PrismaCloud v2
Prisma Cloud secures infrastructure, workloads and applications, across the entire cloud-native technology stack.
Network Security · Prisma Cloud by Palo Alto Networks
Details
| ID | PrismaCloud v2 |
|---|---|
| Provider | Palo Alto Networks |
| Category | Network Security |
| From Version | 6.5.0 |
| Docker Image | demisto/python3:3.12.13.10116658 |
| Supported Modules | Agentix XSIAM EDR Cortex Cloud Cloud Runtime Security |
README
Prisma Cloud secures infrastructure, workloads and applications, across the entire cloud-native technology stack.
This integration was integrated and tested with version 23.2.1 of PrismaCloud
Some changes have been made that might affect your existing content.
If you are upgrading from a previous version of this integration, see Breaking Changes.
Configure Prisma Cloud v2 in Cortex
| Parameter | Description | Required |
|---|---|---|
| Server URL | Prisma Cloud service tenant admin console URL. The URL for the Prisma Cloud service varies depending on the cluster on which your tenant is deployed. For more information see: https://pan.dev/prisma-cloud/api/cspm/api-urls/. | True |
| Username / Access Key ID | True | |
| Password / Access Key Secret | True | |
| Use system proxy settings | False | |
| Trust any certificate (not secure) | False | |
| Incident type | False | |
| Maximum number of incidents to fetch | Maximum is limited to 200. | False |
| First fetch time interval | Date or relative timestamp to start fetching incidents from, in the format of <number> <time unit>. For example, 2 minutes, 12 hours, 6 days, 2 weeks, 3 months, 1 year, ISO timestamp. Default is 3 days. | False |
| Advanced: Time in minutes to look back when fetching incidents | Use this parameter to determine how far back to look in the search for incidents that were created before the last run time and did not match the query when they were created. When choosing to increase this value, duplicate incidents might occur at increase time. | False |
| Fetch only incidents matching these filters | Comma-separated list of filter name and value, in the following format: filtername1=filtervalue1,filtername2=filtervalue2,etc. Names and possible values for filters can be found by running the “prisma-cloud-alert-filter-list” command. | False |
| Fetch incidents | ||
| Incident Mirroring Direction | Choose the direction to mirror the incident: Incoming (from Prisma Cloud to Cortex XSOAR), Outgoing (from Cortex XSOAR to Prisma Cloud), or Incoming and Outgoing (from/to Cortex XSOAR and Prisma Cloud). Cortex XSOAR only parameter. | False |
| Close Mirrored XSOAR Incident | When selected, closing and re-opening the Prisma Cloud alert is mirrored in Cortex XSOAR. Cortex XSOAR only parameter. | False |
| Close Mirrored Prisma Cloud Alert | When selected, closing and re-opening the Cortex XSOAR incident is mirrored in Prisma Cloud. | False |
| Output results of V1 commands to the context data in the old format | False |
Incident Mirroring
You can enable incident mirroring between Cortex XSOAR incidents and Prisma Cloud alerts (available from Cortex XSOAR version 6.0.0).
To setup the mirroring follow these instructions:
- Navigate to Settings > Integrations > Servers & Services.
- Search for Prisma Cloud v2 and select your integration instance.
- Enable Fetches incidents.
- Optional: You can go to the Fetch only incidents matching these filters parameter and select the query to fetch the alerts from Prisma Cloud.
- In the Incident Mirroring Direction parameter, select in which direction the incidents should be mirrored:
- Incoming - Changes in Prisma Cloud Alerts (
status,dismissalNote,reason) will be reflected in Cortex XSOAR incidents. - Outgoing - Changes in Cortex XSOAR incidents will be reflected in Prisma Cloud alerts (
status,reason). - Incoming And Outgoing - Changes in Cortex XSOAR incidents and in Prisma Cloud alerts will be reflected in both directions.
- None - Turns off incident mirroring.
- Incoming - Changes in Prisma Cloud Alerts (
- Optional: Check the Close Mirrored XSOAR Incident integration parameter to close or reopen the Cortex XSOAR incident when the corresponding alert is closed or re-opened in Prisma Cloud.
- Optional: Check the Close Mirrored Prisma Cloud Alert integration parameter to close or reopen the Prisma Cloud alert when the corresponding Cortex XSOAR incident is closed or re-opened.
Newly fetched incidents will be mirrored in the chosen direction. However, this selection does not affect existing incidents.
Important Notes
- To ensure the mirroring works as expected, an incoming mapper is required, to map the expected fields in Cortex XSOAR (you can use the default mapper - Prisma Cloud - Incoming Mapper).
- When mirroring in incidents from Prisma Cloud to Cortex XSOAR:
- When enabling the Close Mirrored XSOAR Incident integration parameter, the field in Prisma Cloud that determines whether the incident was closed or re-opend is the
statusfield.
- When enabling the Close Mirrored XSOAR Incident integration parameter, the field in Prisma Cloud that determines whether the incident was closed or re-opend is the
- When mirroring out incidents from Cortex XSOAR to Prisma Cloud:
- When enabling the Close Mirrored Prisma Cloud Alert integration parameter, the corresponding alert in Prisma Cloud will be closed with a Dismissed status for every reason chosen in the Cortex XSOAR incident (possible reasons are:
False Positive,Duplicate,OtherandResolved). The Reason field of the Prisma Cloud alert will include the original reason selected in Cortex XSOAR and the close notes. - When re-opening a Cortex XSOAR incident with a
ResolvedPrisma Cloud status, the incident will be re-opened, but the alert in Prisma Cloud will remain Resolved due to API limitations.
- When enabling the Close Mirrored Prisma Cloud Alert integration parameter, the corresponding alert in Prisma Cloud will be closed with a Dismissed status for every reason chosen in the Cortex XSOAR incident (possible reasons are:
Commands
You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.
prisma-cloud-alert-dismiss
Dismiss or snooze the alerts matching the given filter. Either policy IDs or alert IDs must be provided. When no absolute time nor relative time arguments are provided, the default time range is all times. For snoozing, provide “snooze_unit” and “snooze_value” arguments.
Base Command
prisma-cloud-alert-dismiss
Input
| Argument Name | Description | Required |
|---|---|---|
| alert_ids | Comma-separated list of alert IDs to be dismissed. | Optional |
| policy_ids | Comma-separated list of policy IDs. | Optional |
| snooze_value | The amount of time for snoozing alert. Both snooze value and unit must be specified if snoozing. | Optional |
| snooze_unit | The time unit for snoozing alert. Both snooze value and unit must be specified if snoozing. Possible values are: hour, day, week, month, year. | Optional |
| dismissal_note | Reason for dismissal. | Required |
| time_range_date_from | Start time for the search. Time is interpreted as UTC. Values can be in either ISO date format, relative time, or epoch timestamp. For example: “2019-10-21T23:45:00 GMT+3” (ISO date format), “3 days” (relative time), 1579039377301 (epoch time). | Optional |
| time_range_date_to | End time for the search. Time is interpreted as UTC. Values can be in either ISO date format, relative time, or epoch timestamp. For example: “2019-10-21T23:45:00 GMT+3” (ISO date format), “3 days” (relative time), 1579039377301 (epoch time). | Optional |
| time_range_unit | The search time unit. The “login” and “epoch” options are only available if “time_range_value” is not provided. Possible values are: hour, day, week, month, year, login, epoch. | Optional |
| time_range_value | The amount of “time_range_unit” to go back in time. For example, 3 days, 5 weeks, etc. | Optional |
| filters | Comma-separated list of filter name and value, in the following format: filtername1=filtervalue1,filtername2=filtervalue2,etc. Names and possible values for filters can be found by running the “prisma-cloud-alert-filter-list” command. | Optional |
Context Output
There is no context output for this command.
Command example
!prisma-cloud-alert-dismiss dismissal_note="from XSOAR" alert_ids=P-464811 snooze_unit=hour snooze_value=1
Human Readable Output
Alerts snoozed successfully
Snooze note: from XSOAR.
Command example
!prisma-cloud-alert-dismiss dismissal_note="from XSOAR" alert_ids=P-469663 time_range_unit=month
Human Readable Output
Alerts dismissed successfully
Dismissal note: from XSOAR.
prisma-cloud-alert-get-details
Gets the details of an alert based on the alert ID.
Base Command
prisma-cloud-alert-get-details
Input
| Argument Name | Description | Required |
|---|---|---|
| alert_id | The alert ID. | Required |
| detailed | Whether to retrieve the entire / trimmed alert model. Possible values are: true, false. Default is true. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| PrismaCloud.Alert.id | String | The alert ID. |
| PrismaCloud.Alert.status | String | The alert status. |
| PrismaCloud.Alert.reason | String | The alert reason. |
| PrismaCloud.Alert.alertTime | Date | The time of the alert. |
| PrismaCloud.Alert.firstSeen | Date | The time the alert was first seen. |
| PrismaCloud.Alert.lastSeen | Date | The time the alert was last seen. |
| PrismaCloud.Alert.eventOccurred | Date | The time the event occurred. |
| PrismaCloud.Alert.alertRules | String | Names of the alert rules that triggered this alert. |
| PrismaCloud.Alert.resource.resourceApiName | String | The resource API name. |
| PrismaCloud.Alert.resource.id | String | The resource ID. |
| PrismaCloud.Alert.resource.account | String | The resource account. |
| PrismaCloud.Alert.resource.accountId | String | The resource account ID. |
| PrismaCloud.Alert.resource.resourceType | String | The resource type. |
| PrismaCloud.Alert.policy.policyId | String | The policy ID. |
| PrismaCloud.Alert.policy.name | String | The policy name. |
| PrismaCloud.Alert.policy.policyType | String | The type of policy. |
| PrismaCloud.Alert.policy.severity | String | The policy severity. |
| PrismaCloud.Alert.policy.recommendation | String | The policy recommendation. |
| PrismaCloud.Alert.policy.remediation.description | String | The policy remediation description. |
| PrismaCloud.Alert.policy.remediation.cliScriptTemplate | String | The policy remediation CLI script template. |
| PrismaCloud.Alert.policy.description | String | The policy description. |
| PrismaCloud.Alert.policy.labels | Unknown | The policy labels. |
| PrismaCloud.Alert.resource.cloudType | String | The resource cloud type. |
| PrismaCloud.Alert.resource.rrn | String | The restricted resource name. |
| PrismaCloud.Alert.resource.regionId | String | The resource region ID. |
| PrismaCloud.Alert.resource.url | String | The resource URL. |
| PrismaCloud.Alert.policy.remediable | Boolean | Whether the policy is remediable. |
| PrismaCloud.Alert.policy.systemDefault | Boolean | Whether the policy is the system default. |
| PrismaCloud.Alert.policy.deleted | Boolean | Whether the policy was deleted. |
Command example
!prisma-cloud-alert-get-details alert_id=P-465020
Context Example
{
"PrismaCloud": {
"Alert": {
"alertRules": [
{
"alertRuleNotificationConfig": [],
"allowAutoRemediate": false,
"enabled": true,
"name": "test",
"notifyOnDismissed": false,
"notifyOnOpen": true,
"notifyOnResolved": false,
"notifyOnSnoozed": false,
"policyScanConfigId": "policy-scan-config-id3",
"scanAll": true,
"target": {
"accountGroups": [],
"excludedAccounts": [],
"regions": [],
"tags": []
}
},
{
"alertRuleNotificationConfig": [],
"allowAutoRemediate": false,
"enabled": true,
"name": "Default Alert Rule",
"notifyOnDismissed": false,
"notifyOnOpen": true,
"notifyOnResolved": false,
"notifyOnSnoozed": false,
"policyScanConfigId": "policy-scan-config-id2",
"scanAll": false,
"target": {
"accountGroups": [],
"excludedAccounts": [],
"regions": [],
"tags": []
}
}
],
"alertTime": "2023-01-25T19:18:22Z",
"dismissalNote": "from XSOAR",
"dismissalUntilTs": -1,
"dismissedBy": "name@company.com",
"firstSeen": "2023-01-25T19:18:22Z",
"history": [
{
"modifiedBy": "name@company.com",
"modifiedOn": 1674987271011,
"reason": "NEW_ALERT",
"status": "open"
}
],
"id": "P-465020",
"lastSeen": "2023-01-29T10:14:31Z",
"metadata": {
"saveSearchId": "save-search-id1"
},
"networkAnomaly": false,
"policy": {
"complianceMetadata": [
{
"complianceId": "compliance-id1",
"customAssigned": false,
"policyId": "a11b2cc3-1111-2222-33aa-a1b23ccc4dd5",
"requirementId": "DSI",
"requirementName": "Data Security & Information Lifecycle Management",
"requirementViewOrder": 5,
"sectionDescription": "Data Inventory / Flows.",
"sectionId": "DSI-02",
"sectionLabel": "CSA CCM",
"sectionViewOrder": 25,
"standardDescription": "Cloud Security Alliance: Cloud Controls Matrix Version 3.0.1",
"standardName": "CSA CCM v3.0.1",
"systemDefault": true
},
{
"complianceId": "compliance-id2",
"customAssigned": false,
"policyId": "a11b2cc3-1111-2222-33aa-a1b23ccc4dd5",
"requirementId": "IAM",
"requirementName": "Identity & Access Management",
"requirementViewOrder": 10,
"sectionDescription": "Third Party Access.",
"sectionId": "IAM-07",
"sectionLabel": "CSA CCM",
"sectionViewOrder": 72,
"standardDescription": "Cloud Security Alliance: Cloud Controls Matrix Version 3.0.1",
"standardName": "CSA CCM v3.0.1",
"systemDefault": true
}
],
"deleted": false,
"description": "This policy identifies GCP VPC Network subnets have disabled Private Google access. Private Google access enables virtual machine instances on a subnet to reach Google APIs and services using an internal IP address rather than an external IP address. Internal (private) IP addresses are internal to Google Cloud Platform and are not routable or reachable over the Internet. You can use Private Google access to allow VMs without Internet access to reach Google APIs, services, and properties that are accessible over HTTP/HTTPS.",
"findingTypes": [],
"labels": [
"Policy Status Review"
],
"lastModifiedBy": "example@gmail.com",
"lastModifiedOn": 1664515792712,
"name": "GCP VPC Network subnets have Private Google access disabled",
"policyId": "a11b2cc3-1111-2222-33aa-a1b23ccc4dd5",
"policyType": "config",
"recommendation": "1. Login to GCP Portal\n2. Go to VPC network (Left Panel)\n3. Select VPC networks\n2. Click on the name of a reported subnet, The 'Subnet details' page will be displayed\n3. Click on 'EDIT' button\n4. Set 'Private Google access' to 'On'\n5. Click on Save",
"remediable": true,
"remediation": {
"cliScriptTemplate": "gcloud compute networks subnets update ${resourceName} --project=${account} --region ${region} --enable-private-ip-google-access",
"description": "This CLI command requires 'compute.networkAdmin' permission. Successful execution will enable GCP VPC Network subnets 'Private Google access'.",
"impact": "enables private-ip-google-access in GCP VPC Network subnets"
},
"severity": "medium",
"systemDefault": true
},
"reason": "USER_DISMISSED",
"resource": {
"account": "mail1@gmail.com",
"accountId": "panw-prisma-cloud",
"additionalInfo": {},
"cloudAccountGroups": [
"Default Account Group"
],
"cloudAccountOwners": [
"mail1@gmail.com"
],
"cloudServiceName": "Google VPC",
"cloudType": "gcp",
"data": {
"creationTimestamp": "2023-01-25T08:52:45.111-08:00",
"fingerprint": "a-fingerprint=",
"gatewayAddress": "1.1.1.1",
"id": "1111111111111111111",
"ipCidrRange": "1.1.1.1/20",
"kind": "compute#subnetwork",
"name": "boombox-network",
"network": "https://some-url",
"privateIpGoogleAccess": false,
"purpose": "PRIVATE",
"region": "https://some-url",
"selfLink": "https://some-url/subnetworks/boombox-network",
"stackType": "IPV4_ONLY"
},
"id": "1111111111111111111",
"internalResourceId": "11111111",
"name": "boombox-network",
"region": "GCP Belgium",
"regionId": "europe-west1",
"resourceApiName": "gcloud-compute-networks-subnets-list",
"resourceConfigJsonAvailable": true,
"resourceDetailsAvailable": true,
"resourceTs": 1676633361033,
"resourceType": "SUBNET",
"rrn": "rrn::name:place:111:a1b2:a%3Ajj55-2023-01-29-09-25",
"unifiedAssetId": "unified-asset-id1"
},
"saveSearchId": "save-search-id3",
"status": "dismissed"
}
}
}
Human Readable Output
Alert P-465020 Details
Alert ID Reason Status Alert Time First Seen Last Seen Policy ID Policy Type Is Policy System Default Is Policy Remediable Policy Name Policy Recommendation Policy Description Policy Severity Policy Remediation Description Policy Remediation CLI Script Policy Labels Resource Type Resource Account Resource Cloud Type Resource RRN Resource ID Resource Account ID Resource Region ID Resource Api Name P-465020 USER_DISMISSED dismissed 2023-01-25T19:18:22Z 2023-01-25T19:18:22Z 2023-01-29T10:14:31Z a11b2cc3-1111-2222-33aa-a1b23ccc4dd5 config true true GCP VPC Network subnets have Private Google access disabled 1. Login to GCP Portal
2. Go to VPC network (Left Panel)
3. Select VPC networks
2. Click on the name of a reported subnet, The ‘Subnet details’ page will be displayed
3. Click on ‘EDIT’ button
4. Set ‘Private Google access’ to ‘On’
5. Click on SaveThis policy identifies GCP VPC Network subnets have disabled Private Google access. Private Google access enables virtual machine instances on a subnet to reach Google APIs and services using an internal IP address rather than an external IP address. Internal (private) IP addresses are internal to Google Cloud Platform and are not routable or reachable over the Internet. You can use Private Google access to allow VMs without Internet access to reach Google APIs, services, and properties that are accessible over HTTP/HTTPS. medium This CLI command requires ‘compute.networkAdmin’ permission. Successful execution will enable GCP VPC Network subnets ‘Private Google access’. gcloud compute networks subnets update ${resourceName} –project=${account} –region ${region} –enable-private-ip-google-access Policy Status Review SUBNET mail1@gmail.com gcp rrn::name:place:111:a1b2:a%3Ajj55-2023-01-29-09-25 1111111111111111111 panw-prisma-cloud europe-west1 gcloud-compute-networks-subnets-list
prisma-cloud-alert-filter-list
List the acceptable filters and values for alerts.
Base Command
prisma-cloud-alert-filter-list
Input
There are no input arguments for this command.
Context Output
| Path | Type | Description |
|---|---|---|
| PrismaCloud.AlertFilters.filterName | String | The filter name. |
| PrismaCloud.AlertFilters.options | String | The filter value options. |
| PrismaCloud.AlertFilters.staticFilter | Unknown | Whether the filter is static. |
Command example
#### Context Example
```json
{
"PrismaCloud": {
"AlertFilters": [
{
"filterName": "policy.name",
"options": [
"GCP Kubernetes Engine Clusters have Master authorized networks disabled"
],
"staticFilter": false
},
{
"filterName": "policy.type",
"options": [
"anomaly",
"audit_event",
"config",
"data",
"iam",
"network",
"workload_incident",
"workload_vulnerability"
],
"staticFilter": true
},
{
"filterName": "policy.label",
"options": [],
"staticFilter": false
},
{
"filterName": "policy.severity",
"options": [
"critical",
"high",
"medium",
"low",
"informational"
],
"staticFilter": true
},
{
"filterName": "policy.complianceStandard",
"options": [],
"staticFilter": false
},
{
"filterName": "policy.complianceRequirement",
"options": [],
"staticFilter": false
},
{
"filterName": "policy.complianceSection",
"options": [],
"staticFilter": false
},
{
"filterName": "cloud.account",
"options": [],
"staticFilter": false
},
{
"filterName": "account.group",
"options": [],
"staticFilter": false
},
{
"filterName": "cloud.region",
"options": [],
"staticFilter": false
},
{
"filterName": "alertRule.name",
"options": [],
"staticFilter": false
},
{
"filterName": "resource.id",
"options": [],
"staticFilter": false
},
{
"filterName": "resource.name",
"options": [],
"staticFilter": false
},
{
"filterName": "resource.type",
"options": [],
"staticFilter": false
},
{
"filterName": "resource.group",
"options": [],
"staticFilter": false
},
{
"filterName": "cloud.service",
"options": [],
"staticFilter": false
},
{
"filterName": "cloud.accountId",
"options": [],
"staticFilter": false
},
{
"filterName": "object.exposure",
"options": [
"private",
"public",
"conditional"
],
"staticFilter": true
},
{
"filterName": "malware",
"options": [
"true"
],
"staticFilter": true
},
{
"filterName": "object.classification",
"options": [],
"staticFilter": false
},
{
"filterName": "object.identifier",
"options": [],
"staticFilter": false
},
{
"filterName": "timeRange.type",
"options": [
"ALERT_STATUS_UPDATED",
"ALERT_UPDATED",
"ALERT_OPENED"
],
"staticFilter": true
},
{
"filterName": "vulnerability.severity",
"options": [
"all",
"high",
"critical",
"low",
"medium"
],
"staticFilter": true
},
{
"filterName": "buildtime.resourceName",
"options": [],
"staticFilter": false
},
{
"filterName": "git.filename",
"options": [],
"staticFilter": false
},
{
"filterName": "git.provider",
"options": [
"github",
"gitlab",
"bitbucket",
"perforce"
],
"staticFilter": false
},
{
"filterName": "git.repository",
"options": [],
"staticFilter": false
},
{
"filterName": "iac.framework",
"options": [
"ttt",
"CloudFormation"
],
"staticFilter": false
},
{
"filterName": "asset.class",
"options": [],
"staticFilter": false
},
{
"filterName": "alert.id",
"options": [],
"staticFilter": false
},
{
"filterName": "policy.subtype",
"options": [
"audit",
"build",
"data_classification",
"dns",
"identity",
"malware",
"network",
"network_config",
"network_event",
"permissions",
"run",
"run_and_build",
"ueba"
],
"staticFilter": true
},
{
"filterName": "alert.status",
"options": [
"dismissed",
"snoozed",
"open",
"resolved"
],
"staticFilter": true
},
{
"filterName": "cloud.type",
"options": [
"alibaba_cloud",
"aws",
"azure",
"gcp",
"oci"
],
"staticFilter": true
},
{
"filterName": "policy.remediable",
"options": [
"true",
"false"
],
"staticFilter": true
}
]
}
}
Human Readable Output
Filter Options
Filter Name Options Static Filter policy.name GCP Kubernetes Engine Clusters have Master authorized networks disabled false policy.type anomaly,
audit_event,
config,
data,
iam,
network,
workload_incident,
workload_vulnerabilitytrue policy.label false policy.severity critical,
high,
medium,
low,
informationaltrue policy.complianceStandard false policy.complianceRequirement false policy.complianceSection false cloud.account false account.group false cloud.region false alertRule.name false resource.id false resource.name false resource.type false resource.group false cloud.service false cloud.accountId false object.exposure private,
public,
conditionaltrue malware true true object.classification false object.identifier false timeRange.type ALERT_STATUS_UPDATED,
ALERT_UPDATED,
ALERT_OPENEDtrue vulnerability.severity all,
high,
critical,
low,
mediumtrue buildtime.resourceName false git.filename false git.provider github,
gitlab,
bitbucket,
perforcefalse git.repository false iac.framework ttt,
CloudFormationfalse asset.class false alert.id false policy.subtype audit,
build,
data_classification,
dns,
identity,
malware,
network,
network_config,
network_event,
permissions,
run,
run_and_build,
uebatrue alert.status dismissed,
snoozed,
open,
resolvedtrue cloud.type alibaba_cloud,
aws,
azure,
gcp,
ocitrue policy.remediable true,
falsetrue
prisma-cloud-remediation-command-list
Generates and returns a list of remediation commands for the specified alerts and policies. Data returned for a successful call include fully constructed commands for remediation. Either a policy ID or alert IDs must be provided. The returned information can be retrieved in the UI by clicking the “Remediate” button under the “Actions” column for supported alerts. When no absolute time nor relative time arguments are provided, the default time range is all times.
Base Command
prisma-cloud-remediation-command-list
Input
| Argument Name | Description | Required |
|---|---|---|
| alert_ids | Comma-seperated list of alert IDs for which to get remediation details. Provided alert IDs must be associated with the same policy. If a policy is specified, all the alerts specified must belong to that policy. | Optional |
| policy_id | Policy ID for which to get remediation details. | Optional |
| time_range_date_from | Start time for the search. Time is interpreted as UTC. Values can be in either ISO date format, relative time, or epoch timestamp. For example: “2019-10-21T23:45:00 GMT+3” (ISO date format), “3 days” (relative time), 1579039377301 (epoch time). | Optional |
| time_range_date_to | End time for the search. Time is interpreted as UTC. Values can be in either ISO date format, relative time, or epoch timestamp. For example: “2019-10-21T23:45:00 GMT+3” (ISO date format), “3 days” (relative time), 1579039377301 (epoch time). | Optional |
| time_range_unit | The search time unit. The “login” and “epoch” options are only available if “time_range_value” is not provided. Possible values are: hour, day, week, month, year, login, epoch. | Optional |
| time_range_value | The amount of “time_range_unit” to go back in time. For example, 3 days, 5 weeks, etc. | Optional |
| limit | Maximum number of entries to return. Default is 50. | Optional |
| all_results | Whether to retrieve all results. The “limit” argument will be ignored. Possible values are: true, false. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| PrismaCloud.AlertRemediation.description | String | Description of CLI remediation instructions. |
| PrismaCloud.AlertRemediation.scriptImpact | String | Impact of CLI remediation instructions. |
| PrismaCloud.AlertRemediation.alertId | String | The ID of the alert to which the remediation details apply. |
| PrismaCloud.AlertRemediation.CLIScript | String | The exact CLI command string. |
Command example
!prisma-cloud-remediation-command-list policy_id=a11b2cc3-1111-2222-33aa-a1b23ccc4dd5 limit=2
Context Example
{
"PrismaCloud": {
"Alert": {
"Remediation": [
{
"CLIScript": "aws rds modify-db-instance --db-instance-identifier aaaaaaaaaaaaaa --region us-east-1 --deletion-protection",
"alertId": "P-351515",
"description": "This CLI command requires 'rds:ModifyDBInstance' permission. Successful execution will enable deletion protection for the reported AWS RDS instance.",
"scriptImpact": null
},
{
"CLIScript": "aws rds modify-db-instance --db-instance-identifier bbbbbbbbbbbbbbb --region us-east-1 --deletion-protection",
"alertId": "P-351323",
"description": "This CLI command requires 'rds:ModifyDBInstance' permission. Successful execution will enable deletion protection for the reported AWS RDS instance.",
"scriptImpact": null
}
]
}
}
}
Human Readable Output
Showing 2 of 3 results:
Remediation Command List
CLI Script Alert Id Description aws rds modify-db-instance –db-instance-identifier aaaaaaaaaaaaaa –region us-east-1 –deletion-protection P-351515 This CLI command requires ‘rds:ModifyDBInstance’ permission. Successful execution will enable deletion protection for the reported AWS RDS instance. aws rds modify-db-instance –db-instance-identifier bbbbbbbbbbbbbbb –region us-east-1 –deletion-protection P-351323 This CLI command requires ‘rds:ModifyDBInstance’ permission. Successful execution will enable deletion protection for the reported AWS RDS instance.
prisma-cloud-alert-remediate
Remediates the alert with the specified ID, if that alert is associated with a remediable policy. In order to check what remediation would run, use the “prisma-cloud-remediation-command-list” command first.
