PrismaCloud IAM

The Prisma Cloud IAM API consists of a set of API endpoints that allow customers to perform CRUD operation on their user profiles.

Identity and Access Management · Prisma Cloud by Palo Alto Networks

Details

IDPrismaCloud IAM
ProviderPalo Alto Networks
CategoryIdentity and Access Management
From Version6.0.0
Docker Imagedemisto/python3:3.12.13.10116658
Supported ModulesAgentix XSIAM EDR Cortex Cloud Cloud Runtime Security

README

Note: This integration should be used as part of our Identity Lifecycle Management premium pack. For more information, please refer to the Identity Lifecycle Management article.

The Prisma Cloud IAM API consists of a set of API endpoints that allow customers to perform CRUD operation on their user profiles.

Configure PrismaCloud IAM in Cortex

Parameter Description Required
Base URL   True
Username   True
Password   True
Customer name If you are a multi-tenant user you will also need to provide the customerName. False
Trust any certificate (not secure)   False
Use system proxy settings   False
Allow creating users   False
Allow updating users   False
Allow enabling users   False
Allow disabling users   False
Automatically create user if not found in update command   False
Incoming Mapper   True
Outgoing Mapper Cortex XSOAR only parameter. False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

iam-create-user

Creates a user.

Base Command

iam-create-user

Input

Argument Name Description Required
user-profile User Profile indicator details. Required
allow-enable When set to true, after the command execution the status of the user in the 3rd-party integration will be active. Possible values are: true, false. Default is true. Optional

Context Output

Path Type Description
IAM.Vendor.active Boolean When true, indicates that the employee’s status is active in the 3rd-party integration.
IAM.Vendor.brand String Name of the integration.
IAM.Vendor.details string Provides the raw data from the 3rd-party integration.
IAM.Vendor.email String The employee’s email address.
IAM.Vendor.errorCode Number HTTP error response code.
IAM.Vendor.errorMessage String Reason why the API failed.
IAM.Vendor.id String The employee’s user ID in the app.
IAM.Vendor.instanceName string Name of the integration instance.
IAM.Vendor.success Boolean When true, indicates that the command was executed successfully.
IAM.Vendor.username String The employee’s username in the app.

Command Example

!iam-create-user user-profile=`{"email": "john.doe@example.com", "givenname": "test", "surname": "test"}`

Context Example

{
    "IAM": {
        "UserProfile": {
            "email": "john.doe@example.com",
            "givenname": "test",
            "surname": "test"
        },
        "Vendor": {
            "action": "update",
            "active": null,
            "brand": "PrismaCloudIAM",
            "details": {
                "email": "john.doe@example.com",
                "firstName": "test",
                "lastName": "test",
                "roleId": "some_role_id",
                "timeZone": "America/Los_Angeles"
            },
            "email": "john.doe@example.com",
            "errorCode": null,
            "errorMessage": "",
            "id": null,
            "instanceName": "PrismaCloudIAM_instance_1",
            "reason": "",
            "skipped": false,
            "success": true,
            "username": null
        }
    }
}

Human Readable Output

Update User Results (PrismaCloudIAM)

brand instanceName success email details
PrismaCloudIAM PrismaCloudIAM_instance_1 true john.doe@example.com email: john.doe@example.com
firstName: test
lastName: test
roleId: some_role_id
timeZone: America/Los_Angeles

iam-update-user

Updates an existing user with the data passed in the user-profile argument.

Base Command

iam-update-user

Input

Argument Name Description Required
user-profile A User Profile indicator. Required
allow-enable When set to true, after the command execution the status of the user in the 3rd-party integration will be active. Possible values are: true, false. Default is true. Optional

Context Output

Path Type Description
IAM.Vendor.active Boolean When true, indicates that the employee’s status is active in the 3rd-party integration.
IAM.Vendor.brand String Name of the integration.
IAM.Vendor.details string Provides the raw data from the 3rd-party integration.
IAM.Vendor.email String The employee’s email address.
IAM.Vendor.errorCode Number HTTP error response code.
IAM.Vendor.errorMessage String Reason why the API failed.
IAM.Vendor.id String The employee’s user ID in the app.
IAM.Vendor.instanceName string Name of the integration instance.
IAM.Vendor.success Boolean When true, indicates that the command was executed successfully.
IAM.Vendor.username String The employee’s username in the app.

Command Example

!iam-update-user user-profile=`{"email": "john.doe@example.com", "givenname": "John"}`

Context Example

{
    "IAM": {
        "UserProfile": {
            "email": "john.doe@example.com",
            "givenname": "John"
        },
        "Vendor": {
            "action": "update",
            "active": null,
            "brand": "PrismaCloudIAM",
            "details": {
                "email": "john.doe@example.com",
                "firstName": "John",
                "roleId": "some_role_id",
                "timeZone": "America/Los_Angeles"
            },
            "email": "john.doe@example.com",
            "errorCode": null,
            "errorMessage": "",
            "id": null,
            "instanceName": "PrismaCloudIAM_instance_1",
            "reason": "",
            "skipped": false,
            "success": true,
            "username": null
        }
    }
}

Human Readable Output

Update User Results (PrismaCloudIAM)

brand instanceName success email details
PrismaCloudIAM PrismaCloudIAM_instance_1 true john.doe@example.com email: john.doe@example.com
firstName: John
roleId: some_role_id
timeZone: America/Los_Angeles

iam-get-user

Retrieves a single user resource.

