect configuration.
    • Web Test Options: Enable/disable HTTP/S tests (enabled by default for web apps). Option to override default ports (80/443). Can add a custom URL path or HTTP headers. Option to ignore SSL certificate trust issues.
    • Path Visualization Options: Enable/disable per-hop performance metrics (enabled by default). Select Protocol (TCP/ICMP) for traceroute - *Note:* If 'Split Tunnel' is checked in Network Options, the protocol choice here is automatically determined by the endpoint OS (Windows uses TCP, macOS uses ICMP for split tunnels) and cannot be manually selected. For non-split-tunneled apps, TCP or ICMP can be chosen.
    • Remote Sites Test Options: (If Remote Sites are selected as source) Choose to monitor only active paths or both active and backup paths as defined in the Prisma SD-WAN path policy. Optionally specify App-IDs, Network Context, or Source Prefixes to align tests with specific SD-WAN rules (requires specific agent/ION versions).
  6. Save the test. Tests are assigned priority based on creation order (1, 2, 3...).

Application Test Configuration Flow 

graph TD
    A[Start: Insights > App Exp > App Tests] --> B(Click 'Create Application Test')
    B --> C[Define Target: URL/IP]
    C --> D{Select Source}
    D -- Mobile_Users --> E[All Users or Custom Users/Groups]
    D -- Remote_Sites --> F[All Sites or Specific Sites]
    D -- PA_Locations --> G[Specific PA Locations]
    E --> H[Configure Advanced Options: Network, Web, Path Vis]
    F --> H
    G --> H
    H --> I(Save Test - Priority Assigned)
    I --> J[Config pushed to Agents/Sites]
    J --> K(Tests Begin Running)

    style A fill:#lightblue
    style K fill:#lightgreen

Application Suites

Application Suites allow grouping related domains or application tests for aggregated monitoring and easier analysis.

ADEM Self-Serve (End-User Remediation)

This feature empowers end users by providing notifications and remediation suggestions for common performance issues they can potentially resolve themselves.

Self-Serve Notification Logic 

sequenceDiagram
    participant Agent as ADEM Agent (on Endpoint)
    participant Portal as ADEM Portal/Service
    participant User as End User
    participant Admin as IT Admin

    Admin->>Portal: Enable Self-Serve & Configure Thresholds/Users
    Agent->>Agent: Monitor Device/WiFi/Internet Status
    Agent->>Agent: Check if Threshold Crossed & Notification Interval Passed
    alt Threshold Crossed & Interval OK
        Agent->>Portal: Report Status (Implied)
        Agent->>User: Display Desktop Notification (e.g., High CPU)
        User->>Agent: Click Notification (Optional)
        Agent->>User: Open Application Experience UI with details & remediation
    else Threshold Not Crossed or Within Interval
        Agent->>Agent: Continue Monitoring
    end

Agent Upgrades & Data Collection Details

UCaaS Integrations (Zoom / Microsoft Teams)

ADEM integrates with Zoom and Microsoft Teams to provide deeper insights into unified communications quality by correlating ADEM's network/endpoint data with vendor-provided call quality metrics (CQM).

Viewing ADEM Data (Dashboards & Monitoring)

Admins access ADEM insights through various dashboards within Strata Cloud Manager (SCM) accessed via the Hub.

Data Flow for Viewing 

graph TD
    A["ADEM Agent (GP/ION/NGFW)"] --> B["Data Collection"]
    B -- Telemetry --> C{"ADEM Portal / Cloud Service"}
    C -- Processed Data --> D["Cortex Data Lake (Implied Storage)"]
    C -- Insights Feed --> E["Strata Cloud Manager / Hub"]
    subgraph SCM_UI_Views
        E --> F["Insights - App Experience"]
        E --> G["Insights - Activity Insights - Users"]
        E --> H["Monitor - Branch Sites"]
        E --> I["Monitor - PA Locations"]
        E --> J["Monitor - Access Analyzer"]
        E --> K["SASE Health - Experience"]
    end
    F --> L["Admin Views Data"]
    G --> L
    H --> L
    I --> L
    J --> L
    K --> L

    style A fill:#d4edda,stroke:#28a745
    style C fill:#e7f3fe,stroke:#29abe2
    style E fill:#e9ecef,stroke:#6c757d
    style L fill:#fff3cd,stroke:#ffc107

Gotchas & Important Considerations

  • Firewall Rules for Synthetics: Ensure downstream firewalls (including Prisma Access policies if traffic routes there) explicitly allow the protocols/ports used by ADEM synthetic tests (ICMP, TCP/443 by default, potentially HTTP/80, or custom ports defined in the test) towards the target application IPs. 'Application-default' service settings in policies might block tests.
  • Split Tunnel Configuration Accuracy: The 'Split Tunnel' checkbox in the Application Test configuration *must* accurately reflect the GlobalProtect configuration for that application. Incorrect configuration impacts Path Visualization data (protocol used) and potentially test reachability. Remember Win agent uses TCP, macOS uses ICMP for split tunnel path vis by default.
  • Test Limits & Priority Impacts: Each remote site device (ION/NGFW) has a maximum number of synthetic tests it can run concurrently (based on model/size). Tests are pushed based on priority (lowest number first). If a site hits its limit, lower-priority tests assigned to it will be moved to an 'Excluded Remote Sites' state for that test and will not run, potentially impacting monitoring coverage. Prioritize critical application tests.
  • RUM Data Dependencies: Real User Monitoring data requires users to have the ADEM Browser Plugin installed *and* actively browse the target web application domain. Data won't exist for non-web apps or users without the plugin. ADEM score calculation prioritizes RUM over Synthetic data when both exist for a mobile user.
  • Self-Serve Notification Logic: Understand the suppression rules: no notifications if the agent is offline >24hrs, or for WiFi/Internet alerts if GP is connected internally. Thresholds must be crossed *after* the 30-minute cooldown period for repeat CPU/Memory/WiFi notifications.
  • EDR/AV Exclusions Crucial: Failure to whitelist required ADEM FQDNs (for portal comms) and processes (agent executables, helpers like `crypter`, `mtr`, `curl`, etc.) in EDR/Antivirus solutions is a common cause of ADEM not functioning correctly or failing to report data. Consult the documentation for the full list.
  • GP Log Collection Certificate Renewal: This certificate is critical for the GP agent (and thus ADEM) to communicate with the portal. If it expires, data collection stops. Admins must manually renew it via Panorama (Cloud Services > Configuration) or Strata Cloud Manager (Manage > Certificate Management) before expiration.
  • UCaaS Integration Prerequisites: Zoom integration requires purchasing the QSS license *from Zoom*. Teams integration requires Teams Admin permissions for the initial authorization workflow. User IDs should match between GP login and UCaaS login for best correlation.
  • Data Latency & Refresh Rates: While ADEM aims for near real-time insights, understand there are intervals for data collection (e.g., endpoint telemetry), synthetic test execution (e.g., every 5 mins for path traces, longer for web tests depending on config), RUM data processing, and dashboard refresh rates (e.g., App Experience UI refreshes ~30 seconds). Configuration changes (like adding users to test groups) can take time to propagate (up to 6 hours mentioned).
  • Access Analyzer Data Sources: Access Analyzer leverages ADEM data but also pulls from Prisma Access topology, firewall config, operational state (routing, FIB), authentication logs, and traffic logs. Its analysis depends on the availability and timeliness of these multiple sources.