Base Command
prisma-cloud-alert-remediate
Input
| Argument Name | Description | Required |
|---|---|---|
| alert_id | The alert ID. | Required |
Context Output
| Path | Type | Description |
|---|---|---|
| PrismaCloud.AlertRemediation.alertId | String | The ID of the alert to which the remediation apply. |
| PrismaCloud.AlertRemediation.successful | Boolean | Whether the remediation was successful. |
| PrismaCloud.AlertRemediation.failureReason | String | The failure reason for the remediation. |
| PrismaCloud.AlertRemediation.errorValue | String | The error value for the remediation. |
Command example
!prisma-cloud-alert-remediate alert_id=P-488074
Context Example
{
"PrismaCloud": {
"AlertRemediation": {
"alertId": "P-488074",
"successful": true
}
}
}
Human Readable Output
Alert P-488074 remediated successfully.
prisma-cloud-alert-reopen
Re-open the alerts matching the given filter. Either policy IDs or alert IDs must be provided. When no absolute time nor relative time arguments are provided, the default time range is all times.
Base Command
prisma-cloud-alert-reopen
Input
| Argument Name | Description | Required |
|---|---|---|
| alert_ids | Comma-separated list of alert IDs to be reopened. | Optional |
| policy_ids | Comma-separated list of policy IDs. | Optional |
| time_range_date_from | Start time for the search. Time is interpreted as UTC. Values can be in either ISO date format, relative time, or epoch timestamp. For example: “2019-10-21T23:45:00 GMT+3” (ISO date format), “3 days” (relative time), 1579039377301 (epoch time). | Optional |
| time_range_date_to | End time for the search. Time is interpreted as UTC. Values can be in either ISO date format, relative time, or epoch timestamp. For example: “2019-10-21T23:45:00 GMT+3” (ISO date format), “3 days” (relative time), 1579039377301 (epoch time). | Optional |
| time_range_unit | The search time unit. The “login” and “epoch” options are only available if “time_range_value” is not provided. Possible values are: hour, day, week, month, year, login, epoch. | Optional |
| time_range_value | The amount of “time_range_unit” to go back in time. For example, 3 days, 5 weeks, etc. | Optional |
| filters | Comma-separated list of filter name and value, in the following format: filtername1=filtervalue1,filtername2=filtervalue2,etc. Names and possible values for filters can be found by running the “prisma-cloud-alert-filter-list” command. | Optional |
Context Output
There is no context output for this command.
Command example
!prisma-cloud-alert-reopen alert_ids=P-469663
Human Readable Output
Alerts re-opened successfully
prisma-cloud-alert-search
Search alerts on the Prisma Cloud platform. When no absolute time nor relative time arguments are provided, the search will show alerts from the last 7 days.
Base Command
prisma-cloud-alert-search
Input
| Argument Name | Description | Required |
|---|---|---|
| time_range_date_from | Start time for the search. Time is interpreted as UTC. Values can be in either ISO date format, relative time, or epoch timestamp. For example: “2019-10-21T23:45:00 GMT+3” (ISO date format), “3 days” (relative time), 1579039377301 (epoch time). | Optional |
| time_range_date_to | End time for the search. Time is interpreted as UTC. Values can be in either ISO date format, relative time, or epoch timestamp. For example: “2019-10-21T23:45:00 GMT+3” (ISO date format), “3 days” (relative time), 1579039377301 (epoch time). | Optional |
| time_range_unit | The search time unit. The “login” and “epoch” options are only available if “time_range_value” is not provided. Possible values are: hour, day, week, month, year, login, epoch. | Optional |
| time_range_value | The amount of “time_range_unit” to go back in time. For example, 3 days, 5 weeks, etc. | Optional |
| filters | Comma-separated list of filter name and value, in the following format: filtername1=filtervalue1,filtername2=filtervalue2,etc. Names and possible values for filters can be found by running the “prisma-cloud-alert-filter-list” command. | Optional |
| detailed | Whether to retrieve the entire / trimmed alert model. Possible values are: true, false. Default is true. | Optional |
| limit | Maximum number of entries to return. Default is 50. | Optional |
| next_token | Token of the next page to retrive. When provided, other arguments are ignored. | Optional |
| sort_field | The field to sort the results by. Possible values are: alertTime,firstSeen,lastSeen,lastUpdated. | Optional |
| sort_direction | The direction to sort the results by. Sort field must be specified if sorting. Possible values are: asc, desc. Default is asc. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| PrismaCloud.AlertPageToken.nextPageToken | String | Next page token. |
| PrismaCloud.Alert.id | String | The ID of the returned alert. |
| PrismaCloud.Alert.status | String | The status of the returned alert. |
| PrismaCloud.Alert.reason | String | The reason of the returned alert. |
| PrismaCloud.Alert.lastSeen | String | The time the returned alert was last seen. |
| PrismaCloud.Alert.firstSeen | String | The time the returned alert was first seen. |
| PrismaCloud.Alert.lastUpdated | String | The time the returned alert was last updated. |
| PrismaCloud.Alert.alertTime | String | The time of the returned alert. |
| PrismaCloud.Alert.policy.policyId | String | The policy ID of the returned alert. |
| PrismaCloud.Alert.policy.name | String | The policy name of the returned alert. |
| PrismaCloud.Alert.policy.policyType | String | The policy type of the returned alert. |
| PrismaCloud.Alert.policy.severity | String | The policy severity of the returned alert. |
| PrismaCloud.Alert.policy.remediable | Boolean | Whether the policy is remediable. |
| PrismaCloud.Alert.policy.description | String | The policy description of the returned alert. |
| PrismaCloud.Alert.policy.recommendation | String | The policy recommendation of the returned alert. |
| PrismaCloud.Alert.policy.remediation.description | String | The policy remediation description of the returned alert. |
| PrismaCloud.Alert.policy.remediation.cliScriptTemplate | String | The policy CLI script template description of the returned alert. |
| PrismaCloud.Alert.policy.systemDefault | Boolean | Whether the policy is the system default. |
| PrismaCloud.Alert.policy.deleted | Boolean | Whether the policy was deleted. |
| PrismaCloud.Alert.resource.resourceType | String | The resource type of the returned alert. |
| PrismaCloud.Alert.resource.name | String | The resource name of the returned alert. |
| PrismaCloud.Alert.resource.account | String | The resource account of the returned alert. |
| PrismaCloud.Alert.resource.cloudType | String | The resource cloud type of the returned alert. |
| PrismaCloud.Alert.resource.rrn | String | The restricted resource name of the returned alert. |
Command example
!prisma-cloud-alert-search filters=alert.status=open,policy.remediable=true,cloud.type=gcp,policy.type=config limit=2
Context Example
{
"PrismaCloud": {
"Alert": [
{
"alertRules": [],
"alertTime": "2023-02-17T12:57:46Z",
"firstSeen": "2023-02-17T12:57:46Z",
"history": [],
"id": "P-487678",
"lastSeen": "2023-02-17T12:57:46Z",
"lastUpdated": "2023-02-19T13:27:29Z",
"metadata": {
"saveSearchId": "save-search-id2"
},
"policy": {
"complianceMetadata": [
{
"complianceId": "compliance-id1",
"customAssigned": false,
"policyId": "policy-id2",
"requirementId": "DSI",
"requirementName": "Data Security & Information Lifecycle Management",
"requirementViewOrder": 5,
"sectionDescription": "Data Inventory / Flows.",
"sectionId": "DSI-02",
"sectionLabel": "CSA CCM",
"sectionViewOrder": 25,
"standardDescription": "Cloud Security Alliance: Cloud Controls Matrix Version 3.0.1",
"standardName": "CSA CCM v3.0.1",
"systemDefault": true
},
{
"complianceId": "compliance-id2",
"customAssigned": false,
"policyId": "policy-id4",
"requirementId": "IAM",
"requirementName": "Identity & Access Management",
"requirementViewOrder": 10,
"sectionDescription": "Third Party Access.",
"sectionId": "IAM-07",
"sectionLabel": "CSA CCM",
"sectionViewOrder": 72,
"standardDescription": "Cloud Security Alliance: Cloud Controls Matrix Version 3.0.1",
"standardName": "CSA CCM v3.0.1",
"systemDefault": true
}
],
"deleted": false,
"description": "This policy identifies GCP Firewall rule allowing all traffic on read-only port (12346) which exposes GKE clusters. In GKE, Kubelet exposes a read-only port 12346 which shows the configurations of all pods on the cluster at the /pods API endpoint. GKE itself does not expose this port to the Internet as the default project firewall configuration blocks external access. However, it is possible to inadvertently expose this port publicly on GKE clusters by creating a Google Compute Engine VPC firewall for GKE nodes that allows traffic from all source ranges on all the ports. This configuration publicly exposes all pod configurations, which might contain sensitive information.",
"findingTypes": [],
"labels": [],
"lastModifiedBy": "example@gmail.com",
"lastModifiedOn": 1649907869989,
"name": "GCP Firewall rule exposes GKE clusters by allowing all traffic on read-only port (12346)",
"policyId": "policy-id5",
"policyType": "config",
"recommendation": "As port 12345 exposes sensitive information of GKE pod configuration it is recommended to disable this firewall rule. \nOtherwise, remove the overly permissive source IPs following below steps,\n\n1. Login to GCP Console\n2. Navigate to 'VPC Network'(Left Panel)\n3. Go to the 'Firewall' section (Left Panel)\n4. Click on the reported Firewall rule\n5. Click on 'EDIT'\n6. Modify Source IP ranges to specific IP\n7. Click on 'SAVE'.",
"remediable": true,
"remediation": {
"cliScriptTemplate": "gcloud compute --project=${account} firewall-rules update ${resourceName} --disabled",
"description": "This CLI command requires 'compute.firewalls.update' and 'compute.networks.updatePolicy' permission. Successful execution will disable this firewall rule blocking internet traffic to port 12346.",
"impact": "Disable GCP Firewall rule which allows all traffic on read-only port (12345)"
},
"severity": "medium",
"systemDefault": true
},
"policyId": "policy-id7",
"reason": "NEW_ALERT",
"resource": {
"account": "Google Cloud Account",
"accountId": "AAAAAAA",
"additionalInfo": {},
"cloudAccountGroups": [
"Default Account Group"
],
"cloudAccountOwners": [
"mail1@gmail.com",
"example@gmail.com"
],
"cloudServiceName": "Google VPC",
"cloudType": "gcp",
"data": {
"allowed": [
{
"IPProtocol": "all"
}
],
"creationTimestamp": "2022-09-19T21:28:10.104-07:00",
"description": "",
"direction": "INGRESS",
"disabled": false,
"id": "666666666666666666",
"kind": "compute#firewall",
"logConfig": {
"enable": false
},
"name": "k8s",
"network": "https://some-url",
"priority": 1000,
"selfLink": "https://some-url",
"sourceRanges": [
"0.0.0.0/0"
]
},
"id": "3333333333333333333",
"name": "k8s",
"region": "global",
"regionId": "global",
"resourceApiName": "gcloud-compute-firewall-rules-list",
"resourceConfigJsonAvailable": true,
"resourceDetailsAvailable": true,
"resourceTs": 1676633555070,
"resourceType": "SECURITY_GROUP",
"rrn": "rrn::name:place:111:a1b2:a%3Ajj55-2023-01-29-09-25",
"unifiedAssetId": "unifiedassetid2"
},
"saveSearchId": "save-search-id5",
"status": "open"
},
{
"alertRules": [],
"alertTime": "2023-02-17T12:57:46Z",
"firstSeen": "2023-02-17T12:57:46Z",
"history": [],
"id": "P-487768",
"lastSeen": "2023-02-17T12:57:46Z",
"lastUpdated": "2023-02-19T13:27:29Z",
"metadata": {
"saveSearchId": "save-search-id5"
},
"policy": {
"complianceMetadata": [
{
"complianceId": "compliance-id5",
"customAssigned": false,
"policyId": "policy-id-4",
"requirementId": "Section 404",
"requirementName": "Management Assessment",
"requirementViewOrder": 3,
"sectionDescription": "(b) Evaluation and Reporting.",
"sectionId": "Section 404.B",
"sectionLabel": "Section 404.B",
"sectionViewOrder": 9,
"standardDescription": "Management",
"standardName": "Management",
"systemDefault": true
}
],
"deleted": false,
"description": "This policy identifies GCP Firewall rule allowing all traffic on port 12345 which allows GKE full node access. The port 12345 on the kubelet is used by the kube-apiserver (running on hosts labelled as Orchestration Plane) for exec and logs. As per security best practice, port 12345 should not be exposed to the public.",
"findingTypes": [],
"labels": [],
"lastModifiedBy": "example@gmail.com",
"lastModifiedOn": 1652328910000,
"name": "GCP Firewall rule exposes GKE clusters by allowing all traffic on port 12345",
"policyId": "policy-id5",
"policyType": "config",
"recommendation": "As port 12345 exposes sensitive information of GKE pod configuration it is recommended to disable this firewall rule. \nOtherwise, remove the overly permissive source IPs following the below steps,\n\n1. Login to GCP Console\n2. Navigate to 'VPC Network'(Left Panel)\n3. Go to the 'Firewall' section (Left Panel)\n4. Click on the reported Firewall rule\n5. Click on 'EDIT'\n6. Modify Source IP ranges to specific IP\n7. Click on 'SAVE'.",
"remediable": true,
"remediation": {
"cliScriptTemplate": "gcloud compute --project=${account} firewall-rules update ${resourceName} --disabled",
"description": "This CLI command requires 'compute.firewalls.update' and 'compute.networks.updatePolicy' permission. Successful execution will disable this firewall rule blocking internet traffic to port 12345.",
"impact": "disable GCP Firewall rule that allows all traffic on port 12345"
},
"severity": "medium",
"systemDefault": true
},
"policyId": "policy-id-2",
"reason": "NEW_ALERT",
"resource": {
"account": "Google Cloud Account",
"accountId": "AAAAAAA",
"additionalInfo": {},
"cloudAccountGroups": [
"AAAAAAA",
"Default Account Group"
],
"cloudAccountOwners": [
"mail1@gmail.com",
"example@gmail.com"
],
"cloudServiceName": "Google VPC",
"cloudType": "gcp",
"data": {
"allowed": [
{
"IPProtocol": "all"
}
],
"creationTimestamp": "2022-09-19T21:28:10.104-07:00",
"description": "",
"direction": "INGRESS",
"disabled": false,
"id": "7777777777777777777",
"kind": "compute#firewall",
"logConfig": {
"enable": false
},
"name": "k8s",
"network": "https://some-url/global/networks/default",
"priority": 1000,
"selfLink": "https://some-url/global/firewalls/k8s",
"sourceRanges": [
"0.0.0.0/0"
]
},
"id": "7777777777777777777",
"name": "k8s",
"region": "global",
"regionId": "global",
"resourceApiName": "gcloud-compute-firewall-rules-list",
"resourceConfigJsonAvailable": true,
"resourceDetailsAvailable": true,
"resourceTs": 1676633555070,
"resourceType": "SECURITY_GROUP",
"rrn": "rrn::name:place:111:a1b2:a%3Ajj55-2023-01-29-09-25",
"unifiedAssetId": "unifiedassetid6"
},
"saveSearchId": "save-search-id6",
"status": "open"
}
],
"AlertPageToken": {
"nextPageToken": "token"
}
}
}
Human Readable Output
Showing 2 of 25 results:
Alerts Details
Alert ID Reason Status Alert Time First Seen Last Seen Last Updated Policy ID Policy Type Is Policy System Default Is Policy Remediable Policy Name Is Policy Deleted Policy Recommendation Policy Description Policy Severity Policy Remediation Description Policy Remediation CLI Script Resource Type Resource Name Resource Account Resource Cloud Type Resource RRN P-487678 NEW_ALERT open 2023-02-17T12:57:46Z 2023-02-17T12:57:46Z 2023-02-17T12:57:46Z 2023-02-19T13:27:29Z policy-id7 config true true GCP Firewall rule exposes GKE clusters by allowing all traffic on read-only port (12346) false As port 12346 exposes sensitive information of GKE pod configuration it is recommended to disable this firewall rule.
Otherwise, remove the overly permissive source IPs following below steps,
1. Login to GCP Console
2. Navigate to ‘VPC Network’(Left Panel)
3. Go to the ‘Firewall’ section (Left Panel)
4. Click on the reported Firewall rule
5. Click on ‘EDIT’
6. Modify Source IP ranges to specific IP
7. Click on ‘SAVE’.This policy identifies GCP Firewall rule allowing all traffic on read-only port (12346) which exposes GKE clusters. In GKE, Kubelet exposes a read-only port 12346 which shows the configurations of all pods on the cluster at the /pods API endpoint. GKE itself does not expose this port to the Internet as the default project firewall configuration blocks external access. However, it is possible to inadvertently expose this port publicly on GKE clusters by creating a Google Compute Engine VPC firewall for GKE nodes that allows traffic from all source ranges on all the ports. This configuration publicly exposes all pod configurations, which might contain sensitive information. medium This CLI command requires ‘compute.firewalls.update’ and ‘compute.networks.updatePolicy’ permission. Successful execution will disable this firewall rule blocking internet traffic to port 12346. gcloud compute –project=${account} firewall-rules update ${resourceName} –disabled SECURITY_GROUP k8s Google Cloud Account gcp rrn::name:place:111:a1b2:a%3Ajj55-2023-01-29-09-25 P-487768 NEW_ALERT open 2023-02-17T12:57:46Z 2023-02-17T12:57:46Z 2023-02-17T12:57:46Z 2023-02-19T13:27:29Z policy-id-2 config true true GCP Firewall rule exposes GKE clusters by allowing all traffic on port 12345 false As port 12345 exposes sensitive information of GKE pod configuration it is recommended to disable this firewall rule.
Otherwise, remove the overly permissive source IPs following the below steps,
1. Login to GCP Console
2. Navigate to ‘VPC Network’(Left Panel)
3. Go to the ‘Firewall’ section (Left Panel)
4. Click on the reported Firewall rule
5. Click on ‘EDIT’
6. Modify Source IP ranges to specific IP
7. Click on ‘SAVE’.This policy identifies GCP Firewall rule allowing all traffic on port 12345 which allows GKE full node access. The port 12345 on the kubelet is used by the kube-apiserver (running on hosts labelled as Orchestration Plane) for exec and logs. As per security best practice, port 12345 should not be exposed to the public. medium This CLI command requires ‘compute.firewalls.update’ and ‘compute.networks.updatePolicy’ permission. Successful execution will disable this firewall rule blocking internet traffic to port 12345. gcloud compute –project=${account} firewall-rules update ${resourceName} –disabled SECURITY_GROUP k8s Google Cloud Account gcp rrn::name:place:111:a1b2:a%3Ajj55-2023-01-29-09-25 Next Page Token
token
prisma-cloud-config-search
Search configuration inventory on the Prisma Cloud platform using RQL language. Use this command for all queries that start with “config”. When no absolute time nor relative time arguments are provided, the default time range is all times.
Base Command
prisma-cloud-config-search
Input
| Argument Name | Description | Required |
|---|---|---|
| time_range_date_from | Start time for the search. Time is interpreted as UTC. Values can be in either ISO date format, relative time, or epoch timestamp. For example: “2019-10-21T23:45:00 GMT+3” (ISO date format), “3 days” (relative time), 1579039377301 (epoch time). | Optional |
| time_range_date_to | End time for the search. Time is interpreted as UTC. Values can be in either ISO date format, relative time, or epoch timestamp. For example: “2019-10-21T23:45:00 GMT+3” (ISO date format), “3 days” (relative time), 1579039377301 (epoch time). | Optional |
| time_range_unit | The search time unit. The “login” and “epoch” options are only available if “time_range_value” is not provided. Possible values are: hour, day, week, month, year, login, epoch. | Optional |
| time_range_value | The amount of “time_range_unit” to go back in time. For example, 3 days, 5 weeks, etc. | Optional |
| query | Query to run in Prisma Cloud config API using RQL language. For more information see: https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-rql-reference/rql-reference/config-query. | Required |
| limit | Maximum number of entries to return. Default is 50. | Optional |
| search_id | Search ID. Can be used to rerun the same search. | Optional |
| sort_direction | The direction to sort the results by. Both sort direction and field must be specified if sorting. Possible values are: asc, desc. Default is desc. | Optional |
| sort_field | The field to sort the results by. Both sort direction and field must be specified if sorting. Possible values are: id, time, apiName, customerId, insertTs, json, cloudAccount, cloudRegion, stateId. Default is insertTs. | Optional |
| heuristic_search | Enable heuristic search optimization for faster results. Default is true. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| PrismaCloud.Config.accountId | String | Cloud account ID. |
| PrismaCloud.Config.accountName | String | Cloud account name. |
| PrismaCloud.Config.allowDrillDown | Boolean | Whether to allow drill down. |
| PrismaCloud.Config.cloudType | String | Cloud type. |
| PrismaCloud.Config.deleted | Boolean | Whether the asset was deleted. |
| PrismaCloud.Config.hasExtFindingRiskFactors | Boolean | Whether the configuration has external finding risk factors. |
| PrismaCloud.Config.hasExternalFinding | Boolean | Whether the configuration has an external finding. |
| PrismaCloud.Config.hasExternalIntegration | Boolean | Whether the configuration has an external integration. |
| PrismaCloud.Config.hasNetwork | Boolean | Whether the configuration has a network. |
| PrismaCloud.Config.id | String | Prisma Cloud configuration ID. |
| PrismaCloud.Config.assetId | String | Prisma Cloud asset ID. |
| PrismaCloud.Config.data | Unknown | Prisma Cloud asset specific data. |
| PrismaCloud.Config.insertTs | Date | Insert timestamp. |
| PrismaCloud.Config.createdTs | Date | Created timestamp. |
| PrismaCloud.Config.name | String | Asset name. |
| PrismaCloud.Config.regionId | String | Cloud region ID. |
| PrismaCloud.Config.regionName | String | Cloud region name. |
| PrismaCloud.Config.resourceType | String | Cloud resource type. |
| PrismaCloud.Config.rrn | String | Cloud restricted resource name. |
| PrismaCloud.Config.service | String | Cloud service. |
| PrismaCloud.Config.stateId | String | State ID. |
Command example
!prisma-cloud-config-search query="config from cloud.resource where cloud.region = 'AWS Ohio' " limit=1
Context Example
{
"PrismaCloud": {
"Config": {
"accountId": "888888888888",
"accountName": "labs",
"allowDrillDown": true,
"assetId": "assetid1",
"cloudType": "aws",
"createdTs": "2023-02-17T11:07:40Z",
"data": {
"status": {
"isLogging": true,
"latestCloudWatchLogsDeliveryTime": "2023-02-19T13:27:38.122Z",
"latestDeliveryAttemptSucceeded": "2023-02-19T13:28:24Z",
"latestDeliveryAttemptTime": "2023-02-19T13:28:24Z",
"latestDeliveryTime": "2023-02-19T13:28:24.465Z",
"latestDigestDeliveryTime": "2023-02-19T12:40:04.109Z",
"latestNotificationAttemptSucceeded": "2023-02-19T13:28:24Z",
"latestNotificationAttemptTime": "2023-02-19T13:28:24Z",
"latestNotificationTime": "2023-02-19T13:28:24.461Z",
"logging": true,
"startLoggingTime": "2022-05-25T10:51:34.851Z",
"timeLoggingStarted": "2022-05-25T10:51:34Z",
"timeLoggingStopped": ""
},
"trail": "control"
},
"deleted": false,
"hasExtFindingRiskFactors": false,
"hasExternalFinding": false,
"hasExternalIntegration": false,
"hasNetwork": false,
"id": "arn:aws:trail:us-west-1:888888888888:trail/control",
"insertTs": "2023-02-19T13:29:28Z",
"name": "trail-status",
"regionId": "us-east-1",
"regionName": "AWS Ohio",
"resourceConfigJsonAvailable": true,
"resourceType": "Cloud Trail Status",
"rrn": "rrn::name:place:111:a1b2:a%3Ajj55-2023-01-29-09-25",
"service": "AWS CloudTrail",
"stateId": "stateid3"
}
}
}
Human Readable Output
Showing 1 of 2925 results:
Configuration Details
Name Id Cloud Type Service Account Name Region Name Deleted Account Id Asset Id Created Ts Insert Ts Region Id Resource Type Rrn control-trail-status arn:aws:trail:us-west-1:888888888888:trail/control aws AWS CloudTrail labs AWS Ohio false 888888888888 assetid1 2023-02-17T11:07:40Z 2023-02-19T13:29:28Z us-east-2 Cloud Trail Status rrn::name:place:111:a1b2:a%3Ajj55-2023-01-29-09-25
prisma-cloud-event-search
Search events inventory on the Prisma Cloud platform using RQL language. Use this command for all queries that start with “event”. When no absolute time nor relative time arguments are provided, the default time range is all times.