Base Command

iam-get-user

Input

Argument Name Description Required
user-profile A User Profile indicator. Required

Context Output

Path Type Description
IAM.Vendor.active Boolean When true, indicates that the employee’s status is active in the 3rd-party integration.
IAM.Vendor.brand String Name of the integration.
IAM.Vendor.details string Provides the raw data from the 3rd-party integration.
IAM.Vendor.email String The employee’s email address.
IAM.Vendor.errorCode Number HTTP error response code.
IAM.Vendor.errorMessage String Reason why the API failed.
IAM.Vendor.id String The employee’s user ID in the app.
IAM.Vendor.instanceName string Name of the integration instance.
IAM.Vendor.success Boolean When true, indicates that the command was executed successfully.
IAM.Vendor.username String The employee’s username in the app.

Command Example

!iam-get-user user-profile=`{"email": "john.doe@example.com"}`

Context Example

{
    "IAM": {
        "UserProfile": {
            "Display Name": "test test",
            "Email": "john.doe@example.com",
            "Given Name": "test",
            "Surname": "test"
        },
        "Vendor": {
            "action": "get",
            "active": true,
            "brand": "PrismaCloudIAM",
            "details": {
                "accessKeysAllowed": true,
                "displayName": "test test",
                "email": "john.doe@example.com",
                "enabled": true,
                "firstName": "test",
                "lastLoginTs": -1,
                "lastModifiedBy": "modifier@example.com",
                "lastModifiedTs": 1628152142011,
                "lastName": "test",
                "role": {
                    "id": "some_role_id",
                    "name": "System Admin"
                },
                "roleId": "some_role_id",
                "roleType": "System Admin",
                "timeZone": "America/Los_Angeles"
            },
            "email": null,
            "errorCode": null,
            "errorMessage": "",
            "id": "john.doe@example.com",
            "instanceName": "PrismaCloudIAM_instance_1",
            "reason": "",
            "skipped": false,
            "success": true,
            "username": null
        }
    }
}

Human Readable Output

Get User Results (PrismaCloudIAM)

brand instanceName success active id details
PrismaCloudIAM PrismaCloudIAM_instance_1 true true john.doe@example.com email: john.doe@example.com
firstName: test
lastName: test
timeZone: America/Los_Angeles
enabled: true
roleId: some_role_id
lastModifiedBy: modifier@example.com
lastModifiedTs: 1628152142011
lastLoginTs: -1
role: {“id”: “some_role_id”, “name”: “System Admin”}
roleType: System Admin
displayName: test test
accessKeysAllowed: true

iam-disable-user

Disable an active user.

Base Command

iam-disable-user

Input

Argument Name Description Required
user-profile A User Profile indicator. Required

Context Output

Path Type Description
IAM.Vendor.active Boolean When true, indicates that the employee’s status is active in the 3rd-party integration.
IAM.Vendor.brand String Name of the integration.
IAM.Vendor.details string Provides the raw data from the 3rd-party integration.
IAM.Vendor.email String The employee’s email address.
IAM.Vendor.errorCode Number HTTP error response code.
IAM.Vendor.errorMessage String Reason why the API failed.
IAM.Vendor.id String The employee’s user ID in the app.
IAM.Vendor.instanceName string Name of the integration instance.
IAM.Vendor.success Boolean When true, indicates that the command was executed successfully.
IAM.Vendor.username String The employee’s username in the app.

Command Example

!iam-disable-user user-profile=`{"email": "john.doe@example.com", "givenname": "John"}`

Context Example

{
    "IAM": {
        "UserProfile": {
            "email": "john.doe@example.com",
            "givenname": "John"
        },
        "Vendor": {
            "action": "disable",
            "active": false,
            "brand": "PrismaCloudIAM",
            "details": null,
            "email": "john.doe@example.com",
            "errorCode": null,
            "errorMessage": "",
            "id": null,
            "instanceName": "PrismaCloudIAM_instance_1",
            "reason": "",
            "skipped": false,
            "success": true,
            "username": null
        }
    }
}

Human Readable Output

Disable User Results (PrismaCloudIAM)

brand instanceName success active email
PrismaCloudIAM PrismaCloudIAM_instance_1 true false john.doe@example.com

Outgoing Mapper

  • In the User Profile - PrismaCloudIAM (Outgoing) you should manually configure and map the following required attributes:
    1. timeZone - the time zone of the user.
    2. roleId - the id of the role assigned to the user

Configuration parameters

  • url — Base URL (required)
  • credentials — Username (required)
  • customer_name — Customer name
  • insecure — Trust any certificate (not secure)
  • proxy — Use system proxy settings
  • create_user_enabled — Allow creating users
  • update_user_enabled — Allow updating users
  • enable_user_enabled — Allow enabling users
  • disable_user_enabled — Allow disabling users
  • create_if_not_exists — Automatically create user if not found in update command
  • mapper_in — Incoming Mapper (required)
  • mapper_out — Outgoing Mapper

Commands (5)

  • get-mapping-fields

    Retrieves a User Profile schema, which holds all of the user fields within the application. Used for outgoing-mapping through the Get Schema option.

  • iam-create-user

    Creates a user.

  • iam-disable-user

    Disable an active user.

  • iam-get-user

    Retrieves a single user resource.

  • iam-update-user

    Updates an existing user with the data passed in the user-profile argument.

Source

PrismaCloudIAM.py PrismaCloudIAM_test.py PrismaCloudIAM.yml PrismaCloudIAM_description.md
Download History Raw 
For secure access to Prisma Cloud API, you need a Prisma Cloud API access key. An access key includes an Access Key ID and a Secret Key.
You can use Prisma Cloud UI to generate this required access key.
If you are a multi-tenant user and the body parameters of your login call include a user name and password instead of an access key ID and secret key, then you will also need to provide the Customer name
which can be seen on the tenant menu  in the Prisma Cloud UI.