PrismaCloud v2

Prisma Cloud secures infrastructure, workloads and applications, across the entire cloud-native technology stack.

Network Security · Prisma Cloud by Palo Alto Networks

Configuration parameters

  • url — Server URL (required)
  • credentials — Username / Access Key ID (required)
  • proxy — Use system proxy settings
  • insecure — Trust any certificate (not secure)
  • incidentType — Incident type
  • max_fetch — Maximum number of incidents to fetch
  • first_fetch — First fetch time interval
  • look_back — Advanced: Time in minutes to look back when fetching incidents
  • filters — Fetch only incidents matching these filters
  • isFetch — Fetch incidents
  • mirror_direction — Incident Mirroring Direction
  • close_incident — Close Mirrored XSOAR Incident
  • close_alert — Close Mirrored Prisma Cloud Alert
  • output_old_format — Output results of V1 commands to the context data in the old format

Commands (47)

  • get-modified-remote-data

    Get the list of incidents that were modified since the last update time. This method is used for debugging purposes. The get-modified-remote-data command is used as part of the Mirroring feature that was introduced in Cortex XSOAR version 6.1.

  • get-remote-data

    Get remote data from a remote incident. This method does not update the current incident, and should be used for debugging purposes only.

  • prisma-cloud-access-key-create

    Adds a new access key for the current user. If you have API access, you can create up to two access keys.

  • prisma-cloud-access-key-delete

    Deletes the access key that has the specified ID.

  • prisma-cloud-access-key-disable

    Deactivates the access key that has the specified ID.

  • prisma-cloud-access-key-enable

    Activates the access key that has the specified ID. You cannot activate an expired access key.

  • prisma-cloud-access-keys-list

    Returns all access keys for your tenant if you have a Prisma Cloud System Admin role. Returns just your access keys if you don't have this role.

  • prisma-cloud-account-list

    List accounts.

  • prisma-cloud-account-owner-list

    Get the owners of the provided accounts.

  • prisma-cloud-account-status-get

    Get the statuses of the provided accounts.

  • prisma-cloud-alert-dismiss

    Dismiss or snooze the alerts matching the given filter. Either policy IDs or alert IDs must be provided. When no absolute time nor relative time arguments are provided, the default time range is all times. For snoozing, provide "snooze_unit" and "snooze_value" arguments.

  • prisma-cloud-alert-filter-list

    List the acceptable filters and values for alerts.

  • prisma-cloud-alert-get-details

    Gets the details of an alert based on the alert ID.

  • prisma-cloud-alert-remediate

    Remediates the alert with the specified ID, if that alert is associated with a remediable policy. In order to check what remediation would run, use the "prisma-cloud-remediation-command-list" command first.

  • prisma-cloud-alert-reopen

    Re-open the alerts matching the given filter. Either policy IDs or alert IDs must be provided. When no absolute time nor relative time arguments are provided, the default time range is all times.

  • prisma-cloud-alert-search

    Search alerts on the Prisma Cloud platform. When no absolute time nor relative time arguments are provided, the search will show alerts from the last 7 days.

  • prisma-cloud-asset-alerts-get

    Returns detailed information for the asset alerts with the given ID.

  • prisma-cloud-asset-findings-get

    Returns detailed information for the asset findings with the given ID.

  • prisma-cloud-asset-generic-get

    Returns detailed information for the asset with the given ID.

  • prisma-cloud-asset-get

    Returns detailed information for the asset with the given ID.

  • prisma-cloud-asset-network-get

    Returns detailed information for the asset network with the given ID.

  • prisma-cloud-asset-relationships-get

    Returns detailed information for the asset relationships with the given ID.

  • prisma-cloud-asset-vulnerabilities-get

    Returns detailed information for the asset vulnerabilities with the given ID.

  • prisma-cloud-code-issues-list

    Retrieves the code errors detected by Application Security during periodic scans. At least one filtering argument is required, excluding `search_scopes`, `search_term`, and `limit`. For example, `fixable_only` or 'branch`.

  • prisma-cloud-config-search

    Search configuration inventory on the Prisma Cloud platform using RQL language. Use this command for all queries that start with "config". When no absolute time nor relative time arguments are provided, the default time range is all times.

  • prisma-cloud-error-file-list Deprecated

    This command is deprecated. Use prisma-cloud-code-issues-list instead.

  • prisma-cloud-event-search

    Search events inventory on the Prisma Cloud platform using RQL language. Use this command for all queries that start with "event". When no absolute time nor relative time arguments are provided, the default time range is all times. In order to reduce the returned data, set the "include_resource_json" argument to "false".

  • prisma-cloud-host-finding-list

    Get resource host finding list.

  • prisma-cloud-network-search

    Search networks inventory on the Prisma Cloud platform using RQL language. Use this command for all queries that start with "networks". When no absolute time nor relative time arguments are provided, the default time range is all times. In order to limit the results returning, use "limit search records to" at the end of the RQL query, followed by a value from one of these options: 1, 10, 100, 1000, and 10,000.

  • prisma-cloud-permission-list

    Get permission list. You must provide either "query" or "next_token".

  • prisma-cloud-remediation-command-list

    Generates and returns a list of remediation commands for the specified alerts and policies. Data returned for a successful call include fully constructed commands for remediation. Either a policy ID or alert IDs must be provided. The returned information can be retrieved in the UI by clicking the "Remediate" button under the "Actions" column for supported alerts. When no absolute time nor relative time arguments are provided, the default time range is all times.

  • prisma-cloud-resource-get

    Get resource details.

  • prisma-cloud-resource-list

    Returns all the resource lists. Maps to the Resource Lists under Settings > Resource Lists in the Console UI.

  • prisma-cloud-trigger-scan

    Trigger asynchronous scan of all resources to refresh the current state at Prisma Cloud Code Security. In order to use this command, the "Code Security" module needs to be enabled and accessible in the Prisma Cloud UI.

  • prisma-cloud-user-roles-list

    Retrieves user roles. Maps to Settings > Access Control > Roles in the Console UI.

  • prisma-cloud-users-list

    Lists all users and service accounts for your tenant. Maps to Settings > Access Control > Users in the Console UI.

  • redlock-dismiss-alerts Deprecated

    Dismiss the alerts matching the given filter. Must provide either policy IDs or alert IDs.

  • redlock-get-alert-details Deprecated

    Gets the details of an alert based on the alert ID.

  • redlock-get-remediation-details Deprecated

    Gets remediation details for the given alert.

  • redlock-get-rql-response Deprecated

    Returns the results of an RQL config query.

  • redlock-list-alert-filters Deprecated

    List the acceptable filters and values for alerts.

  • redlock-reopen-alerts Deprecated

    Re-open the alerts matching the given filter. Must provide either policy IDs or alert IDs.

  • redlock-search-alerts Deprecated

    Search alerts on the Prisma Cloud platform. If no time-range arguments are given, the search will filter only alerts from the last 7 days.

  • redlock-search-config Deprecated

    Search the configuration inventory on the Prisma Cloud platform using RQL language.

  • redlock-search-event Deprecated

    Search events on the Prisma Cloud platform using RQL language.

  • redlock-search-network Deprecated

    Search networks on the Prisma Cloud platform using RQL language.

  • update-remote-system

    Updates the remote incident with local incident changes. This method is only used for debugging purposes and will not update the current incident.