Base Command
prisma-cloud-event-search
Input
| Argument Name | Description | Required |
|---|---|---|
| time_range_date_from | Start time for the search. Time is interpreted as UTC. Values can be in either ISO date format, relative time, or epoch timestamp. For example: “2019-10-21T23:45:00 GMT+3” (ISO date format), “3 days” (relative time), 1579039377301 (epoch time). | Optional |
| time_range_date_to | End time for the search. Time is interpreted as UTC. Values can be in either ISO date format, relative time, or epoch timestamp. For example: “2019-10-21T23:45:00 GMT+3” (ISO date format), “3 days” (relative time), 1579039377301 (epoch time). | Optional |
| time_range_unit | The search time unit. The “login” and “epoch” options are only available if “time_range_value” is not provided. Possible values are: hour, day, week, month, year, login, epoch. | Optional |
| time_range_value | The amount of “time_range_unit” to go back in time. For example, 3 days, 5 weeks, etc. | Optional |
| query | Query to run in Prisma Cloud event API using RQL language. For more information see: https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-rql-reference/rql-reference/event-query. | Required |
| limit | Maximum number of entries to return. Default is 50. | Optional |
| sort_field | The field to sort the results by. Possible values are: cloudService, operation, cloudAccount, cloudRegion, id, time, crud, user. | Optional |
| sort_direction | The direction to sort the results by. Sort field must be specified if sorting. Possible values are: asc, desc. Default is asc. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| PrismaCloud.Event.subject | String | Cloud event subject. |
| PrismaCloud.Event.accountName | String | Cloud event account name. |
| PrismaCloud.Event.name | String | Cloud event name. |
| PrismaCloud.Event.source | String | Cloud event source. |
| PrismaCloud.Event.ip | String | Cloud event IP address. |
| PrismaCloud.Event.eventTs | Date | Cloud event timestamp. |
| PrismaCloud.Event.countryName | String | Cloud event country name. |
| PrismaCloud.Event.stateName | String | Cloud event state name. |
| PrismaCloud.Event.cityName | String | Cloud event city name. |
| PrismaCloud.Event.location | String | Cloud event location. |
| PrismaCloud.Event.account | String | Cloud event account. |
| PrismaCloud.Event.regionId | Number | Cloud event region ID. |
| PrismaCloud.Event.type | String | Cloud event type. |
| PrismaCloud.Event.id | Number | Cloud event ID. |
| PrismaCloud.Event.role | String | Cloud event role. |
| PrismaCloud.Event.accessKeyUsed | Boolean | Whether the cloud event access key is used. |
| PrismaCloud.Event.success | Boolean | Whether the cloud event is successful. |
| PrismaCloud.Event.internal | Boolean | Whether the cloud event is internal. |
| PrismaCloud.Event.cityId | Number | Cloud event city ID. |
| PrismaCloud.Event.cityLatitude | Number | Cloud event city latitude. |
| PrismaCloud.Event.cityLongitude | Number | Cloud event city longitude. |
| PrismaCloud.Event.countryId | Number | Cloud event country ID. |
| PrismaCloud.Event.dynamicData | String | Cloud event dynamic data. |
| PrismaCloud.Event.stateId | Number | Cloud event state ID. |
Command example
!prisma-cloud-event-search query="event from cloud.audit_logs where cloud.type = 'aws'" limit=2
Context Example
{
"PrismaCloud": {
"Event": [
{
"accessKeyUsed": false,
"account": "111111111111",
"accountName": "AAAAAAA",
"cityId": -3,
"cityLatitude": -1,
"cityLongitude": -1,
"cityName": "Internal",
"countryId": -3,
"countryName": "Internal",
"dynamicData": {},
"eventTs": "2022-10-17T00:00:26Z",
"id": 222222222,
"internal": false,
"location": "Internal",
"name": "StartBuild",
"notPersisted": false,
"regionId": 2,
"regionName": "AWS Ohio",
"role": "CloudWatchEventRule",
"source": "codebuild",
"stateId": -3,
"stateName": "Internal",
"subject": "Subject3",
"success": true,
"type": "CREATE"
},
{
"accessKeyUsed": false,
"account": "111111111111",
"accountName": "AAAAAAA",
"cityId": 4509177,
"cityLatitude": -1,
"cityLongitude": -1,
"cityName": "Columbus",
"countryId": 6251111,
"countryName": "United States of America",
"dynamicData": {},
"eventTs": "2022-10-17T00:03:07Z",
"id": 333333333,
"internal": false,
"ip": "1.1.1.1",
"location": "Columbus, Ohio, United States of America",
"name": "CreateReportGroup",
"notPersisted": false,
"regionId": 2,
"regionName": "AWS Ohio",
"role": "aws-codebuild-samples",
"source": "codebuild",
"stateId": 6666666,
"stateName": "Ohio",
"subject": "Subject6",
"success": false,
"type": "CREATE"
}
]
}
}
Human Readable Output
Showing 2 of 39018 results:
Event Details
Subject Account Name Name Source Ip Event Ts Country Name State Name City Name Location Account Region Id Type Id Role Access Key Used Success Internal Subject3 AAAAAAA StartBuild codebuild 2022-10-17T00:00:26Z Internal Internal Internal Internal 111111111111 2 CREATE 222222222 CloudWatchEventRule false true false Subject6 AAAAAAA CreateReportGroup codebuild 1.1.1.1 2022-10-17T00:03:07Z United States of America Ohio Columbus Columbus, Ohio, United States of America 111111111111 2 CREATE 333333333 aws-codebuild-samples false false false
prisma-cloud-network-search
Search networks inventory on the Prisma Cloud platform using RQL language. Use this command for all queries that start with “networks”. When no absolute time nor relative time arguments are provided, the default time range is all times. In order to limit the results returning, use “limit search records to” at the end of the RQL query, followed by a value from one of these options: 1, 10, 100, 1000, and 10,000.
Base Command
prisma-cloud-network-search
Input
| Argument Name | Description | Required |
|---|---|---|
| time_range_date_from | Start time for the search. Time is interpreted as UTC. Values can be in either ISO date format, relative time, or epoch timestamp. For example: “2019-10-21T23:45:00 GMT+3” (ISO date format), “3 days” (relative time), 1579039377301 (epoch time). | Optional |
| time_range_date_to | End time for the search. Time is interpreted as UTC. Values can be in either ISO date format, relative time, or epoch timestamp. For example: “2019-10-21T23:45:00 GMT+3” (ISO date format), “3 days” (relative time), 1579039377301 (epoch time). | Optional |
| time_range_unit | The search time unit. The “login” and “epoch” options are only available if “time_range_value” is not provided. Possible values are: hour, day, week, month, year, login, epoch. | Optional |
| time_range_value | The amount of “time_range_unit” to go back in time. For example, 3 days, 5 weeks, etc. | Optional |
| query | Query to run in Prisma Cloud network API using RQL language. For more information see: https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-rql-reference/rql-reference/network-query. | Required |
| cloud_type | The cloud in which the network should be searched. Possible values are: aws, azure, gcp, alibaba_cloud, oci. | Optional |
| search_id | Search ID. Can be used to rerun the same search. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| PrismaCloud.Network.Node.id | Number | Cloud network node ID. |
| PrismaCloud.Network.Node.name | String | Cloud network node name. |
| PrismaCloud.Network.Node.ipAddr | String | Cloud network node IP address. |
| PrismaCloud.Network.Node.grouped | Boolean | Whether the cloud network node is grouped. |
| PrismaCloud.Network.Node.suspicious | Boolean | Whether the cloud network node is suspicious. |
| PrismaCloud.Network.Node.vulnerable | Boolean | Whether the cloud network node is vulnerable. |
| PrismaCloud.Network.Node.metadata | Unknown | Cloud network node metadata. |
| PrismaCloud.Network.Connection.from | Number | Cloud network connection from node ID. |
| PrismaCloud.Network.Connection.to | Number | Cloud network connection to node ID. |
| PrismaCloud.Network.Connection.label | String | Cloud network connection label. |
| PrismaCloud.Network.Connection.suspicious | Boolean | Whether the cloud network node is suspicious. |
| PrismaCloud.Network.Connection.metadata | Unknown | Cloud network connection metadata. |
Command example
!prisma-cloud-network-search query="network from vpc.flow_record where cloud.account = 'AWS Prod' AND source.publicnetwork IN ( 'Suspicious IPs' ) AND bytes > 0 "
Context Example
{
"PrismaCloud": {
"Network": {
"Connection": [
{
"from": -963693921,
"label": "Web & 1 more",
"metadata": {
"account_id": [
"888888888888"
],
"asset_role": [
"Suspicious IPs"
],
"bytes_accepted": 598088,
"bytes_attempted": 360,
"bytes_rejected": 0,
"cloud_type": [
"aws"
],
"connection_overview_table": [
{
"accepted": "yes",
"port": "Web (80)",
"traffic_volume": 565611
},
{
"accepted": "yes",
"port": "SSH (22)",
"traffic_volume": 32477
},
{
"accepted": "no",
"port": "Web (80)",
"traffic_volume": 360
}
],
"countries": [
"N/A"
],
"flow_class": [
"Web (80)",
"SSH (22)"
],
"from_ip_addresses": [
"0.0.0.0"
],
"isps": [
"N/A"
],
"region_id": [
"N/A"
],
"states": [
"N/A"
],
"suspicious_ips": [
"35.180.1.1",
"172.31.34.235"
],
"to_ip_addresses": [
"35.180.1.1",
"10.0.2.5"
]
},
"suspicious": true,
"to": -1695489264
}
],
"Node": [
{
"grouped": false,
"iconId": "web_server",
"id": -1695489264,
"ipAddr": "10.0.2.5",
"metadata": {
"account_id": [
"888888888888"
],
"account_name": [
"AWS Prod"
],
"asset_role": [
"VM Instance",
"SSH",
"Web Server"
],
"cloud_type": [
"aws"
],
"compliance_count": 0,
"guard_duty_host_count": 4,
"guard_duty_iam_count": 0,
"host_vulnerability_count": 0,
"initial": true,
"inspector_rba_count": 0,
"inspector_sbp_count": 0,
"instance_id": [
"i-0d"
],
"ip_addresses": [
"10.0.2.5"
],
"net_iface_id": [
"eni-08"
],
"redlock_alert_count": 10,
"region_id": [
"us-west-1"
],
"region_name": [
"AWS California"
],
"resource_id": [
"i-00"
],
"rrn": "rrn::name:place:111:a1b2:a%3Ajj55-2023-01-29-09-25",
"secgroup_ids": [
"sg-0a"
],
"security_groups": [
{
"id": "sg-0a",
"name": "WebServersg"
}
],
"serverless_vulnerability_count": 0,
"tags": [
{
"name": "aws:cloudformation:stack-name",
"values": [
"aaa"
]
},
{
"name": "aws:cloudformation:stack-id",
"values": [
"arn:aws:trail:us-west-1:888888888888:trail/control"
]
},
{
"name": "aws:cloudformation:logical-id",
"values": [
"WebServerInstance"
]
},
{
"name": "Name",
"values": [
"PANW-WebServer"
]
}
],
"vpc_id": [
"vpc-07"
],
"vpc_name": [
{
"id": "vpc-07",
"name": "VPC-aaa"
}
]
},
"name": "PANW-WebServer",
"suspicious": false,
"vulnerable": true
},
{
"grouped": true,
"iconId": "suspicious",
"id": -963693921,
"ipAddr": "0.0.0.0",
"metadata": {
"account_id": [
"888888888888"
],
"account_name": [
"N/A"
],
"asset_role": [
"Suspicious IPs"
],
"bytes_accepted": 1368976,
"bytes_attempted": 2428,
"bytes_rejected": 0,
"cloud_type": [
"aws"
],
"compliance_count": 0,
"countries": [
"N/A"
],
"guard_duty_host_count": 0,
"guard_duty_iam_count": 0,
"host_vulnerability_count": 0,
"inspector_rba_count": 0,
"inspector_sbp_count": 0,
"instance_id": [
"N/A"
],
"ip_addresses": [
"N/A"
],
"isps": [
"N/A"
],
"launched_on": [
"N/A"
],
"net_iface_id": [
"N/A"
],
"redlock_alert_count": 0,
"region_id": [
"N/A"
],
"region_name": [
"N/A"
],
"resource_id": [
"N/A"
],
"secgroup_ids": [
"N/A"
],
"secgroup_names": [
"N/A"
],
"security_groups": [
"N/A"
],
"serverless_vulnerability_count": 0,
"specificIps": [
"172.31.34.235",
"1.1.1.1"
],
"states": [
"N/A"
],
"tags": [
"N/A"
],
"vpc_name": [
"N/A"
]
},
"name": "Suspicious IPs",
"suspicious": false,
"vulnerable": false
}
]
}
}
}
Human Readable Output
Network Details
Nodes
Id Name Ip Addr Grouped Suspicious Vulnerable -1695489264 PANW-WebServer 10.0.2.5 false false true -963693921 Suspicious IPs 0.0.0.0 true false false Connections
From To Label Suspicious -963693921 -1695489264 Web & 1 more true
prisma-cloud-error-file-list
Deprecated, use the prisma-cloud-code-issues-list command instead.
prisma-cloud-trigger-scan
Trigger asynchronous scan of all resources to refresh the current state at Prisma Cloud Code Security. In order to use this command, the “Code Security” module needs to be enabled and accessible in the Prisma Cloud UI.
Base Command
prisma-cloud-trigger-scan
Input
There are no input arguments for this command.
Context Output
There is no context output for this command.
Command example
#### Human Readable Output
>### Trigger Scan Results
>
>|Is Executed|Message|
>|---|---|
>| false | Executing a new scan has failed - a scheduled scan is already in progress. |
### prisma-cloud-resource-get
***
Get resource details.
#### Base Command
`prisma-cloud-resource-get`
#### Input
| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| rrn | Restricted Resource Name of the resource to get details about. Can be retrieved by running a command that has that RRN. | Required |
#### Context Output
| **Path** | **Type** | **Description** |
| --- | --- | --- |
| PrismaCloud.Resource.rrn | String | Prisma Cloud restricted resource name. |
| PrismaCloud.Resource.id | String | Prisma Cloud resource ID. |
| PrismaCloud.Resource.name | String | Resource name. |
| PrismaCloud.Resource.url | String | Resource URL. |
| PrismaCloud.Resource.accountId | String | Cloud account ID. |
| PrismaCloud.Resource.accountName | String | Cloud account name. |
| PrismaCloud.Resource.cloudType | String | Cloud type. |
| PrismaCloud.Resource.regionId | String | Cloud region ID. |
| PrismaCloud.Resource.regionName | String | Cloud region Name. |
| PrismaCloud.Resource.service | String | Cloud service. |
| PrismaCloud.Resource.resourceType | String | Cloud resource type. |
| PrismaCloud.Resource.insertTs | Date | Insert timestamp. |
| PrismaCloud.Resource.deleted | Boolean | Whether the resource was deleted. |
| PrismaCloud.Resource.vpcId | String | VPC ID. |
| PrismaCloud.Resource.vpcName | String | VPC name. |
| PrismaCloud.Resource.tags | Unknown | Prisma Cloud resource tags. |
| PrismaCloud.Resource.riskGrade | String | Risk grade. |
| PrismaCloud.Resource.hasNetwork | Boolean | Whether the resource has a network. |
| PrismaCloud.Resource.hasExternalFinding | Boolean | Whether the resource has an external finding. |
| PrismaCloud.Resource.hasExternalIntegration | Boolean | Whether the resource has an external integration. |
| PrismaCloud.Resource.allowDrillDown | Boolean | Whether to allow drill down. |
| PrismaCloud.Resource.hasExtFindingRiskFactors | Boolean | Whether the resource has external finding risk factors. |
| PrismaCloud.Resource.data | Unknown | Prisma Cloud resource specific data. |
#### Command example
```!prisma-cloud-resource-get rrn=rrn::name:place:111:a1b2:a%3Ajj55-2023-01-29-09-25```
#### Context Example
```json
{
"PrismaCloud": {
"Resource": {
"accountId": "111111111111",
"accountName": "AAAAAAA",
"allowDrillDown": true,
"cloudType": "aws",
"data": {
"attributes": [
{
"attributeName": "restore",
"attributeValues": []
}
],
"snapshot": {
"allocatedStorage": 20,
"availabilityZone": "us-east-1a",
"dbiResourceId": "db-S",
"dbinstanceIdentifier": "aaaaaaaaaaaaaa",
"dbsnapshotArn": "arn:aws:trail:us-west-1:888888888888:trail/control",
"dbsnapshotIdentifier": "rds:aaaaaaaaaaaaaa-2023-01-29-09-25",
"encrypted": false,
"engine": "postgres",
"engineVersion": "13.7",
"iamdatabaseAuthenticationEnabled": false,
"instanceCreateTime": "2022-07-22T18:35:54.809Z",
"licenseModel": "postgresql-license",
"masterUsername": "master",
"optionGroupName": "default:postgres-13",
"originalSnapshotCreateTime": "2023-01-29T09:25:08.698Z",
"percentProgress": 100,
"port": 5432,
"processorFeatures": [],
"snapshotCreateTime": "2023-01-29T09:25:08.698Z",
"snapshotTarget": "region",
"snapshotType": "automated",
"status": "available",
"storageThroughput": 0,
"storageType": "standard",
"tagList": [],
"vpcId": "vpc-0f"
},
"tags": []
},
"deleted": true,
"hasExtFindingRiskFactors": false,
"hasExternalFinding": false,
"hasExternalIntegration": false,
"hasNetwork": false,
"id": "rds:aaaaaaaaaaaaaa-2023-01-29-09-25",
"insertTs": "2023-01-29T09:35:27Z",
"name": "rds:aaaaaaaaaaaaaa-2023-01-29-09-25",
"regionId": "us-east-1",
"regionName": "AWS Virginia",
"resourceConfigJsonAvailable": false,
"resourceType": "Managed Database Snapshot",
"riskGrade": "A",
"rrn": "rrn::name:place:111:a1b2:a%3Ajj55-2023-01-29-09-25",
"service": "Amazon RDS",
"tags": {
"": ""
},
"url": "https://some-url?region=us-east-1#db-snapshots:id=rds:aaaaaaaaaaaaaa-2023-01-29-09-25",
"vpcId": "vpc-0f",
"vpcName": "ServerlessVPC"
}
}
}
Human Readable Output
Resource Details
Rrn Id Name Url Account Id Account Name Cloud Type Region Id Region Name Service Resource Type Insert Ts Deleted Vpc Id Vpc Name Tags Risk Grade Has Network Has External Finding Has External Integration Allow Drill Down Has Ext Finding Risk Factors rrn::name:place:111:a1b2:a%3Ajj55-2023-01-29-09-25 rds:aaaaaaaaaaaaaa-2023-01-29-09-25 rds:aaaaaaaaaaaaaa-2023-01-29-09-25 https://some_url?region=us-east-1#db-snapshots:id=rds:aaaaaaaaaaaaaa-2023-01-29-09-25 111111111111 AAAAAAA aws us-east-1 AWS Virginia Amazon RDS Managed Database Snapshot 2023-01-29T09:35:27Z true vpc-0f ServerlessVPC : A false false false true false
prisma-cloud-resource-list
Returns all the resource lists. Maps to the Resource Lists under Settings > Resource Lists in the Console UI.
Base Command
prisma-cloud-resource-list
Input
| Argument Name | Description | Required |
|---|---|---|
| list_type | The resource list type. | Optional |
| limit | Maximum number of entries to return. Default is 50. | Optional |
| all_results | Whether to retrieve all results. The “limit” argument will be ignored. Possible values are: true, false. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| PrismaCloud.ResourceList.id | String | Prisma Cloud resource list ID. |
| PrismaCloud.ResourceList.name | String | Resource list name. |
| PrismaCloud.ResourceList.resourceListType | String | Resource list type. |
| PrismaCloud.ResourceList.description | String | Resource list description. |
| PrismaCloud.ResourceList.lastModifiedBy | String | Resource list last modified user. |
| PrismaCloud.ResourceList.lastModifiedTs | Date | Resource list last modified time. |
| PrismaCloud.ResourceList.members | Unknown | Resource list members. |
Command example
!prisma-cloud-resource-list limit=3
Context Example
{
"PrismaCloud": {
"ResourceList": [
{
"description": null,
"id": "aa11bb22",
"lastModifiedBy": "admin@paloaltonetworks.com",
"lastModifiedTs": "2021-09-20T16:23:15Z",
"members": [
{
"demo": "lab"
},
{
"dev": "prisma"
},
{
"env": "lab"
}
],
"name": "First",
"resourceListType": "TAG"
},
{
"description": null,
"id": "aa22bb11",
"lastModifiedBy": "admin2@paloaltonetworks.com",
"lastModifiedTs": "2023-03-10T04:54:34Z",
"members": [
{
}
],
"name": "other",
"resourceListType": "COMPUTE_ACCESS_GROUP"
},
{
"description": null,
"id": "a3b4",
"lastModifiedBy": "test@paloaltonetworks.com",
"lastModifiedTs": "2023-07-10T22:27:55Z",
"members": [
{
"labels": [
"*"
],
"namespaces": [
"*"
]
}
],
"name": "panw",
"resourceListType": "COMPUTE_ACCESS_GROUP"
}
]
}
}
Human Readable Output
Showing 3 of 6 results:
Resources Details
Name Id Type Last Modified By First aa11bb22 TAG admin@paloaltonetworks.com other aa22bb11 COMPUTE_ACCESS_GROUP admin2@paloaltonetworks.com panw a3b4 COMPUTE_ACCESS_GROUP test@paloaltonetworks.com
prisma-cloud-user-roles-list
Retrieves user roles. Maps to Settings > Access Control > Roles in the Console UI.
Base Command
prisma-cloud-user-roles-list
Input
| Argument Name | Description | Required |
|---|---|---|
| role_id | The role id to get details of. | Optional |
| limit | Maximum number of entries to return. Default is 50. | Optional |
| all_results | Whether to retrieve all results. The “limit” argument will be ignored. Possible values are: true, false. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| PrismaCloud.UserRoles.id | String | Prisma Cloud user roles ID. |
| PrismaCloud.UserRoles.name | String | User roles name. |
| PrismaCloud.UserRoles.resourceListIds | Unknown | User roles resource list IDs. |
| PrismaCloud.UserRoles.description | String | User roles description. |
| PrismaCloud.UserRoles.lastModifiedBy | String | User roles last modified user. |
| PrismaCloud.UserRoles.lastModifiedTs | Date | User roles last modified time. |
| PrismaCloud.UserRoles.associatedUsers | Unknown | User roles associated users. |
| PrismaCloud.UserRoles.restrictDismissalAccess | Boolean | Whether dismissal access is restricted for the user role. |
| PrismaCloud.UserRoles.roleType | String | User roles role type. |
| PrismaCloud.UserRoles.additionalAttributes | Unknown | User roles additional attributes. |
| PrismaCloud.UserRoles.codeRepositoryIds | Unknown | User roles code repository IDs. |
| PrismaCloud.UserRoles.accountGroupIds | Unknown | User roles account group IDs. |
| PrismaCloud.UserRoles.resourceLists | Unknown | User roles resource lists. |
| PrismaCloud.UserRoles.permissionGroup | Unknown | User roles permission group. |
| PrismaCloud.UserRoles.codeRepositories | Unknown | User roles code repositories. |
| PrismaCloud.UserRoles.accountGroups | Unknown | User roles account groups. |
Command example
!prisma-cloud-user-roles-list limit=3
Context Example
{
"PrismaCloud": {
"UserRoles": [
{
"accountGroupIds": [],
"accountGroups": [],
"additionalAttributes": {
"hasDefenderPermissions": false,
"onlyAllowCIAccess": false,
"onlyAllowComputeAccess": false,
"onlyAllowReadAccess": false
},
"associatedUsers": [
"lab",
"demo"
],
"codeRepositories": [],
"codeRepositoryIds": [],
"description": "",
"id": "a2b2",
"lastModifiedBy": "test@paloaltonetworks.com",
"lastModifiedTs": "2023-08-02T17:47:07Z",
"name": "dev-test",
"permissionGroup": null,
"resourceListIds": [],
"resourceLists": [],
"restrictDismissalAccess": true,
"roleType": "Developer"
},
{
"accountGroupIds": [],
"accountGroups": [],
"additionalAttributes": {
"hasDefenderPermissions": false,
"onlyAllowCIAccess": false,
"onlyAllowComputeAccess": false,
"onlyAllowReadAccess": false
},
"associatedUsers": [
"test"
],
"codeRepositories": [],
"codeRepositoryIds": [],
"description": "",
"id": "a3b3",
"lastModifiedBy": "admin@paloaltonetworks.com",
"lastModifiedTs": "2023-07-21T15:27:04Z",
"name": "Custom Read Only",
"permissionGroup": null,
"resourceListIds": [],
"resourceLists": [],
"restrictDismissalAccess": false,
"roleType": "Custom Read Only"
},
{
"accountGroupIds": [
"aaa111",
"bbb222"
],
"accountGroups": [
{
"id": "aaa111",
"name": "group1"
},
{
"id": "bbb222",
"name": "group2"
}
],
"additionalAttributes": {
"hasDefenderPermissions": false,
"onlyAllowCIAccess": false,
"onlyAllowComputeAccess": false,
"onlyAllowReadAccess": true
},
"associatedUsers": [
"user1",
"user2"
],
"codeRepositories": [
{
"id": "a3c3",
"name": "demo"
}
],
"codeRepositoryIds": [
"a3c3"
],
"description": "",
"id": "a4b4",
"lastModifiedBy": "test@paloaltonetworks.com",
"lastModifiedTs": "2023-07-18T19:27:59Z",
"name": "Read Only",
"permissionGroup": null,
"resourceListIds": [],
"resourceLists": [],
"restrictDismissalAccess": true,
"roleType": "Account Group Read Only"
}
]
}
}
Human Readable Output
Showing 3 of 14 results:
User Roles Details
Name Id Role Type dev-test a2b2 Developer Custom Read Only a3b3 Custom Read Only Read Only a4b4 Account Group Read Only
prisma-cloud-users-list
Lists all users and service accounts for your tenant. Maps to Settings > Access Control > Users in the Console UI.
Base Command
prisma-cloud-users-list
Input
| Argument Name | Description | Required |
|---|---|---|
| limit | Maximum number of entries to return. Default is 50. | Optional |
| all_results | Whether to retrieve all results. The “limit” argument will be ignored. Possible values are: true, false. | Optional |
| usernames | Usernames to return only users associated with. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| PrismaCloud.Users.email | String | Prisma Cloud user email. |
| PrismaCloud.Users.firstName | String | User first name. |
| PrismaCloud.Users.lastName | String | User last name. |
| PrismaCloud.Users.timeZone | String | User time zone. |
| PrismaCloud.Users.enabled | Boolean | User enabled. |
| PrismaCloud.Users.lastModifiedBy | String | User last modified user. |
| PrismaCloud.Users.lastModifiedTs | Date | User last modified time. |
| PrismaCloud.Users.lastLoginTs | Date | User last login time. |
| PrismaCloud.Users.displayName | String | User display name. |
| PrismaCloud.Users.ssoBypassAllowed | Boolean | Whether SSO bypass is allowed for the user role. |
| PrismaCloud.Users.accessKeysAllowed | Boolean | Whether access keys are allowed for the user role. |
| PrismaCloud.Users.defaultRoleId | String | User default role ID. |
| PrismaCloud.Users.roleIds | Unknown | User role IDs. |
| PrismaCloud.Users.roles | Unknown | User roles. |
| PrismaCloud.Users.username | String | User username. |
| PrismaCloud.Users.type | String | User type. |
| PrismaCloud.Users.enableKeyExpiration | Boolean | Whether key expiration is enabled for the user role. |
| PrismaCloud.Users.accessKeysCount | Number | User access keys count. |
Command example
!prisma-cloud-users-list limit=2
Context Example
{
"PrismaCloud": {
"Users": [
{
"accessKeysAllowed": false,
"accessKeysCount": 0,
"defaultRoleId": "a4b4",
"displayName": "User Test",
"email": "test@paloaltonetworks.com",
"enableKeyExpiration": false,
"enabled": true,
"firstName": "User",
"lastLoginTs": "1969-12-31T23:59:59Z",
"lastModifiedBy": "admin@paloaltonetworks.com",
"lastModifiedTs": "2020-01-21T22:35:36Z",
"lastName": "Test",
"roleIds": [
"a4b4"
],
"roles": [
{
"id": "a4b4",
"name": "Read Only",
"onlyAllowCIAccess": false,
"onlyAllowComputeAccess": false,
"onlyAllowReadAccess": true,
"type": "Account Group Read Only"
}
],
"roles names": [
"Read Only"
],
"ssoBypassAllowed": false,
"timeZone": "America/New_York",
"type": "USER_ACCOUNT",
"username": "test@paloaltonetworks.com"
},
{
"accessKeysAllowed": false,
"accessKeysCount": 0,
"defaultRoleId": "a4b4",
"displayName": "User Other",
"email": "other@paloaltonetworks.com",
"enableKeyExpiration": false,
"enabled": true,
"firstName": "User",
"lastLoginTs": "2023-08-29T14:04:17Z",
"lastModifiedBy": "USER-ADD",
"lastModifiedTs": "2023-08-29T13:45:06Z",
"lastName": "Other",
"roleIds": [
"a4b4"
],
"roles": [
{
"id": "a4b4",
"name": "Read Only",
"onlyAllowCIAccess": false,
"onlyAllowComputeAccess": false,
"onlyAllowReadAccess": true,
"type": "Account Group Read Only"
}
],
"roles names": [
"Read Only"
],
"ssoBypassAllowed": false,
"timeZone": "America/New_York",
"type": "USER_ACCOUNT",
"username": "other@paloaltonetworks.com"
}
]
}
}
Human Readable Output
Showing 2 of 200 results:
Users Details
Display Name Enabled Username Type Roles Names User Test test@paloaltonetworks.com true test@paloaltonetworks.com USER_ACCOUNT Read Only User Other other@paloaltonetworks.com true other@paloaltonetworks.com USER_ACCOUNT Read Only
prisma-cloud-account-list
List accounts.
Base Command
prisma-cloud-account-list
Input
| Argument Name | Description | Required |
|---|---|---|
| exclude_account_group_details | Whether to exclude account group details. Possible values are: true, false. Default is false. | Optional |
| limit | Maximum number of entries to return. Default is 50. | Optional |
| all_results | Whether to retrieve all results. The “limit” argument will be ignored. Possible values are: true, false. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| PrismaCloud.Account.name | String | Account name. |
| PrismaCloud.Account.cloudType | String | Account cloud type. |
| PrismaCloud.Account.accountType | String | Account type. |
| PrismaCloud.Account.enabled | Boolean | Whether the account is enabled. |
| PrismaCloud.Account.lastModifiedTs | Date | Account last modified time. |
| PrismaCloud.Account.storageScanEnabled | Boolean | Whether account storage scan is enabled. |
| PrismaCloud.Account.protectionMode | String | Account protection mode. |
| PrismaCloud.Account.ingestionMode | Number | Account ingestion mode. |
| PrismaCloud.Account.deploymentType | String | Account deployment type. |
| PrismaCloud.Account.groupIds | Unknown | Account group IDs. |
| PrismaCloud.Account.groups | Unknown | Account groups. |
| PrismaCloud.Account.status | String | Account status. |
| PrismaCloud.Account.numberOfChildAccounts | Number | The number of child accounts. |
| PrismaCloud.Account.accountId | String | Account ID. |
| PrismaCloud.Account.addedOn | Date | Account added on time. |
Command example
!prisma-cloud-account-list limit=1
Context Example
{
"PrismaCloud": {
"Account": [
{
"accountId": "777777777777",
"accountType": "organization",
"addedOn": "2022-10-06T04:06:41Z",
"cloudAccountOwner": "mail1@gmail.com",
"cloudAccountOwnerCount": 1,
"cloudType": "aws",
"deploymentType": "aws",
"enabled": true,
"groupIds": [
"group2"
],
"groups": [
{
"id": "group2",
"name": "Adi"
}
],
"ingestionMode": 7,
"lastModifiedBy": "example@example.com",
"lastModifiedTs": "2022-10-06T12:48:42Z",
"name": "aws-Adi-train",
"numberOfChildAccounts": 4,
"protectionMode": "MONITOR_AND_PROTECT",
"status": "warning",
"storageScanEnabled": false
}
]
}
}
Human Readable Output
Showing 1 of 19 results:
Accounts Details
Account Id Name Cloud Type Account Type Enabled Added On Last Modified Ts Last Modified By Storage Scan Enabled Protection Mode Ingestion Mode Deployment Type Status 777777777777 aws-Adi-train aws organization true 2022-10-06T04:06:41Z 2022-10-06T12:48:42Z example@example.com false MONITOR_AND_PROTECT 7 aws warning
prisma-cloud-account-status-get
Get the statuses of the provided accounts.
Base Command
prisma-cloud-account-status-get
Input
| Argument Name | Description | Required |
|---|---|---|
| account_ids | A comma-separated list of accound IDs. To get account IDs, run the “prisma-cloud-account-list” command. | Required |
Context Output
| Path | Type | Description |
|---|---|---|
| PrismaCloud.Account.accountId | String | Account ID. |
| PrismaCloud.Account.name | String | Account name. |
| PrismaCloud.Account.status | String | Account status. |
| PrismaCloud.Account.message | String | Account message. |
| PrismaCloud.Account.remediation | String | Account remediation action. |
Command example
!prisma-cloud-account-status-get account_ids=111111111111
Context Example
{
"PrismaCloud": {
"Account": {
"accountId": "111111111111",
"message": "",
"name": "Config",
"remediation": "",
"status": "ok",
"subComponents": []
}
}
}
Human Readable Output
Accounts Status Details
Account Id Name Status 111111111111 Config ok
prisma-cloud-account-owner-list
Get the owners of the provided accounts.
Base Command
prisma-cloud-account-owner-list
Input
| Argument Name | Description | Required |
|---|---|---|
| account_ids | A comma-separated list of account IDs. To get account IDs, run the “prisma-cloud-account-list” command. | Required |
Context Output
| Path | Type | Description |
|---|---|---|
| PrismaCloud.Account.accountId | String | Account ID. |
| PrismaCloud.Account.emails | Unknown | Account owner emails. |
Command example
!prisma-cloud-account-owner-list account_ids=888888888888888888888888888888888888,111111111111
Context Example
{
"PrismaCloud": {
"Account": [
{
"accountId": "888888888888888888888888888888888888",
"emails": [
"name@company.com"
]
},
{
"accountId": "111111111111",
"emails": []
}
]
}
}
Human Readable Output
Accounts Owner Details
Account Id Emails 888888888888888888888888888888888888 name@company.com 111111111111
prisma-cloud-host-finding-list
Get resource host finding list.
Base Command
prisma-cloud-host-finding-list
Input
| Argument Name | Description | Required |
|---|---|---|
| rrn | Restricted Resource Name of the resource to get host finding of. Can be retrieved by running a command that has that RRN. | Required |
| finding_types | Comma separated list of finding types to look for. Available options are: guard_duty_host, guard_duty_iam, inspector_sbp, compliance_cis, host_vulnerability_cve. When left empty, will return all options. | Optional |
| risk_factors | Comma separated list of risk factors to look for. Available options are: CRITICAL_SEVERITY, HIGH_SEVERITY, MEDIUM_SEVERITY, HAS_FIX, REMOTE_EXECUTION, DOS, RECENT_VULNERABILITY, EXPLOIT_EXISTS, ATTACK_COMPLEXITY_LOW, ATTACK_VECTOR_NETWORK, REACHABLE_FROM_THE_INTERNET, LISTENING_PORTS, CONTAINER_IS_RUNNING_AS_ROOT, NO_MANDATORY_SECURITY_PROFILE_APPLIED, RUNNING_AS_PRIVILEGED_CONTAINER, PACKAGE_IN_USE. When left empty, will return all options. | Optional |
| limit | Maximum number of entries to return. Default is 50. | Optional |
| all_results | Whether to retrieve all results. The “limit” argument will be ignored. Possible values are: true, false. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| PrismaCloud.HostFinding.accountId | String | Host finding account ID. |
| PrismaCloud.HostFinding.regionId | String | Host finding region ID. |
| PrismaCloud.HostFinding.findingId | String | Host finding ID. |
| PrismaCloud.HostFinding.type | String | Host finding type. |
| PrismaCloud.HostFinding.source | String | Host finding source. |
| PrismaCloud.HostFinding.severity | String | Host finding severity. |
| PrismaCloud.HostFinding.status | String | Host finding status. |
| PrismaCloud.HostFinding.createdOn | Date | The date on which the host finding was created. |
| PrismaCloud.HostFinding.updatedOn | Date | The date on which the host finding was updated. |
| PrismaCloud.HostFinding.normalizedNames | Unknown | Host finding normalized names. |
| PrismaCloud.HostFinding.scanId | String | Host finding scan ID. |
| PrismaCloud.HostFinding.resourceCloudId | String | Host finding resource cloud ID. |
| PrismaCloud.HostFinding.sourceData.accountId | String | Host finding source data account ID. |
| PrismaCloud.HostFinding.sourceData.arn | String | Host finding source data ARN. |
| PrismaCloud.HostFinding.title | String | Host finding title. |
| PrismaCloud.HostFinding.description | String | Host finding description. |
| PrismaCloud.HostFinding.resourceUrl | String | Host finding resource URL. |
| PrismaCloud.HostFinding.rlUpdatedOn | Date | The date on which the RL was updated. |
| PrismaCloud.HostFinding.externalFindingId | String | External finding ID. |
| PrismaCloud.HostFinding.sourceData | Unknown | Host finding source data. |
| PrismaCloud.HostFinding.score | String | Host finding score. |
| PrismaCloud.HostFinding.count | Number | The number of host findings. |
Command example
!prisma-cloud-host-finding-list rrn=rrn::name:place:111:a1b2:a%3Ajj55-2023-01-29-09-25 finding_types=guard_duty_host,guard_duty_iam limit=2
Context Example
{
"PrismaCloud": {
"HostFinding": {
"accountId": "555555555555",
"count": "5",
"createdOn": "2023-01-03T16:13:25Z",
"description": "35.180.1.1 is performing SSH brute force attacks against i-44444444444444444. Brute force attacks are used to gain unauthorized access to your instance by guessing the SSH password.",
"externalFindingId": 999999,
"findingId": "findingid3",
"normalizedNames": [
"UnauthorizedAccess:EC2/SSHBruteForce"
],
"regionId": "us-east-1",
"resourceCloudId": "i-44444444444444444",
"resourceUrl": "https://some-url?#/findings?search=id%3D66666666666666666666666666666666",
"rlUpdatedOn": "2023-02-16T16:27:26Z",
"scanId": "scan-id-5",
"score": "N/A",
"severity": "low",
"source": "guardduty",
"sourceData": {
"accountId": "555555555555",
"arn": "arn:aws:trail:us-west-1:888888888888:trail/control",
"createdAt": "2023-01-03T16:13:25.421Z",
"description": "35.180.1.1 is performing SSH brute force attacks against i-44444444444444444. Brute force attacks are used to gain unauthorized access to your instance by guessing the SSH password.",
"id": "66666666666666666666666666666666",
"partition": "aws",
"region": "us-east-1",
"resource": {
"instanceDetails": {
"availabilityZone": "us-east-1a",
"iamInstanceProfile": {
"arn": "arn:aws:trail:us-west-1:888888888888:trail/control",
"id": "A2"
},
"imageDescription": "Amazon Linux AMI 2.0.20222202 x86_64 ECS HVM GP2",
"imageId": "ami-2",
"instanceId": "i-44444444444444444",
"instanceState": "running",
"instanceType": "t2.xlarge",
"launchTime": "2022-12-13T01:29:18.000Z",
"networkInterfaces": [
{
"ipv6Addresses": [],
"networkInterfaceId": "eni-1",
"privateDnsName": "ip-1-1-1-1.ec2.internal",
"privateIpAddress": "1.1.1.1",
"privateIpAddresses": [
{
"privateDnsName": "ip-1-1-1-1.ec2.internal",
"privateIpAddress": "1.1.1.1"
}
],
"publicDnsName": "ec2-5.compute-1.amazonaws.com",
"publicIp": "1.1.1.1",
"sgs": [
{
"groupId": "sg-000",
"groupName": "security-group"
}
],
"subnetId": "subnet-0",
"vpcId": "vpc-01"
}
],
"productCodes": [],
"tags": [
{
"key": "aws:autoscaling:groupName",
"value": "pc-infra-autoscaling"
}
]
},
"resourceType": "Instance"
},
"schemaVersion": "2.0",
"service": {
"action": {
"actionType": "NETWORK_CONNECTION",
"networkConnectionAction": {
"blocked": false,
"connectionDirection": "INBOUND",
"localIpDetails": {
"ipAddressV4": "1.1.1.1"
},
"localPortDetails": {
"port": 22,
"portName": "SSH"
},
"protocol": "TCP",
"remoteIpDetails": {
"city": {
"cityName": "George Town"
},
"country": {
"countryName": "Malaysia"
},
"geoLocation": {
"lat": 5.4244,
"lon": 100.333
},
"ipAddressV4": "35.180.1.1",
"organization": {
"asn": "9999",
"asnOrg": "TIME",
"isp": "TIME",
"org": "TIME"
}
},
"remotePortDetails": {
"port": 33333,
"portName": "Unknown"
}
}
},
"additionalInfo": {
"type": "default",
"value": "{}"
},
"archived": false,
"count": 5,
"detectorId": "scan-id-5",
"eventFirstSeen": "2023-01-03T15:56:55.000Z",
"eventLastSeen": "2023-02-16T15:53:32.000Z",
"resourceRole": "TARGET",
"serviceName": "guardduty"
},
"severity": 2,
"title": "35.180.1.1 is performing SSH brute force attacks against i-44444444444444444.",
"type": "UnauthorizedAccess:EC2/SSHBruteForce",
"updatedAt": "2023-02-16T16:01:36.608Z"
},
"status": "open",
"title": "35.180.1.1 is performing SSH brute force attacks against i-44444444444444444.",
"type": "guard_duty_host",
"updatedOn": "2023-02-16T16:01:36Z"
}
}
}
Human Readable Output
Showing 1 of 1 results:
Host Finding Details
Account Id Region Id Finding Id Type Source Severity Status Created On Updated On Normalized Names Scan Id Resource Cloud Id Source Data Account ID ARN Title Description Resource Url 555555555555 us-east-1 66666666666666666666666666666666 guard_duty_host guardduty low open 2023-01-03T16:13:25Z 2023-02-16T16:01:36Z UnauthorizedAccess:EC2/SSHBruteForce scan-id-5 i-44444444444444444 555555555555 arn:aws:trail:us-west-1:888888888888:trail/control 35.180.1.1 is performing SSH brute force attacks against i-44444444444444444. 35.180.1.1 is performing SSH brute force attacks against i-44444444444444444. Brute force attacks are used to gain unauthorized access to your instance by guessing the SSH password. https://some_url?#/findings?search=id%3D66666666666666666666666666666666
prisma-cloud-permission-list
Get permission list. You must provide either “query” or “next_token”.
Base Command
prisma-cloud-permission-list
Input
| Argument Name | Description | Required |
|---|---|---|
| user_id | User ID to look for. Must be provided with the “query” argument. | Optional |
| query | IAM query to run in Prisma Cloud config API using RQL language. For more information see: https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-rql-reference/rql-reference/iam-query. | Optional |
| limit | Maximum number of entries to return. Default is 50. | Optional |
| next_token | Token of the next page to retrive. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| PrismaCloud.PermissionPageToken.nextPageToken | String | Next page token. |
| PrismaCloud.Permission.id | String | Permission ID. |
| PrismaCloud.Permission.sourceCloudType | String | Permission source cloud type. |
| PrismaCloud.Permission.sourceCloudAccount | String | Permission source cloud account. |
| PrismaCloud.Permission.sourceResourceId | String | Permission source resource ID. |
| PrismaCloud.Permission.destCloudType | String | Permission destination cloud type. |
| PrismaCloud.Permission.destCloudServiceName | String | Permission destination cloud service name. |
| PrismaCloud.Permission.destResourceType | String | Permission destination resource type. |
| PrismaCloud.Permission.effectiveActionName | String | Permission effective action name. |
| PrismaCloud.Permission.grantedByCloudType | String | Permission granted by cloud type. |
| PrismaCloud.Permission.grantedByCloudPolicyId | String | Permission granted by cloud policy ID. |
| PrismaCloud.Permission.grantedByCloudPolicyName | String | Permission granted by cloud policy name. |
| PrismaCloud.Permission.grantedByCloudPolicyType | String | Permission granted by cloud policy type. |
| PrismaCloud.Permission.grantedByCloudPolicyRrn | String | Permission granted by cloud policy restricted resource name. |
| PrismaCloud.Permission.grantedByCloudEntityId | String | Permission granted by cloud entity ID. |
| PrismaCloud.Permission.grantedByCloudEntityName | String | Permission granted by cloud entity name. |
| PrismaCloud.Permission.grantedByCloudEntityRrn | String | Permission granted by cloud entity restricted resource name. |
| PrismaCloud.Permission.sourcePublic | Boolean | Whether the permission source is public. |
| PrismaCloud.Permission.sourceCloudRegion | String | Permission source cloud region. |
| PrismaCloud.Permission.sourceCloudServiceName | String | Permission source cloud service name. |
| PrismaCloud.Permission.sourceResourceName | String | Permission source resource name. |
| PrismaCloud.Permission.sourceResourceType | String | Permission source resource type. |
| PrismaCloud.Permission.sourceIdpService | String | Permission source IDP service. |
| PrismaCloud.Permission.sourceIdpDomain | String | Permission source IDP domain. |
| PrismaCloud.Permission.sourceIdpEmail | String | Permission source IDP email. |
| PrismaCloud.Permission.sourceIdpUsername | String | Permission source IDP username. |
| PrismaCloud.Permission.sourceIdpGroup | String | Permission source IDP group. |
| PrismaCloud.Permission.sourceIdpRrn | String | Permission source IDP restricted resource name. |
| PrismaCloud.Permission.sourceCloudResourceRrn | String | Permission source cloud resource restricted resource name. |
| PrismaCloud.Permission.destCloudAccount | String | Permission destination cloud account. |
| PrismaCloud.Permission.destCloudRegion | String | Permission destination cloud region. |
| PrismaCloud.Permission.destResourceName | String | Permission destination resource name. |
| PrismaCloud.Permission.destResourceId | String | Permission destination resource ID. |
| PrismaCloud.Permission.destCloudResourceRrn | String | Permission destination cloud resource restricted resource name. |
| PrismaCloud.Permission.grantedByCloudEntityType | String | Permission granted by cloud entity type. |
| PrismaCloud.Permission.accessedResourcesCount | String | Permission accessed resources count. |
| PrismaCloud.Permission.lastAccessDate | String | Permission last access date. |
| PrismaCloud.Permission.lastAccessStatus | String | Permission last access status. |
| PrismaCloud.Permission.isWildCardDestCloudResourceName | Boolean | Whether the destination cloud resource name is a wildcard. |
| PrismaCloud.Permission.exceptions | Unknown | Permission exceptions. |
| PrismaCloud.Permission.grantedByLevelType | String | Permission granted by level type. |
| PrismaCloud.Permission.grantedByLevelId | String | Permission granted by level ID. |
| PrismaCloud.Permission.grantedByLevelName | String | Permission granted by level name. |
| PrismaCloud.Permission.grantedByLevelRrn | String | Permission granted by level restricted resource name. |
Command example
!prisma-cloud-permission-list query="config from iam where source.cloud.service.name = 'EC2'" limit=2
Context Example
{
"PrismaCloud": {
"Permission": [
{
"accessedResourcesCount": null,
"destCloudAccount": "AWS-JLo",
"destCloudRegion": "*",
"destCloudResourceRrn": null,
"destCloudServiceName": "ec2",
"destCloudType": "AWS",
"destResourceId": "*",
"destResourceName": "*",
"destResourceType": "instance",
"effectiveActionName": "ssm:UpdateInstanceInformation",
"exceptions": [
{
"messageCode": "CLOUD_EVENT_NOT_SUPPORTED"
},
{
"messageCode": "AWS_ROOT_ACCOUNT_IS_NOT_ONBOARDED"
}
],
"grantedByCloudEntityId": "arn:aws:trail:us-west-1:888888888888:trail/control",
"grantedByCloudEntityName": "service-role/AWSCloud9SSMAccessRole",
"grantedByCloudEntityRrn": "rrn::name:place:111:a1b2:a%3Ajj55-2023-01-29-09-25",
"grantedByCloudEntityType": "role",
"grantedByCloudPolicyId": "arn:aws:arn:aws:trail:us-west-1:888888888888:trail/control",
"grantedByCloudPolicyName": "AWSCloud9SSMInstanceProfile",
"grantedByCloudPolicyRrn": "rrn::name:place:111:a1b2:a%3Ajj55-2023-01-29-09-25",
"grantedByCloudPolicyType": "AWS Managed Policy",
"grantedByCloudType": "AWS",
"grantedByLevelId": null,
"grantedByLevelName": null,
"grantedByLevelRrn": null,
"grantedByLevelType": "",
"id": "jjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjj",
"isWildCardDestCloudResourceName": true,
"lastAccessDate": null,
"lastAccessStatus": "NOT_AVAILABLE",
"sourceCloudAccount": "AWS-JLo",
"sourceCloudRegion": "AWS Oregon",
"sourceCloudResourceRrn": "rrn::name:place:111:a1b2:a%3Ajj55-2023-01-29-09-25",
"sourceCloudServiceName": "ec2",
"sourceCloudType": "AWS",
"sourceIdpDomain": null,
"sourceIdpEmail": null,
"sourceIdpGroup": null,
"sourceIdpRrn": null,
"sourceIdpService": null,
"sourceIdpUsername": null,
"sourcePublic": false,
"sourceResourceId": "arn:aws:trail:us-west-1:888888888888:trail/control",
"sourceResourceName": "i-33333333333333333",
"sourceResourceType": "instance"
},
{
"accessedResourcesCount": null,
"destCloudAccount": "AWS-JLo",
"destCloudRegion": "*",
"destCloudResourceRrn": null,
"destCloudServiceName": "ssm",
"destCloudType": "AWS",
"destResourceId": "*",
"destResourceName": "*",
"destResourceType": "managed-instance",
"effectiveActionName": "ssm:UpdateInstanceInformation",
"exceptions": [
{
"messageCode": "CLOUD_EVENT_NOT_SUPPORTED"
},
{
"messageCode": "AWS_ROOT_ACCOUNT_IS_NOT_ONBOARDED"
}
],
"grantedByCloudEntityId": "arn:aws:arn:aws:trail:us-west-1:888888888888:trail/control",
"grantedByCloudEntityName": "service-role/AWSCloud9SSMAccessRole",
"grantedByCloudEntityRrn": "rrn::name:place:111:a1b2:a%3Ajj55-2023-01-29-09-25",
"grantedByCloudEntityType": "role",
"grantedByCloudPolicyId": "arn:aws:trail:us-west-1:888888888888:trail/control",
"grantedByCloudPolicyName": "AWSCloud9SSMInstanceProfile",
"grantedByCloudPolicyRrn": "rrn::name:place:111:a1b2:a%3Ajj55-2023-01-29-09-25",
"grantedByCloudPolicyType": "AWS Managed Policy",
"grantedByCloudType": "AWS",
"grantedByLevelId": null,
"grantedByLevelName": null,
"grantedByLevelRrn": null,
"grantedByLevelType": "",
"id": "kkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkk",
"isWildCardDestCloudResourceName": true,
"lastAccessDate": null,
"lastAccessStatus": "NOT_AVAILABLE",
"sourceCloudAccount": "AWS-JLo",
"sourceCloudRegion": "AWS Oregon",
"sourceCloudResourceRrn": "rrn::name:place:111:a1b2:a%3Ajj55-2023-01-29-09-25",
"sourceCloudServiceName": "ec2",
"sourceCloudType": "AWS",
"sourceIdpDomain": null,
"sourceIdpEmail": null,
"sourceIdpGroup": null,
"sourceIdpRrn": null,
"sourceIdpService": null,
"sourceIdpUsername": null,
"sourcePublic": false,
"sourceResourceId": "arn:aws:trail:us-west-1:888888888888:trail/control",
"sourceResourceName": "i-33333333333333333",
"sourceResourceType": "instance"
}
],
"PermissionPageToken": {
"nextPageToken": "token2"
}
}
}
Human Readable Output
Showing 2 of 20261 results:
Permissions Details
Id Source Cloud Type Source Cloud Account Source Resource Id Destination Cloud Type Destination Cloud Service Name Destination Resource Type Effective Action Name Granted By Cloud Type Granted By Cloud Policy Id Granted By Cloud Policy Name Granted By Cloud Policy Type Granted By Cloud Policy Rrn Granted By Cloud Entity Id Granted By Cloud Entity Name Granted By Cloud Entity Rrn jjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjj AWS AWS-JLo arn:aws:trail:us-west-1:888888888888:trail/control AWS ec2 instance ssm:UpdateInstanceInformation AWS arn:aws:trail:us-west-1:888888888888:trail/control AWSCloud9SSMInstanceProfile AWS Managed Policy rrn::name:place:111:a1b2:a%3Ajj55-2023-01-29-09-25 arn:aws:iam::555555555555:role/service-role/AWSCloud9SSMAccessRole service-role/AWSCloud9SSMAccessRole rrn::name:place:111:a1b2:a%3Ajj55-2023-01-29-09-25 kkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkk AWS AWS-JLo arn:aws:trail:us-west-1:888888888888:trail/control AWS ssm managed-instance ssm:UpdateInstanceInformation AWS arn:aws:trail:us-west-1:888888888888:trail/control AWSCloud9SSMInstanceProfile AWS Managed Policy rrn::name:place:111:a1b2:a%3Ajj55-2023-01-29-09-25 arn:aws:iam::555555555555:role/service-role/AWSCloud9SSMAccessRole service-role/AWSCloud9SSMAccessRole rrn::name:place:111:a1b2:a%3Ajj55-2023-01-29-09-25 Next Page Token
token2
Access Keys
Access keys are a secure way to enable programmatic access to the Prisma Cloud API. By default, only the System Admin has API access and can enable API access for other administrators. If you have API access, you can create up to two access keys.
A service account is a special Prisma Cloud identity used to access Prisma Cloud programmatically via API.
To create a service account, see Add Service Accounts On Prisma Cloud
Base Command
prisma-cloud-access-key-create
Input
| Argument Name | Description | Required |
|---|---|---|
| name | Access key name. | Required |
| expires-on | Timestamp in milliseconds when access key expires. Default:0. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| PrismaCloud.AccessKeys.id | String | Access key ID. |
| PrismaCloud.AccessKeys.secretKey | String | Access key secret. |
Command example
!prisma-cloud-access-key-create name=MyNewKey
Context Example
{
"PrismaCloud": {
"AccessKeys": [
{
"Id": "Id",
"Secret Key": "Secret Key"
}
]
}
}
prisma-cloud-access-keys-list
Input
| Argument Name | Description | Required |
|---|---|---|
| access-key | Returns the metadata of the access key that has the specified ID. | Optional |
| limit | Maximum number of entries to return. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| PrismaCloud.AccessKeys.id | String | Access key ID. |
| PrismaCloud.AccessKeys.name | String | The name of the access key. |
| PrismaCloud.AccessKeys.createdBy | String | The user who created the access key. |
| PrismaCloud.AccessKeys.createdTs | String | Time access key was created. |
| PrismaCloud.AccessKeys.expiresOn | String | The time the access key expires. |
| PrismaCloud.AccessKeys.lastUsedTime | String | The last time the access key was used. |
| PrismaCloud.AccessKeys.status | String | Access key status. |
| PrismaCloud.AccessKeys.role.id | String | User role ID. |
| PrismaCloud.AccessKeys.role.name | String | User role name. |
| PrismaCloud.AccessKeys.roleType | String | User role permission type. |
| PrismaCloud.AccessKeys.username | String | Access key user name. |
Command example
!prisma-cloud-access-keys-list limit=2
Context Example
{
"PrismaCloud": {
"AccessKeys": [
{
"id": "string",
"name": "string",
"createdBy": "string",
"createdTs": "number",
"lastUsedTime": "number",
"status": "string",
"expiresOn": "number",
"role": {
"id": "string",
"name": "string"
},
"roleType": "string",
"username": "string"
},
{
"id": "string",
"name": "string",
"createdBy": "string",
"createdTs": "number",
"lastUsedTime": "number",
"status": "string",
"expiresOn": "number",
"role": {
"id": "string",
"name": "string"
},
"roleType": "string",
"username": "string"
}
]
}
}
prisma-cloud-access-key-disable
Input
| Argument Name | Description | Required |
|---|---|---|
| access-key | Access key ID. | Required |
Command example
!prisma-cloud-access-key-disable access-key=id
Human Readable Output
Access key mockmock-mock-mock-mock-mockmockmock was disabled successfully
prisma-cloud-access-key-enable
Input
| Argument Name | Description | Required |
|---|---|---|
| access-key | Access key ID. | Required |
Command example
!prisma-cloud-access-key-enable access-key=id
Human Readable Output
Access key mockmock-mock-mock-mock-mockmockmock was enabled successfully
prisma-cloud-access-key-delete
Input
| Argument Name | Description | Required |
|---|---|---|
| access-key | Access key ID. | Required |
Command example
!prisma-cloud-access-key-delete access-key=id
Human Readable Output
Access key mockmock-mock-mock-mock-mockmockmock was successfully deleted successfully
Breaking changes from the previous version of this integration - Prisma Cloud v2
The following sections list the changes in this version.
Commands
The following commands were deprecated in this version because they are not supported by the API anymore
- redlock-list-scans
- redlock-get-scan-status**
- redlock-get-scan-results
The following commands were replaced in this version
- redlock-dismiss-alerts - this command is replaced by prisma-cloud-alert-dismiss.
- redlock-get-alert-details - this command is replaced by prisma-cloud-alert-get-details.
- redlock-get-remediation-details - this command is replaced by prisma-cloud-remediation-command-list.
- redlock-get-rql-response - this command is replaced by prisma-cloud-config-search.
- redlock-list-alert-filters - this command is replaced by prisma-cloud-alert-filter-list.
- redlock-reopen-alerts - this command is replaced by prisma-cloud-alert-reopen.
- redlock-search-alerts - this command is replaced by prisma-cloud-alert-search.
- redlock-search-config - this command is replaced by prisma-cloud-config-search.
- redlock-search-event - this command is replaced by prisma-cloud-event-search.
- redlock-search-network - this command is replaced by prisma-cloud-network-search.
Additional Considerations for this version
- “Risk detail” was removed from all commands because it is not supported by the API anymore.
- Commands from the previous version were kept in order to make to transition from v1 to v2 easy for existing playbooks. We encourage to use the new version of each command.
prisma-cloud-code-issues-list
Retrieves the code errors detected by Application Security during periodic scans.
Base Command
prisma-cloud-code-issues-list
Input
| Argument Name | Description | Required |
|---|---|---|
| git_users | Comma-separated list of names of Git users. | Optional |
| branch | A branch name. | Optional |
| code_categories | Comma-separated list of code issue categories. Is also available as a search criteria (search_scopes). Possible values are: IacMisconfiguration, IacExternalModule, ImageReferencerVul, ImageReferencerLicenses, Vulnerabilities, Licenses, Secrets. | Optional |
| iac_categories | Comma-separated list of categories related to Infrastructure-as-Code (IaC) issues. Possible values are: IAM, Monitoring, Networking, Kubernetes, General, Storage, Public, Drift, Compute. | Optional |
| iac_labels | Comma-separated list of labels associated with Infrastructure-as-Code (IaC). Possible values are: CustomPolicy, HasFix. | Optional |
| file_types | Comma-separated list of file types. Possible values are: yml, yaml, json, template, py, js, properties, pem, php, xml, ts, env, Dockerfile, java, rb, sum, mod, cs, txt, bicep, hcl, gradle, kts, lock, config, csproj, dependencies. | Optional |
| fixable_only | Whether to retrieve only fixable issues. Recommended to use this argument with another argument code_categories ,for example. Possible values are: true, false. | Optional |
| repositories | Comma-separated list of repository names. | Optional |
| secrets_risk_factors | Comma-separated list of risk factors related to secrets. Possible values are: PublicRepository, PrivateRepository, User, Privileged, Valid, Invalid, Unknown, FoundInHistory. | Optional |
| search_scopes | Comma-separated list of specific areas or categories within which to search. When specifying search_scopes, search_term argument is required. Possible values are: IacMisconfiguration, IacExternalModule, ImageReferencerVul, ImageReferencerLicenses, Vulnerabilities, Licenses, Secrets. |
Optional |
| severities | Comma-separated list of the criticality of issues. Possible values are: INFO, LOW, MEDIUM, HIGH, CRITICAL. | Optional |
| vulnerability_risk_factors | Comma-separated list of risk factors for vulnerabilities. Possible values are: AttackComplexity, AttackVector, DoS, HasFix, RemoteExecution, ExploitInTheWild, ExploitPOC, IsUsed. | Optional |
| search_term | A keyword or phrase used to narrow down results within specific scopes (like a particular vulnerability). It’s needed if you are filtering results by search_scopes. | Optional |
| iac_tags | An infrastructure-as-code (IaC) resource. Relevant only to- IacMisconfiguration,Vulnerabilities. | Optional |
| license_type | Comma-separated list of license types. | Optional |
| check_status | Status of checks. Possible values are: Error, Passed, Suppressed, FixPendin. | Optional |
| limit | The limit of issues to retrieve. Default is 50. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| PrismaCloud.CodeIssue.modifiedOn | String | The date and time when the code issue was last modified. |
| PrismaCloud.CodeIssue.isPublic | String | Indicates whether the repository or resource is publicly accessible (true/false). |
| PrismaCloud.CodeIssue.fileType | String | The type of file where the issue was detected (e.g., `.js`, `.py`). |
| PrismaCloud.CodeIssue.secretCommitRemove | String | The commit identifier where a secret was removed. |
| PrismaCloud.CodeIssue.secretCommitAdd | String | The commit identifier where a secret was added. |
| PrismaCloud.CodeIssue.gitUser | String | The username of the person who made the commit associated with the code issue. |
| PrismaCloud.CodeIssue.codePath | String | The path to the code file where the issue was detected. |
| PrismaCloud.CodeIssue.codeCategory | String | The category or classification of the detected issue (e.g., security, compliance). |
| PrismaCloud.CodeIssue.author | String | The original author of the code where the issue was detected. |
| PrismaCloud.CodeIssue.repositoryUuid | String | The unique identifier of the repository where the issue was found. |
| PrismaCloud.CodeIssue.path | String | The path in the repository where the issue was detected. |
| PrismaCloud.CodeIssue.repositorySource | String | The source of the repository (e.g., GitHub, Bitbucket). |
| PrismaCloud.CodeIssue.firstDetected | String | The date and time when the code issue was first detected. |
| PrismaCloud.CodeIssue.codeIssueLine | String | The line number in the code where the issue was detected. |
| PrismaCloud.CodeIssue.labels | String | Labels associated with the code issue for classification or categorization. |
| PrismaCloud.CodeIssue.labels.label | String | A specific label related to the code issue. |
| PrismaCloud.CodeIssue.labels.metadata.imageName | String | The name of the image associated with the label metadata. |
| PrismaCloud.CodeIssue.policy | String | The policy that was violated by the detected issue. |
| PrismaCloud.CodeIssue.repository | String | The name of the repository where the issue was found. |
| PrismaCloud.CodeIssue.resourceName | String | The name of the resource associated with the code issue. |
| PrismaCloud.CodeIssue.resourceScanType | String | The type of scan that detected the issue (e.g., static analysis, secret detection). |
| PrismaCloud.CodeIssue.resourceUuid | String | The unique identifier of the resource associated with the code issue. |
| PrismaCloud.CodeIssue.severity | String | The severity level of the detected issue (e.g., High, Medium, Low). |
| PrismaCloud.CodeIssue.violationId | String | The unique identifier for the policy violation related to the code issue. |
| PrismaCloud.CodeIssue.causePackageId | String | The ID of the package that caused the issue. |
| PrismaCloud.CodeIssue.causePackageName | String | The name of the package that caused the issue. |
| PrismaCloud.CodeIssue.cveUuid | String | The unique identifier of the Common Vulnerabilities and Exposures (CVE) related to the issue. |
| PrismaCloud.CodeIssue.cvss | String | The Common Vulnerability Scoring System (CVSS) score for the detected issue. |
| PrismaCloud.CodeIssue.fixVersion | String | The version of the code or package that contains the fix for the issue. |
| PrismaCloud.CodeIssue.pr | String | The pull request (PR) associated with resolving the code issue. |
| PrismaCloud.CodeIssue.resourceId | String | The identifier of the resource related to the code issue. |
| PrismaCloud.CodeIssue.riskFactors | String | Risk factors associated with the code issue, such as high-impact areas or sensitive data. |
| PrismaCloud.CodeIssue.isIndirectPackage | String | Indicates whether the issue is from an indirect package (true/false). |
prisma-cloud-asset-alerts-get
Returns detailed information for the asset alerts with the given ID.
Base Command
prisma-cloud-asset-alerts-get
Input
| Argument Name | Description | Required |
|---|---|---|
| asset_id | Unified asset ID or RRN (Restricted Resource Name). | Required |
| finding_type | External finding types. Possible values are: COMPLIANCE_CIS, GUARD_DUTY_HOST, GUARD_DUTY_IAM, INSPECTOR_RBA, INSPECTOR_SBP, NETWORK_REACHABILITY, AZURE_SECURITY_CENTER_ALERTS, UNCLASSIFIED, COMMAND_AND_CONTROL, CREDENTIAL_ACCESS, CROSS_ACCOUNT_TRUST, DATA_EXFILTRATION, DEFENSE_EVASION, DISCOVERY, HIGH_PRIVILEGED_ROLE, INITIAL_ACCESS, INTERNET_EXPOSURE, KEYS_AND_SECRETS, LATERAL_MOVEMENT, MALWARE, MFA, MISCONFIGURATION, NETWORK_ANOMALY, PRIVILEGE_ESCALATION, RECONNAISSANCE, RESOURCE_HIJACKING, SSH_BRUTE_FORCE, UNAUTHORIZED_ACCESS, UNENCRYPTED_DATA, UNUSED_PRIVILEGES, USER_ANOMALY, WEAK_PASSWORD, SENSITIVE_DATA_EXPOSURE, INJECTIONS, VULNERABILITY_SCANNING, SHELLSHOCK, KNOWN_BOTS, UNKNOWN_BOTS, VIRTUAL_PATCHES, WEB_ATTACK, BOT_ACTIVITY, WEB_SCRAPING, CUSTOM, VULNERABILITY, HOST_VULNERABILITY_CVE, CONTAINER_IMAGE_VULNERABILITY_CVE, VIRTUAL_IMAGE_VULNERABILITY_CVE, SERVERLESS_VULNERABILITY, PACKAGE_VULNERABILITY. | Optional |
| risk_factors | Comma-separated list of external finding risk factors. Possible values are: CRITICAL_SEVERITY, HIGH_SEVERITY, MEDIUM_SEVERITY, HAS_FIX, REMOTE_EXECUTION, DOS, RECENT_VULNERABILITY, EXPLOIT_EXISTS, ATTACK_COMPLEXITY_LOW, ATTACK_VECTOR_NETWORK, REACHABLE_FROM_THE_INTERNET, LISTENING_PORTS, CONTAINER_IS_RUNNING_AS_ROOT, NO_MANDATORY_SECURITY_PROFILE_APPLIED, RUNNING_AS_PRIVILEGED_CONTAINER, PACKAGE_IN_USE, DOS_LOW, DOS_HIGH, EXPLOIT_EXISTS_IN_THE_WILD, EXPLOIT_EXISTS_POC, SENSITIVE_INFORMATION, ROOT_MOUNT, RUNTIME_SOCKET, HOST_ACCESS. | Optional |
| timeline_item_id | Timeline item ID. | Optional |
| alert_ids | Comma-separated list of alert IDs. | Optional |
| limit | Limit number of records. | Optional |
| permission_type | Permissions type. | Optional |
| page_token | Next page token. | Optional |
| prisma_cloud_findings_only | Filter Hyperion findings. Possible values are: true, false. | Optional |
| vulnerability_info_type_id | CVE ID, package ID, or layer ID. The value needs to be fetched from one of the group by API calls. | Optional |
| vulnerability_info_type | Supported vulnerability types. Possible values are: CVE, PACKAGE, LAYER. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| PrismaCloud.AssetAlerts.problem.title | String | The title of the problem. |
| PrismaCloud.AssetAlerts.problem.status.statusCode | Number | The status code of the problem. |
| PrismaCloud.AssetAlerts.problem.status.reasonPhrase | String | The reason for the problem. |
| PrismaCloud.AssetAlerts.problem.detail | String | The details of the problem. |
| PrismaCloud.AssetAlerts.problem.instance | String | The instance of the problem. |
| PrismaCloud.AssetAlerts.problem.type | String | The type of the problem. |
| PrismaCloud.AssetAlerts.problem.parameters | Unknown | The parameters of the problem. |
| PrismaCloud.AssetAlerts.id | String | The ID of the asset alert. |
| PrismaCloud.AssetAlerts.severity | String | The severity of the asset alert. |
| PrismaCloud.AssetAlerts.policyId | String | The policy ID of the asset alert. |
| PrismaCloud.AssetAlerts.isHyperionPolicy | Boolean | The hyperion policy of the asset alert. |
| PrismaCloud.AssetAlerts.policyType | String | The policy type of the asset alert. |
| PrismaCloud.AssetAlerts.policyName | String | The policy name of the asset alert. |
| PrismaCloud.AssetAlerts.policyDescription | String | The policy description of the asset alert. |
| PrismaCloud.AssetAlerts.alertTime | Number | The alert time of the asset alert. |
prisma-cloud-asset-network-get
Returns detailed information for the asset network with the given ID.
Base Command
prisma-cloud-asset-network-get
Input
| Argument Name | Description | Required |
|---|---|---|
| asset_id | Unified asset ID or RRN (Restricted Resource Name). | Required |
| finding_type | External finding types. Possible values are: COMPLIANCE_CIS, GUARD_DUTY_HOST, GUARD_DUTY_IAM, INSPECTOR_RBA, INSPECTOR_SBP, NETWORK_REACHABILITY, AZURE_SECURITY_CENTER_ALERTS, UNCLASSIFIED, COMMAND_AND_CONTROL, CREDENTIAL_ACCESS, CROSS_ACCOUNT_TRUST, DATA_EXFILTRATION, DEFENSE_EVASION, DISCOVERY, HIGH_PRIVILEGED_ROLE, INITIAL_ACCESS, INTERNET_EXPOSURE, KEYS_AND_SECRETS, LATERAL_MOVEMENT, MALWARE, MFA, MISCONFIGURATION, NETWORK_ANOMALY, PRIVILEGE_ESCALATION, RECONNAISSANCE, RESOURCE_HIJACKING, SSH_BRUTE_FORCE, UNAUTHORIZED_ACCESS, UNENCRYPTED_DATA, UNUSED_PRIVILEGES, USER_ANOMALY, WEAK_PASSWORD, SENSITIVE_DATA_EXPOSURE, INJECTIONS, VULNERABILITY_SCANNING, SHELLSHOCK, KNOWN_BOTS, UNKNOWN_BOTS, VIRTUAL_PATCHES, WEB_ATTACK, BOT_ACTIVITY, WEB_SCRAPING, CUSTOM, VULNERABILITY, HOST_VULNERABILITY_CVE, CONTAINER_IMAGE_VULNERABILITY_CVE, VIRTUAL_IMAGE_VULNERABILITY_CVE, SERVERLESS_VULNERABILITY, PACKAGE_VULNERABILITY. | Optional |
| risk_factors | Comma-separated list of external finding risk factors. Possible values are: CRITICAL_SEVERITY, HIGH_SEVERITY, MEDIUM_SEVERITY, HAS_FIX, REMOTE_EXECUTION, DOS, RECENT_VULNERABILITY, EXPLOIT_EXISTS, ATTACK_COMPLEXITY_LOW, ATTACK_VECTOR_NETWORK, REACHABLE_FROM_THE_INTERNET, LISTENING_PORTS, CONTAINER_IS_RUNNING_AS_ROOT, NO_MANDATORY_SECURITY_PROFILE_APPLIED, RUNNING_AS_PRIVILEGED_CONTAINER, PACKAGE_IN_USE, DOS_LOW, DOS_HIGH, EXPLOIT_EXISTS_IN_THE_WILD, EXPLOIT_EXISTS_POC, SENSITIVE_INFORMATION, ROOT_MOUNT, RUNTIME_SOCKET, HOST_ACCESS. | Optional |
| timeline_item_id | Timeline item ID. | Optional |
| alert_ids | Comma-separated list of alert IDs. | Optional |
| limit | Limit number of records. | Optional |
| permission_type | Permissions type. | Optional |
| page_token | Next page token. | Optional |
| prisma_cloud_findings_only | Filter Hyperion findings. Possible values are: true, false. | Optional |
| vulnerability_info_type_id | CVE ID, package ID, or layer ID. The value needs to be fetched from one of the group by API calls. | Optional |
| vulnerability_info_type | Supported vulnerability types. Possible values are: CVE, PACKAGE, LAYER. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| PrismaCloud.AssetNetwork.problem.title | String | The title of the problem. |
| PrismaCloud.AssetNetwork.problem.status.statusCode | Number | The status code of the problem. |
| PrismaCloud.AssetNetwork.problem.status.reasonPhrase | String | The reason for the problem. |
| PrismaCloud.AssetNetwork.problem.detail | String | The details of the problem. |
| PrismaCloud.AssetNetwork.problem.instance | String | The instance of the problem. |
| PrismaCloud.AssetNetwork.problem.type | String | The type of the problem. |
| PrismaCloud.AssetNetwork.problem.parameters | Unknown | The parameters of the problem. |
| PrismaCloud.AssetNetwork.id | Number | The ID of the asset network. |
| PrismaCloud.AssetNetwork.access | String | The access of the asset network. |
| PrismaCloud.AssetNetwork.direction | String | The direction of the asset network. |
| PrismaCloud.AssetNetwork.ips | String | The IPS of the asset network. |
| PrismaCloud.AssetNetwork.ports | String | The ports of the asset network. |
| PrismaCloud.AssetNetwork.protocol | String | The protocol of the asset network. |
| PrismaCloud.AssetNetwork.priority | Number | The priority of the asset network. |
prisma-cloud-asset-vulnerabilities-get
Returns detailed information for the asset vulnerabilities with the given ID.
Base Command
prisma-cloud-asset-vulnerabilities-get
Input
| Argument Name | Description | Required |
|---|---|---|
| asset_id | Unified asset ID or RRN (Restricted Resource Name). | Required |
| finding_type | External finding types. Possible values are: COMPLIANCE_CIS, GUARD_DUTY_HOST, GUARD_DUTY_IAM, INSPECTOR_RBA, INSPECTOR_SBP, NETWORK_REACHABILITY, AZURE_SECURITY_CENTER_ALERTS, UNCLASSIFIED, COMMAND_AND_CONTROL, CREDENTIAL_ACCESS, CROSS_ACCOUNT_TRUST, DATA_EXFILTRATION, DEFENSE_EVASION, DISCOVERY, HIGH_PRIVILEGED_ROLE, INITIAL_ACCESS, INTERNET_EXPOSURE, KEYS_AND_SECRETS, LATERAL_MOVEMENT, MALWARE, MFA, MISCONFIGURATION, NETWORK_ANOMALY, PRIVILEGE_ESCALATION, RECONNAISSANCE, RESOURCE_HIJACKING, SSH_BRUTE_FORCE, UNAUTHORIZED_ACCESS, UNENCRYPTED_DATA, UNUSED_PRIVILEGES, USER_ANOMALY, WEAK_PASSWORD, SENSITIVE_DATA_EXPOSURE, INJECTIONS, VULNERABILITY_SCANNING, SHELLSHOCK, KNOWN_BOTS, UNKNOWN_BOTS, VIRTUAL_PATCHES, WEB_ATTACK, BOT_ACTIVITY, WEB_SCRAPING, CUSTOM, VULNERABILITY, HOST_VULNERABILITY_CVE, CONTAINER_IMAGE_VULNERABILITY_CVE, VIRTUAL_IMAGE_VULNERABILITY_CVE, SERVERLESS_VULNERABILITY, PACKAGE_VULNERABILITY. | Optional |
| risk_factors | Comma-separated list of external finding risk factors. Possible values are: CRITICAL_SEVERITY, HIGH_SEVERITY, MEDIUM_SEVERITY, HAS_FIX, REMOTE_EXECUTION, DOS, RECENT_VULNERABILITY, EXPLOIT_EXISTS, ATTACK_COMPLEXITY_LOW, ATTACK_VECTOR_NETWORK, REACHABLE_FROM_THE_INTERNET, LISTENING_PORTS, CONTAINER_IS_RUNNING_AS_ROOT, NO_MANDATORY_SECURITY_PROFILE_APPLIED, RUNNING_AS_PRIVILEGED_CONTAINER, PACKAGE_IN_USE, DOS_LOW, DOS_HIGH, EXPLOIT_EXISTS_IN_THE_WILD, EXPLOIT_EXISTS_POC, SENSITIVE_INFORMATION, ROOT_MOUNT, RUNTIME_SOCKET, HOST_ACCESS. | Optional |
| timeline_item_id | Timeline item ID. | Optional |
| alert_ids | Comma-separated list of alert IDs. | Optional |
| limit | Limit number of records. | Optional |
| permission_type | Permissions type. | Optional |
| page_token | Next page token. | Optional |
| prisma_cloud_findings_only | Filter Hyperion findings. Possible values are: true, false. | Optional |
| vulnerability_info_type_id | CVE ID, package ID, or layer ID. The value needs to be fetched from one of the group by API calls. | Optional |
| vulnerability_info_type | Supported vulnerability types. Possible values are: CVE, PACKAGE, LAYER. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| PrismaCloud.AssetVulnerabilities.problem.title | String | The title of the problem. |
| PrismaCloud.AssetVulnerabilities.problem.status.statusCode | Number | The status code of the problem. |
| PrismaCloud.AssetVulnerabilities.problem.status.reasonPhrase | String | The reason for the problem. |
| PrismaCloud.AssetVulnerabilities.problem.detail | String | The details of the problem. |
| PrismaCloud.AssetVulnerabilities.problem.instance | String | The instance of the problem. |
| PrismaCloud.AssetVulnerabilities.problem.type | String | The type of the problem. |
| PrismaCloud.AssetVulnerabilities.problem.parameters | Unknown | The parameters of the problem. |
| PrismaCloud.AssetVulnerabilities.accountId | String | The account ID of the asset vulnerability. |
| PrismaCloud.AssetVulnerabilities.count | String | The count of asset vulnerabilities. |
| PrismaCloud.AssetVulnerabilities.createdOn | Number | The created on of the asset vulnerability. |
| PrismaCloud.AssetVulnerabilities.customerId | Number | The customer ID of the asset vulnerability. |
| PrismaCloud.AssetVulnerabilities.cveId | String | The CVE ID of the asset vulnerability. |
| PrismaCloud.AssetVulnerabilities.description | String | The description of the asset vulnerability. |
| PrismaCloud.AssetVulnerabilities.externalId | Number | The external ID of the asset vulnerability. |
| PrismaCloud.AssetVulnerabilities.id | String | The ID of the asset vulnerability. |
| PrismaCloud.AssetVulnerabilities.normalizedName | String | The normalized name of the asset vulnerability. |
| PrismaCloud.AssetVulnerabilities.normalizedNames | String | The normalized names of the asset vulnerability. |
| PrismaCloud.AssetVulnerabilities.nvdUrl | String | The nvd URL of the asset vulnerability. |
| PrismaCloud.AssetVulnerabilities.link | String | The link of the asset vulnerability. |
| PrismaCloud.AssetVulnerabilities.rawData | String | The raw data of the asset vulnerability. |
| PrismaCloud.AssetVulnerabilities.regionId | String | The region ID of the asset vulnerability. |
| PrismaCloud.AssetVulnerabilities.resourceCloudId | String | The resource cloud ID of the asset vulnerability. |
| PrismaCloud.AssetVulnerabilities.resourceId | Number | The resource ID of the asset vulnerability. |
| PrismaCloud.AssetVulnerabilities.resourceUrl | String | The resource URL of the asset vulnerability. |
| PrismaCloud.AssetVulnerabilities.riskFactors | String | The risk factors of the asset vulnerability. |
| PrismaCloud.AssetVulnerabilities.rlUpdatedOn | Number | The rl updated on of the asset vulnerability. |
| PrismaCloud.AssetVulnerabilities.scanId | String | The scan ID of the asset vulnerability. |
| PrismaCloud.AssetVulnerabilities.score | String | The score of the asset vulnerability. |
| PrismaCloud.AssetVulnerabilities.severity | String | The severity of the asset vulnerability. |
| PrismaCloud.AssetVulnerabilities.source | String | The source of the asset vulnerability. |
| PrismaCloud.AssetVulnerabilities.sourceData | Unknown | The source data of the asset vulnerability. |
| PrismaCloud.AssetVulnerabilities.status | String | The status of the asset vulnerability. |
| PrismaCloud.AssetVulnerabilities.title | String | The title of the asset vulnerability. |
| PrismaCloud.AssetVulnerabilities.type | String | The type of the asset vulnerability. |
| PrismaCloud.AssetVulnerabilities.packageName | String | The package name of the asset vulnerability. |
| PrismaCloud.AssetVulnerabilities.updatedOn | Number | The updated on of the asset vulnerability. |
prisma-cloud-asset-get
Returns detailed information for the asset with the given ID.
Base Command
prisma-cloud-asset-get
Input
| Argument Name | Description | Required |
|---|---|---|
| asset_id | Unified Asset ID or RRN (Restricted Resource Name). | Required |
| finding_type | External finding types. Possible values are: COMPLIANCE_CIS, GUARD_DUTY_HOST, GUARD_DUTY_IAM, INSPECTOR_RBA, INSPECTOR_SBP, NETWORK_REACHABILITY, AZURE_SECURITY_CENTER_ALERTS, UNCLASSIFIED, COMMAND_AND_CONTROL, CREDENTIAL_ACCESS, CROSS_ACCOUNT_TRUST, DATA_EXFILTRATION, DEFENSE_EVASION, DISCOVERY, HIGH_PRIVILEGED_ROLE, INITIAL_ACCESS, INTERNET_EXPOSURE, KEYS_AND_SECRETS, LATERAL_MOVEMENT, MALWARE, MFA, MISCONFIGURATION, NETWORK_ANOMALY, PRIVILEGE_ESCALATION, RECONNAISSANCE, RESOURCE_HIJACKING, SSH_BRUTE_FORCE, UNAUTHORIZED_ACCESS, UNENCRYPTED_DATA, UNUSED_PRIVILEGES, USER_ANOMALY, WEAK_PASSWORD, SENSITIVE_DATA_EXPOSURE, INJECTIONS, VULNERABILITY_SCANNING, SHELLSHOCK, KNOWN_BOTS, UNKNOWN_BOTS, VIRTUAL_PATCHES, WEB_ATTACK, BOT_ACTIVITY, WEB_SCRAPING, CUSTOM, VULNERABILITY, HOST_VULNERABILITY_CVE, CONTAINER_IMAGE_VULNERABILITY_CVE, VIRTUAL_IMAGE_VULNERABILITY_CVE, SERVERLESS_VULNERABILITY, PACKAGE_VULNERABILITY. | Optional |
| risk_factors | Comma-separated list of external finding risk factors. Possible values are: CRITICAL_SEVERITY, HIGH_SEVERITY, MEDIUM_SEVERITY, HAS_FIX, REMOTE_EXECUTION, DOS, RECENT_VULNERABILITY, EXPLOIT_EXISTS, ATTACK_COMPLEXITY_LOW, ATTACK_VECTOR_NETWORK, REACHABLE_FROM_THE_INTERNET, LISTENING_PORTS, CONTAINER_IS_RUNNING_AS_ROOT, NO_MANDATORY_SECURITY_PROFILE_APPLIED, RUNNING_AS_PRIVILEGED_CONTAINER, PACKAGE_IN_USE, DOS_LOW, DOS_HIGH, EXPLOIT_EXISTS_IN_THE_WILD, EXPLOIT_EXISTS_POC, SENSITIVE_INFORMATION, ROOT_MOUNT, RUNTIME_SOCKET, HOST_ACCESS. | Optional |
| timeline_item_id | Timeline item ID. | Optional |
| alert_ids | Comma-separated list of alert IDs. | Optional |
| limit | Limit number of records. | Optional |
| permission_type | Permissions type. | Optional |
| page_token | Next page token. | Optional |
| prisma_cloud_findings_only | Filter Hyperion findings. Possible values are: true, false. | Optional |
| vulnerability_info_type_id | CVE ID, Package ID, or Layer ID. The value needs to be fetched from one of the groups by API calls. | Optional |
| vulnerability_info_type | Supported vulnerability types. Possible values are: CVE, PACKAGE, LAYER. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| PrismaCloud.Asset.problem.title | String | The title of the problem. |
| PrismaCloud.Asset.problem.status.statusCode | Number | The status code of the problem. |
| PrismaCloud.Asset.problem.status.reasonPhrase | String | The reason for the problem. |
| PrismaCloud.Asset.problem.detail | String | The details of the problem. |
| PrismaCloud.Asset.problem.instance | String | The instance of the problem. |
| PrismaCloud.Asset.problem.type | String | The type of the problem. |
| PrismaCloud.Asset.problem.parameters | Unknown | The parameters of the problem. |
| PrismaCloud.Asset.id | String | The ID of the asset. |
| PrismaCloud.Asset.prismaId | String | The Prisma ID of the asset. |
| PrismaCloud.Asset.appName | String | The app name of the asset. |
| PrismaCloud.Asset.externalAssetId | String | The external asset ID of the asset. |
| PrismaCloud.Asset.assetTypeId | Number | The asset type ID of the asset. |
| PrismaCloud.Asset.cloudType | String | The cloud type of the asset. |
| PrismaCloud.Asset.createdTs | Number | The creation timestamp of the asset. |
| PrismaCloud.Asset.insertTs | Number | The insertion timestamp of the asset. |
| PrismaCloud.Asset.data | Unknown | The data of the asset. |
| PrismaCloud.Asset.dynamicData | Unknown | The dynamic data of the asset. |
| PrismaCloud.Asset.riskGrade | String | The risk grade of the asset. |
| PrismaCloud.Asset.stateId | String | The state ID of the asset. |
| PrismaCloud.Asset.name | String | The name of the asset. |
| PrismaCloud.Asset.regionId | String | The region ID of the asset. |
| PrismaCloud.Asset.regionName | String | The region name of the asset. |
| PrismaCloud.Asset.altAssetId | String | The alternative asset ID of the asset. |
| PrismaCloud.Asset.url | String | The URL of the asset. |
| PrismaCloud.Asset.vpcId | String | The VPC ID of the asset. |
| PrismaCloud.Asset.vpcExternalAssetId | String | The VPC external asset ID of the asset. |
| PrismaCloud.Asset.vpcName | String | The VPC name of the asset. |
| PrismaCloud.Asset.tags | Unknown | The tags of the asset. |
| PrismaCloud.Asset.relationshipCounts | Number | The relationship counts of the asset. |
| PrismaCloud.Asset.vulnerabilityCounts | Unknown | The vulnerability counts of the asset. |
| PrismaCloud.Asset.accountName | String | The account name of the asset. |
| PrismaCloud.Asset.assetType | String | The account type of the asset. |
| PrismaCloud.Asset.serviceName | String | The service name of the asset. |
| PrismaCloud.Asset.resourceType | String | The resource type of the asset. |
| PrismaCloud.Asset.deleted | Boolean | The deletion state of the asset. |
| PrismaCloud.Asset.assetClassId | String | The asset class ID of the asset. |
| PrismaCloud.Asset.assetClass | String | The asset class of the asset. |
| PrismaCloud.Asset.attributes | Unknown | The attributes of the asset. |
| PrismaCloud.Asset.alertsCount.severity | String | The severity of the alerts of the asset. |
| PrismaCloud.Asset.alertsCount.count | Number | The alert count of the asset. |
| PrismaCloud.Asset.ipAddresses | String | The IP addresses of the asset. |
| PrismaCloud.Asset.trueInternetExposure | String | The internet exposure state of the asset. |
| PrismaCloud.Asset.dataSecurity | Unknown | The data security of the asset. |
prisma-cloud-asset-generic-get
Returns detailed information for the asset with the given ID.
Base Command
prisma-cloud-asset-generic-get
Input
| Argument Name | Description | Required |
|---|---|---|
| asset_id | Unified asset ID or RRN (Restricted Resource Name). | Required |
| type | Asset domain service query type. Possible values are: external_finding, asset, asset_lite, alerts, alerts_counts, alert_summary, finding_summary, attack_path, attack_path_summary, raw_config, network, timeline, external_integration, asset_data_indicators, relationships, findings, vulnerabilities, permissions, package_info, labels, vulnerability_aggregates, process_info, vulnerabilities_group_by_type, asset_cwp_vulns, app_contexts, attributes, data_security, data_security_summary. Default is asset. | Required |
| finding_type | External finding types. Possible values are: COMPLIANCE_CIS, GUARD_DUTY_HOST, GUARD_DUTY_IAM, INSPECTOR_RBA, INSPECTOR_SBP, NETWORK_REACHABILITY, AZURE_SECURITY_CENTER_ALERTS, UNCLASSIFIED, COMMAND_AND_CONTROL, CREDENTIAL_ACCESS, CROSS_ACCOUNT_TRUST, DATA_EXFILTRATION, DEFENSE_EVASION, DISCOVERY, HIGH_PRIVILEGED_ROLE, INITIAL_ACCESS, INTERNET_EXPOSURE, KEYS_AND_SECRETS, LATERAL_MOVEMENT, MALWARE, MFA, MISCONFIGURATION, NETWORK_ANOMALY, PRIVILEGE_ESCALATION, RECONNAISSANCE, RESOURCE_HIJACKING, SSH_BRUTE_FORCE, UNAUTHORIZED_ACCESS, UNENCRYPTED_DATA, UNUSED_PRIVILEGES, USER_ANOMALY, WEAK_PASSWORD, SENSITIVE_DATA_EXPOSURE, INJECTIONS, VULNERABILITY_SCANNING, SHELLSHOCK, KNOWN_BOTS, UNKNOWN_BOTS, VIRTUAL_PATCHES, WEB_ATTACK, BOT_ACTIVITY, WEB_SCRAPING, CUSTOM, VULNERABILITY, HOST_VULNERABILITY_CVE, CONTAINER_IMAGE_VULNERABILITY_CVE, VIRTUAL_IMAGE_VULNERABILITY_CVE, SERVERLESS_VULNERABILITY, PACKAGE_VULNERABILITY. | Optional |
| risk_factors | Comma-separated list of external finding risk factors. Possible values are: CRITICAL_SEVERITY, HIGH_SEVERITY, MEDIUM_SEVERITY, HAS_FIX, REMOTE_EXECUTION, DOS, RECENT_VULNERABILITY, EXPLOIT_EXISTS, ATTACK_COMPLEXITY_LOW, ATTACK_VECTOR_NETWORK, REACHABLE_FROM_THE_INTERNET, LISTENING_PORTS, CONTAINER_IS_RUNNING_AS_ROOT, NO_MANDATORY_SECURITY_PROFILE_APPLIED, RUNNING_AS_PRIVILEGED_CONTAINER, PACKAGE_IN_USE, DOS_LOW, DOS_HIGH, EXPLOIT_EXISTS_IN_THE_WILD, EXPLOIT_EXISTS_POC, SENSITIVE_INFORMATION, ROOT_MOUNT, RUNTIME_SOCKET, HOST_ACCESS. | Optional |
| timeline_item_id | Timeline item ID. | Optional |
| alert_ids | Comma-separated list of alert IDs. | Optional |
| limit | Limit number of records. | Optional |
| permission_type | Permissions type. | Optional |
| page_token | Next page token. | Optional |
| prisma_cloud_findings_only | Filter Hyperion findings. Possible values are: true, false. | Optional |
| vulnerability_info_type_id | CVE ID, package ID, or layer ID. The value needs to be fetched from one of the group by API calls. | Optional |
| vulnerability_info_type | Supported vulnerability types. Possible values are: CVE, PACKAGE, LAYER. | Optional |
Context Output
There is no context output for this command.
prisma-cloud-asset-findings-get
Returns detailed information for the asset findings with the given ID.
Base Command
prisma-cloud-asset-findings-get
Input
| Argument Name | Description | Required |
|---|---|---|
| asset_id | Unified asset ID or RRN (Restricted Resource Name). | Required |
| finding_type | External finding types. Possible values are: COMPLIANCE_CIS, GUARD_DUTY_HOST, GUARD_DUTY_IAM, INSPECTOR_RBA, INSPECTOR_SBP, NETWORK_REACHABILITY, AZURE_SECURITY_CENTER_ALERTS, UNCLASSIFIED, COMMAND_AND_CONTROL, CREDENTIAL_ACCESS, CROSS_ACCOUNT_TRUST, DATA_EXFILTRATION, DEFENSE_EVASION, DISCOVERY, HIGH_PRIVILEGED_ROLE, INITIAL_ACCESS, INTERNET_EXPOSURE, KEYS_AND_SECRETS, LATERAL_MOVEMENT, MALWARE, MFA, MISCONFIGURATION, NETWORK_ANOMALY, PRIVILEGE_ESCALATION, RECONNAISSANCE, RESOURCE_HIJACKING, SSH_BRUTE_FORCE, UNAUTHORIZED_ACCESS, UNENCRYPTED_DATA, UNUSED_PRIVILEGES, USER_ANOMALY, WEAK_PASSWORD, SENSITIVE_DATA_EXPOSURE, INJECTIONS, VULNERABILITY_SCANNING, SHELLSHOCK, KNOWN_BOTS, UNKNOWN_BOTS, VIRTUAL_PATCHES, WEB_ATTACK, BOT_ACTIVITY, WEB_SCRAPING, CUSTOM, VULNERABILITY, HOST_VULNERABILITY_CVE, CONTAINER_IMAGE_VULNERABILITY_CVE, VIRTUAL_IMAGE_VULNERABILITY_CVE, SERVERLESS_VULNERABILITY, PACKAGE_VULNERABILITY. | Optional |
| risk_factors | Comma-separated list of external finding risk factors. Possible values are: CRITICAL_SEVERITY, HIGH_SEVERITY, MEDIUM_SEVERITY, HAS_FIX, REMOTE_EXECUTION, DOS, RECENT_VULNERABILITY, EXPLOIT_EXISTS, ATTACK_COMPLEXITY_LOW, ATTACK_VECTOR_NETWORK, REACHABLE_FROM_THE_INTERNET, LISTENING_PORTS, CONTAINER_IS_RUNNING_AS_ROOT, NO_MANDATORY_SECURITY_PROFILE_APPLIED, RUNNING_AS_PRIVILEGED_CONTAINER, PACKAGE_IN_USE, DOS_LOW, DOS_HIGH, EXPLOIT_EXISTS_IN_THE_WILD, EXPLOIT_EXISTS_POC, SENSITIVE_INFORMATION, ROOT_MOUNT, RUNTIME_SOCKET, HOST_ACCESS. | Optional |
| timeline_item_id | Timeline item ID. | Optional |
| alert_ids | Comma-separated list of alert IDs. | Optional |
| limit | Limit number of records. | Optional |
| permission_type | Permissions type. | Optional |
| page_token | Next page token. | Optional |
| prisma_cloud_findings_only | Filter Hyperion findings. Possible values are: true, false. | Optional |
| vulnerability_info_type_id | CVE ID, package ID, or layer ID. The value needs to be fetched from one of the group by API calls. | Optional |
| vulnerability_info_type | Supported vulnerability types. Possible values are: CVE, PACKAGE, LAYER. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| PrismaCloud.AssetFindings.problem.title | String | The title of the problem. |
| PrismaCloud.AssetFindings.problem.status.statusCode | Number | The status code of the problem. |
| PrismaCloud.AssetFindings.problem.status.reasonPhrase | String | The reason for the problem. |
| PrismaCloud.AssetFindings.problem.detail | String | The details of the problem. |
| PrismaCloud.AssetFindings.problem.instance | String | The instance of the problem. |
| PrismaCloud.AssetFindings.problem.type | String | The type of the problem. |
| PrismaCloud.AssetFindings.problem.parameters | Unknown | The parameters of the problem. |
| PrismaCloud.AssetFindings.accountId | String | The account ID of the asset findings. |
| PrismaCloud.AssetFindings.count | String | The count of asset findings. |
| PrismaCloud.AssetFindings.createdOn | Number | The created on of the asset findings. |
| PrismaCloud.AssetFindings.customerId | Number | The customer ID of the asset findings. |
| PrismaCloud.AssetFindings.cveId | String | The CVE ID of the asset findings. |
| PrismaCloud.AssetFindings.description | String | The description of the asset findings. |
| PrismaCloud.AssetFindings.externalId | Number | The external ID of the asset findings. |
| PrismaCloud.AssetFindings.id | String | The ID of the asset findings. |
| PrismaCloud.AssetFindings.normalizedName | String | The normalized name of the asset findings. |
| PrismaCloud.AssetFindings.normalizedNames | String | The normalized names of the asset findings. |
| PrismaCloud.AssetFindings.nvdUrl | String | The nvd URL of the asset findings. |
| PrismaCloud.AssetFindings.link | String | The link of the asset findings. |
| PrismaCloud.AssetFindings.rawData | String | The raw data of the asset findings. |
| PrismaCloud.AssetFindings.regionId | String | The region ID of the asset findings. |
| PrismaCloud.AssetFindings.resourceCloudId | String | The resource cloud ID of the asset findings. |
| PrismaCloud.AssetFindings.resourceId | Number | The resource ID of the asset findings. |
| PrismaCloud.AssetFindings.resourceUrl | String | The resource URL of the asset findings. |
| PrismaCloud.AssetFindings.riskFactors | String | The risk factors of the asset findings. |
| PrismaCloud.AssetFindings.rlUpdatedOn | Number | The rl updated on of the asset findings. |
| PrismaCloud.AssetFindings.scanId | String | The scan ID of the asset findings. |
| PrismaCloud.AssetFindings.score | String | The score of the asset findings. |
| PrismaCloud.AssetFindings.severity | String | The severity of the asset findings. |
| PrismaCloud.AssetFindings.source | String | The source of the asset findings. |
| PrismaCloud.AssetFindings.sourceData | Unknown | The source data of the asset findings. |
| PrismaCloud.AssetFindings.status | String | The status of the asset findings. |
| PrismaCloud.AssetFindings.title | String | The title of the asset findings. |
| PrismaCloud.AssetFindings.type | String | The type of the asset findings. |
| PrismaCloud.AssetFindings.packageName | String | The package name of the asset findings. |
| PrismaCloud.AssetFindings.updatedOn | Number | The updated on of the asset findings. |
prisma-cloud-asset-relationships-get
Returns detailed information for the asset relationships with the given ID.
Base Command
prisma-cloud-asset-relationships-get
Input
| Argument Name | Description | Required |
|---|---|---|
| asset_id | Unified asset ID or RRN (Restricted Resource Name). | Required |
| finding_type | External finding types. Possible values are: COMPLIANCE_CIS, GUARD_DUTY_HOST, GUARD_DUTY_IAM, INSPECTOR_RBA, INSPECTOR_SBP, NETWORK_REACHABILITY, AZURE_SECURITY_CENTER_ALERTS, UNCLASSIFIED, COMMAND_AND_CONTROL, CREDENTIAL_ACCESS, CROSS_ACCOUNT_TRUST, DATA_EXFILTRATION, DEFENSE_EVASION, DISCOVERY, HIGH_PRIVILEGED_ROLE, INITIAL_ACCESS, INTERNET_EXPOSURE, KEYS_AND_SECRETS, LATERAL_MOVEMENT, MALWARE, MFA, MISCONFIGURATION, NETWORK_ANOMALY, PRIVILEGE_ESCALATION, RECONNAISSANCE, RESOURCE_HIJACKING, SSH_BRUTE_FORCE, UNAUTHORIZED_ACCESS, UNENCRYPTED_DATA, UNUSED_PRIVILEGES, USER_ANOMALY, WEAK_PASSWORD, SENSITIVE_DATA_EXPOSURE, INJECTIONS, VULNERABILITY_SCANNING, SHELLSHOCK, KNOWN_BOTS, UNKNOWN_BOTS, VIRTUAL_PATCHES, WEB_ATTACK, BOT_ACTIVITY, WEB_SCRAPING, CUSTOM, VULNERABILITY, HOST_VULNERABILITY_CVE, CONTAINER_IMAGE_VULNERABILITY_CVE, VIRTUAL_IMAGE_VULNERABILITY_CVE, SERVERLESS_VULNERABILITY, PACKAGE_VULNERABILITY. | Optional |
| risk_factors | Comma-separated list of external finding risk factors. Possible values are: CRITICAL_SEVERITY, HIGH_SEVERITY, MEDIUM_SEVERITY, HAS_FIX, REMOTE_EXECUTION, DOS, RECENT_VULNERABILITY, EXPLOIT_EXISTS, ATTACK_COMPLEXITY_LOW, ATTACK_VECTOR_NETWORK, REACHABLE_FROM_THE_INTERNET, LISTENING_PORTS, CONTAINER_IS_RUNNING_AS_ROOT, NO_MANDATORY_SECURITY_PROFILE_APPLIED, RUNNING_AS_PRIVILEGED_CONTAINER, PACKAGE_IN_USE, DOS_LOW, DOS_HIGH, EXPLOIT_EXISTS_IN_THE_WILD, EXPLOIT_EXISTS_POC, SENSITIVE_INFORMATION, ROOT_MOUNT, RUNTIME_SOCKET, HOST_ACCESS. | Optional |
| timeline_item_id | Timeline item ID. | Optional |
| alert_ids | Comma-separated list of alert IDs. | Optional |
| limit | Limit number of records. | Optional |
| permission_type | Permissions type. | Optional |
| page_token | Next page token. | Optional |
| prisma_cloud_findings_only | Filter Hyperion findings. Possible values are: true, false. | Optional |
| vulnerability_info_type_id | CVE ID, package ID, or layer ID. The value needs to be fetched from one of the group by API calls. | Optional |
| vulnerability_info_type | Supported vulnerability types. Possible values are: CVE, PACKAGE, LAYER. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| PrismaCloud.AssetRelationships.assetId | String | The asset ID of the asset relationship. |
| PrismaCloud.AssetRelationships.relationshipType | String | The relationship type of the asset relationship. |
| PrismaCloud.AssetRelationships.assetTypeId | Number | The asset type ID of the asset relationship. |
| PrismaCloud.AssetRelationships.assetType | String | The asset type of the asset relationship. |
| PrismaCloud.AssetRelationships.assetName | String | The asset name of the asset relationship. |
| PrismaCloud.AssetRelationships.externalAssetId | String | The external asset ID of the asset relationship. |
| PrismaCloud.AssetRelationships.cloudId | String | The cloud ID of the asset relationship. |
| PrismaCloud.AssetRelationships.cloudName | String | The cloud name of the asset relationship. |
| PrismaCloud.AssetRelationships.pseudoAsset | Boolean | The pseudo asset of the asset relationship. |
| PrismaCloud.AssetRelationships.region | String | The region of the asset relationship. |
| PrismaCloud.AssetRelationships.cloudAccountId | String | The cloud account ID of the asset relationship. |
| PrismaCloud.AssetRelationships.assetClassId | String | The asset class ID of the asset relationship. |
| PrismaCloud.AssetRelationships.assetClass | String | The asset class of the asset relationship. |
| PrismaCloud.AssetRelationships.alertsCount.severity | String | The severity of the alerts of the asset relationship. |
| PrismaCloud.AssetRelationships.alertsCount.count | Number | The number of alerts of the asset relationships. |
| PrismaCloud.AssetRelationships.alertCountBySeverity.severity | String | The severity of the alerts of the asset relationship. |
| PrismaCloud.AssetRelationships.alertCountBySeverity.count | Number | The number of alerts by severity of the asset relationship. |
| PrismaCloud.AssetRelationships.vulnerabilityCounts | Unknown | The number of vulnerabilities of the asset relationship. |
| PrismaCloud.AssetRelationships.problem.title | String | The title of the problem. |
| PrismaCloud.AssetRelationships.problem.status.statusCode | Number | The status code of the problem. |
| PrismaCloud.AssetRelationships.problem.status.reasonPhrase | String | The reason for the problem. |
| PrismaCloud.AssetRelationships.problem.detail | String | The details of the problem. |
| PrismaCloud.AssetRelationships.problem.instance | String | The instance of the problem. |
| PrismaCloud.AssetRelationships.problem.type | String | The type of the problem. |
| PrismaCloud.AssetRelationships.problem.parameters | Unknown | The parameters of the problem. |
Configuration parameters
url— Server URL (required)credentials— Username / Access Key ID (required)proxy— Use system proxy settingsinsecure— Trust any certificate (not secure)incidentType— Incident typeincidentFetchInterval— Incidents Fetch Intervalmax_fetch— Maximum number of incidents to fetchfirst_fetch— First fetch time intervallook_back— Advanced: Time in minutes to look back when fetching incidentsfilters— Fetch only incidents matching these filtersisFetch— Fetch incidentsmirror_direction— Incident Mirroring Directionclose_incident— Close Mirrored XSOAR Incidentclose_alert— Close Mirrored Prisma Cloud Alertoutput_old_format— Output results of V1 commands to the context data in the old format
Commands (47)
-
get-modified-remote-dataGet the list of incidents that were modified since the last update time. This method is used for debugging purposes. The get-modified-remote-data command is used as part of the Mirroring feature that was introduced in Cortex XSOAR version 6.1.
-
get-remote-dataGet remote data from a remote incident. This method does not update the current incident, and should be used for debugging purposes only.
-
prisma-cloud-access-key-createAdds a new access key for the current user. If you have API access, you can create up to two access keys.
-
prisma-cloud-access-key-deleteDeletes the access key that has the specified ID.
-
prisma-cloud-access-key-disableDeactivates the access key that has the specified ID.
-
prisma-cloud-access-key-enableActivates the access key that has the specified ID. You cannot activate an expired access key.
-
prisma-cloud-access-keys-listReturns all access keys for your tenant if you have a Prisma Cloud System Admin role. Returns just your access keys if you don't have this role.
-
prisma-cloud-account-listList accounts.
-
prisma-cloud-account-owner-listGet the owners of the provided accounts.
-
prisma-cloud-account-status-getGet the statuses of the provided accounts.
-
prisma-cloud-alert-dismissDismiss or snooze the alerts matching the given filter. Either policy IDs or alert IDs must be provided. When no absolute time nor relative time arguments are provided, the default time range is all times. For snoozing, provide "snooze_unit" and "snooze_value" arguments.
-
prisma-cloud-alert-filter-listList the acceptable filters and values for alerts.
-
prisma-cloud-alert-get-detailsGets the details of an alert based on the alert ID.
-
prisma-cloud-alert-remediateRemediates the alert with the specified ID, if that alert is associated with a remediable policy. In order to check what remediation would run, use the "prisma-cloud-remediation-command-list" command first.
-
prisma-cloud-alert-reopenRe-open the alerts matching the given filter. Either policy IDs or alert IDs must be provided. When no absolute time nor relative time arguments are provided, the default time range is all times.
-
prisma-cloud-alert-searchSearch alerts on the Prisma Cloud platform. When no absolute time nor relative time arguments are provided, the search will show alerts from the last 7 days.
-
prisma-cloud-asset-alerts-getReturns detailed information for the asset alerts with the given ID.
-
prisma-cloud-asset-findings-getReturns detailed information for the asset findings with the given ID.
-
prisma-cloud-asset-generic-getReturns detailed information for the asset with the given ID.
-
prisma-cloud-asset-getReturns detailed information for the asset with the given ID.
-
prisma-cloud-asset-network-getReturns detailed information for the asset network with the given ID.
-
prisma-cloud-asset-relationships-getReturns detailed information for the asset relationships with the given ID.
-
prisma-cloud-asset-vulnerabilities-getReturns detailed information for the asset vulnerabilities with the given ID.
-
prisma-cloud-code-issues-listRetrieves the code errors detected by Application Security during periodic scans. At least one filtering argument is required, excluding `search_scopes`, `search_term`, and `limit`. For example, `fixable_only` or 'branch`.
-
prisma-cloud-config-searchSearch configuration inventory on the Prisma Cloud platform using RQL language. Use this command for all queries that start with "config". When no absolute time nor relative time arguments are provided, the default time range is all times.
-
prisma-cloud-error-file-listDeprecatedThis command is deprecated. Use prisma-cloud-code-issues-list instead.
-
prisma-cloud-event-searchSearch events inventory on the Prisma Cloud platform using RQL language. Use this command for all queries that start with "event". When no absolute time nor relative time arguments are provided, the default time range is all times. In order to reduce the returned data, set the "include_resource_json" argument to "false".
-
prisma-cloud-host-finding-listGet resource host finding list.
-
prisma-cloud-network-searchSearch networks inventory on the Prisma Cloud platform using RQL language. Use this command for all queries that start with "networks". When no absolute time nor relative time arguments are provided, the default time range is all times. In order to limit the results returning, use "limit search records to" at the end of the RQL query, followed by a value from one of these options: 1, 10, 100, 1000, and 10,000.
-
prisma-cloud-permission-listGet permission list. You must provide either "query" or "next_token".
-
prisma-cloud-remediation-command-listGenerates and returns a list of remediation commands for the specified alerts and policies. Data returned for a successful call include fully constructed commands for remediation. Either a policy ID or alert IDs must be provided. The returned information can be retrieved in the UI by clicking the "Remediate" button under the "Actions" column for supported alerts. When no absolute time nor relative time arguments are provided, the default time range is all times.
-
prisma-cloud-resource-getGet resource details.
-
prisma-cloud-resource-listReturns all the resource lists. Maps to the Resource Lists under Settings > Resource Lists in the Console UI.
-
prisma-cloud-trigger-scanTrigger asynchronous scan of all resources to refresh the current state at Prisma Cloud Code Security. In order to use this command, the "Code Security" module needs to be enabled and accessible in the Prisma Cloud UI.
-
prisma-cloud-user-roles-listRetrieves user roles. Maps to Settings > Access Control > Roles in the Console UI.
-
prisma-cloud-users-listLists all users and service accounts for your tenant. Maps to Settings > Access Control > Users in the Console UI.
-
redlock-dismiss-alertsDeprecatedDismiss the alerts matching the given filter. Must provide either policy IDs or alert IDs.
-
redlock-get-alert-detailsDeprecatedGets the details of an alert based on the alert ID.
-
redlock-get-remediation-detailsDeprecatedGets remediation details for the given alert.
-
redlock-get-rql-responseDeprecatedReturns the results of an RQL config query.
-
redlock-list-alert-filtersDeprecatedList the acceptable filters and values for alerts.
-
redlock-reopen-alertsDeprecatedRe-open the alerts matching the given filter. Must provide either policy IDs or alert IDs.
-
redlock-search-alertsDeprecatedSearch alerts on the Prisma Cloud platform. If no time-range arguments are given, the search will filter only alerts from the last 7 days.
-
redlock-search-configDeprecatedSearch the configuration inventory on the Prisma Cloud platform using RQL language.
-
redlock-search-eventDeprecatedSearch events on the Prisma Cloud platform using RQL language.
-
redlock-search-networkDeprecatedSearch networks on the Prisma Cloud platform using RQL language.
-
update-remote-systemUpdates the remote incident with local incident changes. This method is only used for debugging purposes and will not update the current incident.
sectionorder: - Connect - Collect commonfields: id: PrismaCloud v2 version: -1 name: PrismaCloud v2 display: Prisma Cloud v2 category: Network Security provider: Palo Alto Networks description: Prisma Cloud secures infrastructure, workloads and applications, across the entire cloud-native technology stack. configuration: - additionalinfo: 'Prisma Cloud service tenant admin console URL. The URL for the Prisma Cloud service varies depending on the cluster on which your tenant is deployed. For more information see: https://pan.dev/prisma-cloud/api/cspm/api-urls/.' name: url display: Server URL defaultvalue: https://api.prismacloud.io/ type: 0 required: true section: Connect - display: Username / Access Key ID name: credentials required: true type: 9 displaypassword: Password / Access Key Secret section: Connect - name: proxy display: Use system proxy settings defaultvalue: 'false' type: 8 section: Connect advanced: true required: false - name: insecure display: Trust any certificate (not secure) defaultvalue: 'false' type: 8 section: Connect advanced: true required: false - display: Incident type name: incidentType type: 13 section: Connect required: false supportedModules: - agentix - xsiam - display: Incidents Fetch Interval name: incidentFetchInterval defaultvalue: '1' required: false type: 19 section: Collect advanced: true supportedModules: - agentix - xsiam - additionalinfo: Maximum is limited to 200. defaultvalue: '50' display: Maximum number of incidents to fetch name: max_fetch type: 0 section: Collect required: false supportedModules: - agentix - xsiam - additionalinfo: Date or relative timestamp to start fetching incidents from, in the format of <number> <time unit>. For example, 2 minutes, 12 hours, 6 days, 2 weeks, 3 months, 1 year, ISO timestamp. Default is 3 days. defaultvalue: 3 days display: First fetch time interval name: first_fetch type: 0 section: Collect required: false - additionalinfo: Use this parameter to determine how far back to look in the search for incidents that were created before the last run time and did not match the query when they were created. When choosing to increase this value, duplicate incidents might occur at increase time. defaultvalue: 20 display: 'Advanced: Time in minutes to look back when fetching incidents' name: look_back type: 0 section: Collect advanced: true required: false - display: Fetch only incidents matching these filters defaultvalue: 'alert.status=open' name: filters type: 0 additionalinfo: 'Comma-separated list of filter name and value, in the following format: filtername1=filtervalue1,filtername2=filtervalue2,etc. Names and possible values for filters can be found by running the "prisma-cloud-alert-filter-list" command.' section: Collect advanced: true required: false - display: Fetch incidents name: isFetch type: 8 section: Collect supportedModules: - agentix - xsiam - additionalinfo: 'Choose the direction to mirror the incident: Incoming (from Prisma Cloud to Cortex XSOAR), Outgoing (from Cortex XSOAR to Prisma Cloud), or Incoming and Outgoing (from/to Cortex XSOAR and Prisma Cloud). Cortex XSOAR only parameter.' defaultvalue: None display: Incident Mirroring Direction name: mirror_direction options: - None - Incoming - Outgoing - Incoming And Outgoing required: false type: 15 section: Collect hidden: - marketplacev2 - platform - additionalinfo: When selected, closing and re-opening the Prisma Cloud alert is mirrored in Cortex XSOAR. Cortex XSOAR only parameter. defaultvalue: 'false' display: Close Mirrored XSOAR Incident name: close_incident required: false type: 8 section: Collect hidden: - marketplacev2 - platform - additionalinfo: When selected, closing and re-opening the Cortex XSOAR incident is mirrored in Prisma Cloud. defaultvalue: 'false' display: Close Mirrored Prisma Cloud Alert name: close_alert required: false type: 8 section: Collect - name: output_old_format display: Output results of V1 commands to the context data in the old format defaultvalue: 'false' type: 8 section: Connect advanced: true required: false script: script: '' type: python subtype: python3 dockerimage: demisto/python3:3.12.13.10116658 isfetch: true isremotesyncin: true isremotesyncout: true commands: - arguments: - name: page description: Page number to return. First page is 0. type: integer - name: page_size description: Number of results in a page. Maximum is 1000. type: integer - description: Comma-separated list of names of Git users. isArray: true name: git_users - description: A branch name. isArray: false name: branch - description: Comma-separated list of code issue categories. Is also available as a search criteria (search_scopes). isArray: true name: code_categories auto: PREDEFINED predefined: - IacMisconfiguration - IacExternalModule - ImageReferencerVul - ImageReferencerLicenses - Vulnerabilities - Licenses - Secrets - description: Comma-separated list of categories related to Infrastructure-as-Code (IaC) issues. isArray: true name: iac_categories auto: PREDEFINED predefined: - IAM - Monitoring - Networking - Kubernetes - General - Storage - Public - Drift - Compute - description: Comma-separated list of labels associated with Infrastructure-as-Code (IaC). name: iac_labels isArray: true auto: PREDEFINED predefined: - CustomPolicy - HasFix - description: Comma-separated list of file types. name: file_types isArray: true auto: PREDEFINED predefined: - build.gradle - gradle.properties - build.gradle.kts - pom.xml - requirements.txt - package-lock.json - package.json - bower.json - go.sum - go.mod - tf - json - yml - yaml - Template - .checkov.baseline - Hcl - Dockerfile - gradle-wrapper.properties - METADATA - Bicep - Pipfile.lock - Pipfile - Yarn.lock - Gemfile - Gemfile.lock - gemspec - env - settings.py - main.py - application.py - config.py - app.js - config.js - dev.js - db.properties - application.properties - private.pem - privatekey.pem - Index.php - config.php - config.xml - strings.xml - app.module.ts - environment.ts - tpl - tfvars - unknown - csproj - packages.config - Directory.Packages.props - paket.dependencies - paket.references - paket.lock - sln - config - composer.json - composer.lock - description: Whether to retrieve only fixable issues. Recommended to use this argument with another argument (code_categories, file_types, iac_categories...) name: fixable_only type: Boolean auto: PREDEFINED predefined: - 'true' - 'false' - description: Comma-separated list of repository names. name: repositories isArray: true - description: Comma-separated list of risk factors related to secrets. name: secrets_risk_factors isArray: true auto: PREDEFINED predefined: - PublicRepository - PrivateRepository - User - Privileged - Valid - Invalid - Unknown - FoundInHistory - description: Comma-separated list of specific areas or categories within which to search. When specifying `search_scopes`, `search_term` argument is required. name: search_scopes isArray: true auto: PREDEFINED predefined: - IacMisconfiguration - IacExternalModule - ImageReferencerVul - ImageReferencerLicenses - Vulnerabilities - Licenses - Secrets - description: Comma-separated list of criticality of issues. name: severities isArray: true auto: PREDEFINED predefined: - INFO - LOW - MEDIUM - HIGH - CRITICAL - description: Comma-separated list of risk factors for vulnerabilities. name: vulnerability_risk_factors isArray: true auto: PREDEFINED predefined: - AttackComplexity - AttackVector - DoS - HasFix - RemoteExecution - ExploitInTheWild - ExploitPOC - IsUsed - description: A keyword or phrase used to narrow down results within specific scopes (like a particular vulnerability). This argument is require when filtering results by search_scopes. name: search_term - description: An infrastructure-as-code (IaC) resource. Relevant only to IacMisconfiguration, Vulnerabilities. name: iac_tags - description: Comma-separated list of license types. name: license_type isArray: true - description: Status of checks. name: check_status auto: PREDEFINED predefined: - Error - Passed - Suppressed - FixPending - description: The limit of issues to retrieve. If `page` and `page_size` arguments are provided, then the limit argument is ignored. name: limit defaultValue: 50 description: Retrieves the code errors detected by Application Security during periodic scans. At least one filtering argument is required, excluding `search_scopes`, `search_term`, and `limit`. For example, `fixable_only` or 'branch`. name: 'prisma-cloud-code-issues-list' outputs: - contextPath: PrismaCloud.CodeIssue.modifiedOn description: The date and time when the code issue was last modified. type: String - contextPath: PrismaCloud.CodeIssue.isPublic description: Indicates whether the repository or resource is publicly accessible (true/false). type: String - contextPath: PrismaCloud.CodeIssue.fileType description: The type of file where the issue was detected (e.g., `.js`, `.py`). type: String - contextPath: PrismaCloud.CodeIssue.secretCommitRemove description: The commit identifier where a secret was removed. type: String - contextPath: PrismaCloud.CodeIssue.secretCommitAdd description: The commit identifier where a secret was added. type: String - contextPath: PrismaCloud.CodeIssue.gitUser description: The username of the person who made the commit associated with the code issue. type: String - contextPath: PrismaCloud.CodeIssue.codePath description: The path to the code file where the issue was detected. type: String - contextPath: PrismaCloud.CodeIssue.codeCategory description: The category or classification of the detected issue (e.g., security, compliance). type: String - contextPath: PrismaCloud.CodeIssue.author description: The original author of the code where the issue was detected. type: String - contextPath: PrismaCloud.CodeIssue.repositoryUuid description: The unique identifier of the repository where the issue was found. type: String - contextPath: PrismaCloud.CodeIssue.path description: The path in the repository where the issue was detected. type: String - contextPath: PrismaCloud.CodeIssue.repositorySource description: The source of the repository (e.g., GitHub, Bitbucket). type: String - contextPath: PrismaCloud.CodeIssue.firstDetected description: The date and time when the code issue was first detected. type: String - contextPath: PrismaCloud.CodeIssue.codeIssueLine description: The line number in the code where the issue was detected. type: String - contextPath: PrismaCloud.CodeIssue.labels description: Labels associated with the code issue for classification or categorization. type: String - contextPath: PrismaCloud.CodeIssue.labels.label description: A specific label related to the code issue. type: String - contextPath: PrismaCloud.CodeIssue.labels.metadata.imageName description: The name of the image associated with the label metadata. type: String - contextPath: PrismaCloud.CodeIssue.policy description: The policy that was violated by the detected issue. type: String - contextPath: PrismaCloud.CodeIssue.repository description: The name of the repository where the issue was found. type: String - contextPath: PrismaCloud.CodeIssue.resourceName description: The name of the resource associated with the code issue. type: String - contextPath: PrismaCloud.CodeIssue.resourceScanType description: The type of scan that detected the issue (e.g., static analysis, secret detection). type: String - contextPath: PrismaCloud.CodeIssue.resourceUuid description: The unique identifier of the resource associated with the code issue. type: String - contextPath: PrismaCloud.CodeIssue.severity description: The severity level of the detected issue (e.g., High, Medium, Low). type: String - contextPath: PrismaCloud.CodeIssue.violationId description: The unique identifier for the policy violation related to the code issue. type: String - contextPath: PrismaCloud.CodeIssue.causePackageId description: The ID of the package that caused the issue. type: String - contextPath: PrismaCloud.CodeIssue.causePackageName description: The name of the package that caused the issue. type: String - contextPath: PrismaCloud.CodeIssue.cveUuid description: The unique identifier of the Common Vulnerabilities and Exposures (CVE) related to the issue. type: String - contextPath: PrismaCloud.CodeIssue.cvss description: The Common Vulnerability Scoring System (CVSS) score for the detected issue. type: String - contextPath: PrismaCloud.CodeIssue.fixVersion description: The version of the code or package that contains the fix for the issue. type: String - contextPath: PrismaCloud.CodeIssue.pr description: The pull request (PR) associated with resolving the code issue. type: String - contextPath: PrismaCloud.CodeIssue.resourceId description: The identifier of the resource related to the code issue. type: String - contextPath: PrismaCloud.CodeIssue.riskFactors description: Risk factors associated with the code issue, such as high-impact areas or sensitive data. type: String - contextPath: PrismaCloud.CodeIssue.isIndirectPackage description: Indicates whether the issue is from an indirect package (true/false). type: String - arguments: - description: Comma-separated list of alert IDs to be dismissed. isArray: true name: alert_ids - description: Comma-separated list of policy IDs. isArray: true name: policy_ids - description: The amount of time for snoozing alert. Both snooze value and unit must be specified if snoozing. name: snooze_value - auto: PREDEFINED description: The time unit for snoozing alert. Both snooze value and unit must be specified if snoozing. name: snooze_unit predefined: - hour - day - week - month - year - description: Reason for dismissal. name: dismissal_note required: true - description: 'Start time for the search. Time is interpreted as UTC. Values can be in either ISO date format, relative time, or epoch timestamp. For example: "2019-10-21T23:45:00 GMT+3" (ISO date format), "3 days" (relative time), 1579039377301 (epoch time).' name: time_range_date_from - description: 'End time for the search. Time is interpreted as UTC. Values can be in either ISO date format, relative time, or epoch timestamp. For example: "2019-10-21T23:45:00 GMT+3" (ISO date format), "3 days" (relative time), 1579039377301 (epoch time).' name: time_range_date_to - auto: PREDEFINED description: 'The search time unit. The "login" and "epoch" options are only available if "time_range_value" is not provided.' name: time_range_unit predefined: - hour - day - week - month - year - login - epoch - description: The amount of "time_range_unit" to go back in time. For example, 3 days, 5 weeks, etc. name: time_range_value - description: 'Comma-separated list of filter name and value, in the following format: filtername1=filtervalue1,filtername2=filtervalue2,etc. Names and possible values for filters can be found by running the "prisma-cloud-alert-filter-list" command.' isArray: true name: filters description: Dismiss or snooze the alerts matching the given filter. Either policy IDs or alert IDs must be provided. When no absolute time nor relative time arguments are provided, the default time range is all times. For snoozing, provide "snooze_unit" and "snooze_value" arguments. execution: true name: prisma-cloud-alert-dismiss - arguments: - default: true description: The alert ID. name: alert_id required: true - auto: PREDEFINED defaultValue: 'true' description: Whether to retrieve the entire / trimmed alert model. name: detailed predefined: - 'true' - 'false' description: Gets the details of an alert based on the alert ID. name: prisma-cloud-alert-get-details outputs: - contextPath: PrismaCloud.Alert.id description: The alert ID. type: String - contextPath: PrismaCloud.Alert.status description: The alert status. type: String - contextPath: PrismaCloud.Alert.reason description: The alert reason. type: String - contextPath: PrismaCloud.Alert.alertTime description: The time of the alert. type: Date - contextPath: PrismaCloud.Alert.firstSeen description: The time the alert was first seen. type: Date - contextPath: PrismaCloud.Alert.lastSeen description: The time the alert was last seen. type: Date - contextPath: PrismaCloud.Alert.eventOccurred description: The time the event occurred. type: Date - contextPath: PrismaCloud.Alert.alertRules description: Names of the alert rules that triggered this alert. type: String - contextPath: PrismaCloud.Alert.resource.resourceApiName description: The resource API name. type: String - contextPath: PrismaCloud.Alert.resource.id description: The resource ID. type: String - contextPath: PrismaCloud.Alert.resource.account description: The resource account. type: String - contextPath: PrismaCloud.Alert.resource.accountId description: The resource account ID. type: String - contextPath: PrismaCloud.Alert.resource.resourceType description: The resource type. type: String - contextPath: PrismaCloud.Alert.policy.policyId description: The policy ID. type: String - contextPath: PrismaCloud.Alert.policy.name description: The policy name. type: String - contextPath: PrismaCloud.Alert.policy.policyType description: The type of policy. type: String - contextPath: PrismaCloud.Alert.policy.severity description: The policy severity. type: String - contextPath: PrismaCloud.Alert.policy.recommendation description: The policy recommendation. type: String - contextPath: PrismaCloud.Alert.policy.remediation.description description: The policy remediation description. type: String - contextPath: PrismaCloud.Alert.policy.remediation.cliScriptTemplate description: The policy remediation CLI script template. type: String - contextPath: PrismaCloud.Alert.policy.description description: The policy description. type: String - contextPath: PrismaCloud.Alert.policy.labels description: The policy labels. type: Unknown - contextPath: PrismaCloud.Alert.resource.cloudType description: The resource cloud type. type: String - contextPath: PrismaCloud.Alert.resource.rrn description: The restricted resource name. type: String - contextPath: PrismaCloud.Alert.resource.regionId description: The resource region ID. type: String - contextPath: PrismaCloud.Alert.resource.url description: The resource URL. type: String - contextPath: PrismaCloud.Alert.policy.remediable description: Whether the policy is remediable. type: Boolean - contextPath: PrismaCloud.Alert.policy.systemDefault description: Whether the policy is the system default. type: Boolean - contextPath: PrismaCloud.Alert.policy.deleted description: Whether the policy was deleted. type: Boolean - description: List the acceptable filters and values for alerts. name: prisma-cloud-alert-filter-list outputs: - contextPath: PrismaCloud.AlertFilters.filterName description: The filter name. type: String - contextPath: PrismaCloud.AlertFilters.options description: The filter value options. type: String - contextPath: PrismaCloud.AlertFilters.staticFilter description: Whether the filter is static. type: Unknown - arguments: - description: Comma-seperated list of alert IDs for which to get remediation details. Provided alert IDs must be associated with the same policy. If a policy is specified, all the alerts specified must belong to that policy. isArray: true name: alert_ids - description: Policy ID for which to get remediation details. name: policy_id - description: 'Start time for the search. Time is interpreted as UTC. Values can be in either ISO date format, relative time, or epoch timestamp. For example: "2019-10-21T23:45:00 GMT+3" (ISO date format), "3 days" (relative time), 1579039377301 (epoch time).' name: time_range_date_from - description: 'End time for the search. Time is interpreted as UTC. Values can be in either ISO date format, relative time, or epoch timestamp. For example: "2019-10-21T23:45:00 GMT+3" (ISO date format), "3 days" (relative time), 1579039377301 (epoch time).' name: time_range_date_to - auto: PREDEFINED description: 'The search time unit. The "login" and "epoch" options are only available if "time_range_value" is not provided.' name: time_range_unit predefined: - hour - day - week - month - year - login - epoch - description: The amount of "time_range_unit" to go back in time. For example, 3 days, 5 weeks, etc. name: time_range_value - defaultValue: '50' description: Maximum number of entries to return. name: limit - auto: PREDEFINED description: Whether to retrieve all results. The "limit" argument will be ignored. name: all_results predefined: - 'true' - 'false' description: Generates and returns a list of remediation commands for the specified alerts and policies. Data returned for a successful call include fully constructed commands for remediation. Either a policy ID or alert IDs must be provided. The returned information can be retrieved in the UI by clicking the "Remediate" button under the "Actions" column for supported alerts. When no absolute time nor relative time arguments are provided, the default time range is all times. name: prisma-cloud-remediation-command-list outputs: - contextPath: PrismaCloud.AlertRemediation.description description: Description of CLI remediation instructions. type: String - contextPath: PrismaCloud.AlertRemediation.scriptImpact description: Impact of CLI remediation instructions. type: String - contextPath: PrismaCloud.AlertRemediation.alertId description: The ID of the alert to which the remediation details apply. type: String - contextPath: PrismaCloud.AlertRemediation.CLIScript description: The exact CLI command string. type: String - arguments: - default: true description: The alert ID. name: alert_id required: true name: prisma-cloud-alert-remediate description: Remediates the alert with the specified ID, if that alert is associated with a remediable policy. In order to check what remediation would run, use the "prisma-cloud-remediation-command-list" command first. execution: true outputs: - contextPath: PrismaCloud.AlertRemediation.alertId description: The ID of the alert to which the remediation apply. type: String - contextPath: PrismaCloud.AlertRemediation.successful description: Whether the remediation was successful. type: Boolean - contextPath: PrismaCloud.AlertRemediation.failureReason description: The failure reason for the remediation. type: String - contextPath: PrismaCloud.AlertRemediation.errorValue description: The error value for the remediation. type: String - arguments: - description: Comma-separated list of alert IDs to be reopened. isArray: true name: alert_ids - description: Comma-separated list of policy IDs. isArray: true name: policy_ids - description: 'Start time for the search. Time is interpreted as UTC. Values can be in either ISO date format, relative time, or epoch timestamp. For example: "2019-10-21T23:45:00 GMT+3" (ISO date format), "3 days" (relative time), 1579039377301 (epoch time).' name: time_range_date_from - description: 'End time for the search. Time is interpreted as UTC. Values can be in either ISO date format, relative time, or epoch timestamp. For example: "2019-10-21T23:45:00 GMT+3" (ISO date format), "3 days" (relative time), 1579039377301 (epoch time).' name: time_range_date_to - auto: PREDEFINED description: 'The search time unit. The "login" and "epoch" options are only available if "time_range_value" is not provided.' name: time_range_unit predefined: - hour - day - week - month - year - login - epoch - description: The amount of "time_range_unit" to go back in time. For example, 3 days, 5 weeks, etc. name: time_range_value - description: 'Comma-separated list of filter name and value, in the following format: filtername1=filtervalue1,filtername2=filtervalue2,etc. Names and possible values for filters can be found by running the "prisma-cloud-alert-filter-list" command.' isArray: true name: filters description: Re-open the alerts matching the given filter. Either policy IDs or alert IDs must be provided. When no absolute time nor relative time arguments are provided, the default time range is all times. execution: true name: prisma-cloud-alert-reopen - arguments: - description: 'Start time for the search. Time is interpreted as UTC. Values can be in either ISO date format, relative time, or epoch timestamp. For example: "2019-10-21T23:45:00 GMT+3" (ISO date format), "3 days" (relative time), 1579039377301 (epoch time).' name: time_range_date_from - description: 'End time for the search. Time is interpreted as UTC. Values can be in either ISO date format, relative time, or epoch timestamp. For example: "2019-10-21T23:45:00 GMT+3" (ISO date format), "3 days" (relative time), 1579039377301 (epoch time).' name: time_range_date_to - auto: PREDEFINED description: 'The search time unit. The "login" and "epoch" options are only available if "time_range_value" is not provided.' name: time_range_unit predefined: - hour - day - week - month - year - login - epoch - description: The amount of "time_range_unit" to go back in time. For example, 3 days, 5 weeks, etc. name: time_range_value - description: 'Comma-separated list of filter name and value, in the following format: filtername1=filtervalue1,filtername2=filtervalue2,etc. Names and possible values for filters can be found by running the "prisma-cloud-alert-filter-list" command.' isArray: true name: filters - auto: PREDEFINED defaultValue: 'true' description: Whether to retrieve the entire / trimmed alert model. name: detailed predefined: - 'true' - 'false' - defaultValue: '50' description: Maximum number of entries to return. name: limit - description: Token of the next page to retrive. When provided, other arguments are ignored. name: next_token - description: 'The field to sort the results by. Possible values are: alertTime,firstSeen,lastSeen,lastUpdated.' name: sort_field auto: PREDEFINED predefined: - alertTime - firstSeen - lastSeen - lastUpdated - description: 'The direction to sort the results by. Sort field must be specified if sorting. Possible values are: asc, desc. Default is asc.' name: sort_direction defaultValue: asc auto: PREDEFINED predefined: - asc - desc description: Search alerts on the Prisma Cloud platform. When no absolute time nor relative time arguments are provided, the search will show alerts from the last 7 days. name: prisma-cloud-alert-search outputs: - contextPath: PrismaCloud.AlertPageToken.nextPageToken description: Next page token. type: String - contextPath: PrismaCloud.Alert.id description: The ID of the returned alert. type: String - contextPath: PrismaCloud.Alert.status description: The status of the returned alert. type: String - contextPath: PrismaCloud.Alert.reason description: The reason of the returned alert. type: String - contextPath: PrismaCloud.Alert.lastSeen description: The time the returned alert was last seen. type: String - contextPath: PrismaCloud.Alert.firstSeen description: The time the returned alert was first seen. type: String - contextPath: PrismaCloud.Alert.lastUpdated description: The time the returned alert was last updated. type: String - contextPath: PrismaCloud.Alert.alertTime description: The time of the returned alert. type: String - contextPath: PrismaCloud.Alert.policy.policyId description: The policy ID of the returned alert. type: String - contextPath: PrismaCloud.Alert.policy.name description: The policy name of the returned alert. type: String - contextPath: PrismaCloud.Alert.policy.policyType description: The policy type of the returned alert. type: String - contextPath: PrismaCloud.Alert.policy.severity description: The policy severity of the returned alert. type: String - contextPath: PrismaCloud.Alert.policy.remediable description: Whether the policy is remediable. type: Boolean - contextPath: PrismaCloud.Alert.policy.description description: The policy description of the returned alert. type: String - contextPath: PrismaCloud.Alert.policy.recommendation description: The policy recommendation of the returned alert. type: String - contextPath: PrismaCloud.Alert.policy.remediation.description description: The policy remediation description of the returned alert. type: String - contextPath: PrismaCloud.Alert.policy.remediation.cliScriptTemplate description: The policy CLI script template description of the returned alert. type: String - contextPath: PrismaCloud.Alert.policy.systemDefault description: Whether the policy is the system default. type: Boolean - contextPath: PrismaCloud.Alert.policy.deleted description: Whether the policy was deleted. type: Boolean - contextPath: PrismaCloud.Alert.resource.resourceType description: The resource type of the returned alert. type: String - contextPath: PrismaCloud.Alert.resource.name description: The resource name of the returned alert. type: String - contextPath: PrismaCloud.Alert.resource.account description: The resource account of the returned alert. type: String - contextPath: PrismaCloud.Alert.resource.cloudType description: The resource cloud type of the returned alert. type: String - contextPath: PrismaCloud.Alert.resource.rrn description: The restricted resource name of the returned alert. type: String - arguments: - description: 'Start time for the search. Time is interpreted as UTC. Values can be in either ISO date format, relative time, or epoch timestamp. For example: "2019-10-21T23:45:00 GMT+3" (ISO date format), "3 days" (relative time), 1579039377301 (epoch time).' name: time_range_date_from - description: 'End time for the search. Time is interpreted as UTC. Values can be in either ISO date format, relative time, or epoch timestamp. For example: "2019-10-21T23:45:00 GMT+3" (ISO date format), "3 days" (relative time), 1579039377301 (epoch time).' name: time_range_date_to - auto: PREDEFINED description: 'The search time unit. The "login" and "epoch" options are only available if "time_range_value" is not provided.' name: time_range_unit predefined: - hour - day - week - month - year - login - epoch - description: The amount of "time_range_unit" to go back in time. For example, 3 days, 5 weeks, etc. name: time_range_value - description: 'Query to run in Prisma Cloud config API using RQL language. For more information see: https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-rql-reference/rql-reference/config-query.' name: query required: true - defaultValue: '50' description: Maximum number of entries to return. name: limit - description: Search ID. Can be used to rerun the same search. name: search_id - auto: PREDEFINED defaultValue: 'desc' description: The direction to sort the results by. Both sort direction and field must be specified if sorting. name: sort_direction predefined: - asc - desc - auto: PREDEFINED defaultValue: 'insertTs' description: The field to sort the results by. Both sort direction and field must be specified if sorting. name: sort_field predefined: - id - time - apiName - customerId - insertTs - json - cloudAccount - cloudRegion - stateId - description: 'Whether to include the resource JSON or not. Default is "true". "false" will not return the resource JSON, "true" will return the resource JSON. Note that if the value is "true", some of the keys, which contain large data objects, are still omitted by default and in order to retrieve them, set the "include_additional_resource_fields" argument to "true". Doing so can increase the context size dramatically.' name: include_resource_json defaultValue: 'true' auto: PREDEFINED predefined: - 'true' - 'false' - description: 'Whether to retrieve all of the resource JSON, including keys with large objects such as: "disks.shieldedInstanceInitialState" and "configure-sh" key under metadata. Default is "false".' name: include_additional_resource_fields defaultValue: 'false' auto: PREDEFINED predefined: - 'true' - 'false' - description: 'Enable heuristic search optimization for faster results. Default is true.' name: heuristic_search defaultValue: 'true' auto: PREDEFINED predefined: - 'true' - 'false' description: Search configuration inventory on the Prisma Cloud platform using RQL language. Use this command for all queries that start with "config". When no absolute time nor relative time arguments are provided, the default time range is all times. name: prisma-cloud-config-search outputs: - contextPath: PrismaCloud.Config.accountId description: Cloud account ID. type: String - contextPath: PrismaCloud.Config.accountName description: Cloud account name. type: String - contextPath: PrismaCloud.Config.allowDrillDown description: Whether to allow drill down. type: Boolean - contextPath: PrismaCloud.Config.cloudType description: Cloud type. type: String - contextPath: PrismaCloud.Config.deleted description: Whether the asset was deleted. type: Boolean - contextPath: PrismaCloud.Config.hasExtFindingRiskFactors description: Whether the configuration has external finding risk factors. type: Boolean - contextPath: PrismaCloud.Config.hasExternalFinding description: Whether the configuration has an external finding. type: Boolean - contextPath: PrismaCloud.Config.hasExternalIntegration description: Whether the configuration has an external integration. type: Boolean - contextPath: PrismaCloud.Config.hasNetwork description: Whether the configuration has a network. type: Boolean - contextPath: PrismaCloud.Config.id description: Prisma Cloud configuration ID. type: String - contextPath: PrismaCloud.Config.assetId description: Prisma Cloud asset ID. type: String - contextPath: PrismaCloud.Config.data description: Prisma Cloud asset specific data. type: Unknown - contextPath: PrismaCloud.Config.insertTs description: Insert timestamp. type: Date - contextPath: PrismaCloud.Config.createdTs description: Created timestamp. type: Date - contextPath: PrismaCloud.Config.name description: Asset name. type: String - contextPath: PrismaCloud.Config.regionId description: Cloud region ID. type: String - contextPath: PrismaCloud.Config.regionName description: Cloud region name. type: String - contextPath: PrismaCloud.Config.resourceType description: Cloud resource type. type: String - contextPath: PrismaCloud.Config.rrn description: Cloud restricted resource name. type: String - contextPath: PrismaCloud.Config.service description: Cloud service. type: String - contextPath: PrismaCloud.Config.stateId description: State ID. type: String - arguments: - description: 'Start time for the search. Time is interpreted as UTC. Values can be in either ISO date format, relative time, or epoch timestamp. For example: "2019-10-21T23:45:00 GMT+3" (ISO date format), "3 days" (relative time), 1579039377301 (epoch time).' name: time_range_date_from - description: 'End time for the search. Time is interpreted as UTC. Values can be in either ISO date format, relative time, or epoch timestamp. For example: "2019-10-21T23:45:00 GMT+3" (ISO date format), "3 days" (relative time), 1579039377301 (epoch time).' name: time_range_date_to - auto: PREDEFINED description: The search time unit. The "login" and "epoch" options are only available if "time_range_value" is not provided. name: time_range_unit predefined: - hour - day - week - month - year - login - epoch - description: The amount of "time_range_unit" to go back in time. For example, 3 days, 5 weeks, etc. name: time_range_value - description: 'Query to run in Prisma Cloud event API using RQL language. For more information see: https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-rql-reference/rql-reference/event-query.' name: query required: true - defaultValue: '50' description: Maximum number of entries to return. name: limit - description: 'The field to sort the results by. Possible values are: cloudService, operation, cloudAccount, cloudRegion, id, time, crud, user.' name: sort_field auto: PREDEFINED predefined: - cloudService - operation - cloudAccount - cloudRegion - id - time - crud - user - description: 'The direction to sort the results by. Sort field must be specified if sorting. Possible values are: asc, desc. Default is asc.' name: sort_direction defaultValue: asc auto: PREDEFINED predefined: - asc - desc description: Search events inventory on the Prisma Cloud platform using RQL language. Use this command for all queries that start with "event". When no absolute time nor relative time arguments are provided, the default time range is all times. In order to reduce the returned data, set the "include_resource_json" argument to "false". name: prisma-cloud-event-search outputs: - contextPath: PrismaCloud.Event.subject description: Cloud event subject. type: String - contextPath: PrismaCloud.Event.accountName description: Cloud event account name. type: String - contextPath: PrismaCloud.Event.name description: Cloud event name. type: String - contextPath: PrismaCloud.Event.source description: Cloud event source. type: String - contextPath: PrismaCloud.Event.ip description: Cloud event IP address. type: String - contextPath: PrismaCloud.Event.eventTs description: Cloud event timestamp. type: Date - contextPath: PrismaCloud.Event.countryName description: Cloud event country name. type: String - contextPath: PrismaCloud.Event.stateName description: Cloud event state name. type: String - contextPath: PrismaCloud.Event.cityName description: Cloud event city name. type: String - contextPath: PrismaCloud.Event.location description: Cloud event location. type: String - contextPath: PrismaCloud.Event.account description: Cloud event account. type: String - contextPath: PrismaCloud.Event.regionId description: Cloud event region ID. type: Number - contextPath: PrismaCloud.Event.type description: Cloud event type. type: String - contextPath: PrismaCloud.Event.id description: Cloud event ID. type: Number - contextPath: PrismaCloud.Event.role description: Cloud event role. type: String - contextPath: PrismaCloud.Event.accessKeyUsed description: Whether the cloud event access key is used. type: Boolean - contextPath: PrismaCloud.Event.success description: Whether the cloud event is successful. type: Boolean - contextPath: PrismaCloud.Event.internal description: Whether the cloud event is internal. type: Boolean - contextPath: PrismaCloud.Event.cityId description: Cloud event city ID. type: Number - contextPath: PrismaCloud.Event.cityLatitude description: Cloud event city latitude. type: Number - contextPath: PrismaCloud.Event.cityLongitude description: Cloud event city longitude. type: Number - contextPath: PrismaCloud.Event.countryId description: Cloud event country ID. type: Number - contextPath: PrismaCloud.Event.dynamicData description: Cloud event dynamic data. type: String - contextPath: PrismaCloud.Event.stateId description: Cloud event state ID. type: Number - arguments: - description: 'Start time for the search. Time is interpreted as UTC. Values can be in either ISO date format, relative time, or epoch timestamp. For example: "2019-10-21T23:45:00 GMT+3" (ISO date format), "3 days" (relative time), 1579039377301 (epoch time).' name: time_range_date_from - description: 'End time for the search. Time is interpreted as UTC. Values can be in either ISO date format, relative time, or epoch timestamp. For example: "2019-10-21T23:45:00 GMT+3" (ISO date format), "3 days" (relative time), 1579039377301 (epoch time).' name: time_range_date_to - auto: PREDEFINED description: 'The search time unit. The "login" and "epoch" options are only available if "time_range_value" is not provided.' name: time_range_unit predefined: - hour - day - week - month - year - login - epoch - description: The amount of "time_range_unit" to go back in time. For example, 3 days, 5 weeks, etc. name: time_range_value - description: 'Query to run in Prisma Cloud network API using RQL language. For more information see: https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-rql-reference/rql-reference/network-query.' name: query required: true - auto: PREDEFINED description: The cloud in which the network should be searched. name: cloud_type predefined: - aws - azure - gcp - alibaba_cloud - oci - description: Search ID. Can be used to rerun the same search. name: search_id description: 'Search networks inventory on the Prisma Cloud platform using RQL language. Use this command for all queries that start with "networks". When no absolute time nor relative time arguments are provided, the default time range is all times. In order to limit the results returning, use "limit search records to" at the end of the RQL query, followed by a value from one of these options: 1, 10, 100, 1000, and 10,000.' name: prisma-cloud-network-search outputs: - contextPath: PrismaCloud.Network.Node.id description: Cloud network node ID. type: Number - contextPath: PrismaCloud.Network.Node.name description: Cloud network node name. type: String - contextPath: PrismaCloud.Network.Node.ipAddr description: Cloud network node IP address. type: String - contextPath: PrismaCloud.Network.Node.grouped description: Whether the cloud network node is grouped. type: Boolean - contextPath: PrismaCloud.Network.Node.suspicious description: Whether the cloud network node is suspicious. type: Boolean - contextPath: PrismaCloud.Network.Node.vulnerable description: Whether the cloud network node is vulnerable. type: Boolean - contextPath: PrismaCloud.Network.Node.metadata description: Cloud network node metadata. type: Unknown - contextPath: PrismaCloud.Network.Connection.from description: Cloud network connection from node ID. type: Number - contextPath: PrismaCloud.Network.Connection.to description: Cloud network connection to node ID. type: Number - contextPath: PrismaCloud.Network.Connection.label description: Cloud network connection label. type: String - contextPath: PrismaCloud.Network.Connection.suspicious description: Whether the cloud network node is suspicious. type: Boolean - contextPath: PrismaCloud.Network.Connection.metadata description: Cloud network connection metadata. type: Unknown - arguments: - description: ID number of the CICD run. name: cicd_run_id - description: Comma-separated list of authors of the files. isArray: true name: authors - description: Branch of the files. name: branch - description: 'Comma-separated list of categories of the files. Available options are: IAM, Compute, Monitoring, Networking, Kubernetes, General, Storage, Secrets, Public, Vulnerabilities, Drift, BuildIntegrity, Licenses.' isArray: true name: categories - auto: PREDEFINED description: The code status. name: code_status predefined: - hasFix - description: 'Comma-separated list of file types of the files. Available options are: tf, json, yml, yaml, template, .checkov.baseline, hcl, Dockerfile, package.json, package-lock.json, bower.json, pom.xml, build.gradle, build.gradle.kts, gradle.properties, gradle-wrapper.properties, go.sum, go.mod, requirements.txt, METADATA, bicep, Pipfile.lock, Pipfile, yarn.lock, Gemfile, Gemfile.lock, gemspec, env, settings.py, main.py, application.py, config.py, app.js, config.js, dev.js, db.properties, application.properties, private.pem, privatekey.pem, index.php, config.php, config.xml, strings.xml, app.module.ts, environment.ts, tpl, tfvars, unknown.' isArray: true name: file_types - description: Repository of the files. name: repository required: true - description: Repository ID of the files. name: repository_id - description: 'Comma-separated list of search options of the files. Available options are: path, code.' isArray: true name: search_options - description: Search text in the files. name: search_text - auto: PREDEFINED description: Search title of the files. name: search_title predefined: - 'title' - 'constructive_title' - 'descriptive_title' - description: 'Comma-separated list of severities of the files. Available options are: CRITICAL, HIGH, MEDIUM, LOW, INFO.' isArray: true name: severities - description: 'Comma-separated list of source types of the files. Available options are: Github, Bitbucket, Gitlab, AzureRepos, cli, AWS, Azure, GCP, Docker, githubEnterprise, gitlabEnterprise, bitbucketEnterprise, terraformCloud, githubActions, circleci, codebuild, jenkins, tfcRunTasks, admissionController, terraformEnterprise.' isArray: true name: source_types required: true - description: 'Comma-separated list of tag key and value, in the following format: tagkey1=tagvalue1,tagkey2=tagvalue2,etc.' isArray: true name: tags - description: 'Comma-separated list of statuses of the files. Available options are: Errors, Suppressed, Passed, Fixed.' isArray: true name: statuses - defaultValue: '50' description: Maximum number of entries to return. name: limit - auto: PREDEFINED description: Whether to retrieve all results. The "limit" argument will be ignored. name: all_results predefined: - 'true' - 'false' description: This command is deprecated. Use prisma-cloud-code-issues-list instead. name: prisma-cloud-error-file-list deprecated: true outputs: - contextPath: PrismaCloud.ErrorFile.filePath description: Error file path. type: String - contextPath: PrismaCloud.ErrorFile.suppressedErrorsCount description: The number of error file suppressed errors. type: Number - contextPath: PrismaCloud.ErrorFile.passedCount description: The number of error files passed. type: Number - contextPath: PrismaCloud.ErrorFile.openErrorsCount description: The number of error file open errors. type: Number - contextPath: PrismaCloud.ErrorFile.errorsCount description: The number of error file errors. type: Number - contextPath: PrismaCloud.ErrorFile.fixedCount description: The number of error files fixed. type: Number - contextPath: PrismaCloud.ErrorFile.type description: Error file type. type: String - name: prisma-cloud-trigger-scan description: Trigger asynchronous scan of all resources to refresh the current state at Prisma Cloud Code Security. In order to use this command, the "Code Security" module needs to be enabled and accessible in the Prisma Cloud UI. - arguments: - description: Restricted Resource Name of the resource to get details about. Can be retrieved by running a command that has that RRN. name: rrn required: true description: Get resource details. name: prisma-cloud-resource-get outputs: - contextPath: PrismaCloud.Resource.rrn description: Prisma Cloud restricted resource name. type: String - contextPath: PrismaCloud.Resource.id description: Prisma Cloud resource ID. type: String - contextPath: PrismaCloud.Resource.name description: Resource name. type: String - contextPath: PrismaCloud.Resource.url description: Resource URL. type: String - contextPath: PrismaCloud.Resource.accountId description: Cloud account ID. type: String - contextPath: PrismaCloud.Resource.accountName description: Cloud account name. type: String - contextPath: PrismaCloud.Resource.cloudType description: Cloud type. type: String - contextPath: PrismaCloud.Resource.regionId description: Cloud region ID. type: String - contextPath: PrismaCloud.Resource.regionName description: Cloud region Name. type: String - contextPath: PrismaCloud.Resource.service description: Cloud service. type: String - contextPath: PrismaCloud.Resource.resourceType description: Cloud resource type. type: String - contextPath: PrismaCloud.Resource.insertTs description: Insert timestamp. type: Date - contextPath: PrismaCloud.Resource.deleted description: Whether the resource was deleted. type: Boolean - contextPath: PrismaCloud.Resource.vpcId description: VPC ID. type: String - contextPath: PrismaCloud.Resource.vpcName description: VPC name. type: String - contextPath: PrismaCloud.Resource.tags description: Prisma Cloud resource tags. type: Unknown - contextPath: PrismaCloud.Resource.riskGrade description: Risk grade. type: String - contextPath: PrismaCloud.Resource.hasNetwork description: Whether the resource has a network. type: Boolean - contextPath: PrismaCloud.Resource.hasExternalFinding description: Whether the resource has an external finding. type: Boolean - contextPath: PrismaCloud.Resource.hasExternalIntegration description: Whether the resource has an external integration. type: Boolean - contextPath: PrismaCloud.Resource.allowDrillDown description: Whether to allow drill down. type: Boolean - contextPath: PrismaCloud.Resource.hasExtFindingRiskFactors description: Whether the resource has external finding risk factors. type: Boolean - contextPath: PrismaCloud.Resource.data description: Prisma Cloud resource specific data. type: Unknown - arguments: - description: The resource list type. name: list_type - description: The namespace to return only resources associated with it. name: namespace - defaultValue: '50' description: Maximum number of entries to return. name: limit - auto: PREDEFINED description: Whether to retrieve all results. The "limit" argument will be ignored. name: all_results predefined: - 'true' - 'false' description: Returns all the resource lists. Maps to the Resource Lists under Settings > Resource Lists in the Console UI. name: prisma-cloud-resource-list outputs: - contextPath: PrismaCloud.ResourceList.id description: Prisma Cloud resource list ID. type: String - contextPath: PrismaCloud.ResourceList.name description: Resource list name. type: String - contextPath: PrismaCloud.ResourceList.resourceListType description: Resource list type. type: String - contextPath: PrismaCloud.ResourceList.description description: Resource list description. type: String - contextPath: PrismaCloud.ResourceList.lastModifiedBy description: Resource list last modified user. type: String - contextPath: PrismaCloud.ResourceList.lastModifiedTs description: Resource list last modified time. type: Date - contextPath: PrismaCloud.ResourceList.members description: Resource list members. type: Unknown - contextPath: PrismaCloud.ResourceList.namespaces description: Resource list namespaces. type: Unknown - arguments: - description: The role id to get details of. name: role_id - description: The resource list name to return only user roles associated with it. name: resource_list_name - defaultValue: '50' description: Maximum number of entries to return. name: limit - auto: PREDEFINED description: Whether to retrieve all results. The "limit" argument will be ignored. name: all_results predefined: - 'true' - 'false' description: Retrieves user roles. Maps to Settings > Access Control > Roles in the Console UI. name: prisma-cloud-user-roles-list outputs: - contextPath: PrismaCloud.UserRoles.id description: Prisma Cloud user roles ID. type: String - contextPath: PrismaCloud.UserRoles.name description: User roles name. type: String - contextPath: PrismaCloud.UserRoles.resourceListIds description: User roles resource list IDs. type: Unknown - contextPath: PrismaCloud.UserRoles.description description: User roles description. type: String - contextPath: PrismaCloud.UserRoles.lastModifiedBy description: User roles last modified user. type: String - contextPath: PrismaCloud.UserRoles.lastModifiedTs description: User roles last modified time. type: Date - contextPath: PrismaCloud.UserRoles.associatedUsers description: User roles associated users. type: Unknown - contextPath: PrismaCloud.UserRoles.restrictDismissalAccess description: Whether dismissal access is restricted for the user role. type: Boolean - contextPath: PrismaCloud.UserRoles.roleType description: User roles role type. type: String - contextPath: PrismaCloud.UserRoles.additionalAttributes description: User roles additional attributes. type: Unknown - contextPath: PrismaCloud.UserRoles.codeRepositoryIds description: User roles code repository IDs. type: Unknown - contextPath: PrismaCloud.UserRoles.accountGroupIds description: User roles account group IDs. type: Unknown - contextPath: PrismaCloud.UserRoles.resourceLists description: User roles resource lists. type: Unknown - contextPath: PrismaCloud.UserRoles.permissionGroup description: User roles permission group. type: Unknown - contextPath: PrismaCloud.UserRoles.codeRepositories description: User roles code repositories. type: Unknown - contextPath: PrismaCloud.UserRoles.accountGroups description: User roles account groups. type: Unknown - arguments: - defaultValue: '50' description: Maximum number of entries to return. name: limit - auto: PREDEFINED description: Whether to retrieve all results. The "limit" argument will be ignored. name: all_results predefined: - 'true' - 'false' - description: Usernames to return only users associated with. name: usernames isArray: true description: Lists all users and service accounts for your tenant. Maps to Settings > Access Control > Users in the Console UI. name: prisma-cloud-users-list outputs: - contextPath: PrismaCloud.Users.email description: Prisma Cloud user email. type: String - contextPath: PrismaCloud.Users.firstName description: User first name. type: String - contextPath: PrismaCloud.Users.lastName description: User last name. type: String - contextPath: PrismaCloud.Users.timeZone description: User time zone. type: String - contextPath: PrismaCloud.Users.enabled description: User enabled. type: Boolean - contextPath: PrismaCloud.Users.lastModifiedBy description: User last modified user. type: String - contextPath: PrismaCloud.Users.lastModifiedTs description: User last modified time. type: Date - contextPath: PrismaCloud.Users.lastLoginTs description: User last login time. type: Date - contextPath: PrismaCloud.Users.displayName description: User display name. type: String - contextPath: PrismaCloud.Users.ssoBypassAllowed description: Whether SSO bypass is allowed for the user role. type: Boolean - contextPath: PrismaCloud.Users.accessKeysAllowed description: Whether access keys are allowed for the user role. type: Boolean - contextPath: PrismaCloud.Users.defaultRoleId description: User default role ID. type: String - contextPath: PrismaCloud.Users.roleIds description: User role IDs. type: Unknown - contextPath: PrismaCloud.Users.roles description: User roles. type: Unknown - contextPath: PrismaCloud.Users.username description: User username. type: String - contextPath: PrismaCloud.Users.type description: User type. type: String - contextPath: PrismaCloud.Users.enableKeyExpiration description: Whether key expiration is enabled for the user role. type: Boolean - contextPath: PrismaCloud.Users.accessKeysCount description: User access keys count. type: Number - arguments: - auto: PREDEFINED defaultValue: 'false' description: Whether to exclude account group details. name: exclude_account_group_details predefined: - 'true' - 'false' - defaultValue: '50' description: Maximum number of entries to return. name: limit - auto: PREDEFINED description: Whether to retrieve all results. The "limit" argument will be ignored. name: all_results predefined: - 'true' - 'false' description: List accounts. name: prisma-cloud-account-list outputs: - contextPath: PrismaCloud.Account.name description: Account name. type: String - contextPath: PrismaCloud.Account.cloudType description: Account cloud type. type: String - contextPath: PrismaCloud.Account.accountType description: Account type. type: String - contextPath: PrismaCloud.Account.enabled description: Whether the account is enabled. type: Boolean - contextPath: PrismaCloud.Account.lastModifiedTs description: Account last modified time. type: Date - contextPath: PrismaCloud.Account.storageScanEnabled description: Whether account storage scan is enabled. type: Boolean - contextPath: PrismaCloud.Account.protectionMode description: Account protection mode. type: String - contextPath: PrismaCloud.Account.ingestionMode description: Account ingestion mode. type: Number - contextPath: PrismaCloud.Account.deploymentType description: Account deployment type. type: String - contextPath: PrismaCloud.Account.groupIds description: Account group IDs. type: Unknown - contextPath: PrismaCloud.Account.groups description: Account groups. type: Unknown - contextPath: PrismaCloud.Account.status description: Account status. type: String - contextPath: PrismaCloud.Account.numberOfChildAccounts description: The number of child accounts. type: Number - contextPath: PrismaCloud.Account.accountId description: Account ID. type: String - contextPath: PrismaCloud.Account.addedOn description: Account added on time. type: Date - arguments: - description: A comma-separated list of accound IDs. To get account IDs, run the "prisma-cloud-account-list" command. isArray: true name: account_ids required: true description: Get the statuses of the provided accounts. name: prisma-cloud-account-status-get outputs: - contextPath: PrismaCloud.Account.accountId description: Account ID. type: String - contextPath: PrismaCloud.Account.name description: Account name. type: String - contextPath: PrismaCloud.Account.status description: Account status. type: String - contextPath: PrismaCloud.Account.message description: Account message. type: String - contextPath: PrismaCloud.Account.remediation description: Account remediation action. type: String - arguments: - description: A comma-separated list of account IDs. To get account IDs, run the "prisma-cloud-account-list" command. isArray: true name: account_ids required: true description: Get the owners of the provided accounts. name: prisma-cloud-account-owner-list outputs: - contextPath: PrismaCloud.Account.accountId description: Account ID. type: String - contextPath: PrismaCloud.Account.emails description: Account owner emails. type: Unknown - arguments: - description: Restricted Resource Name of the resource to get host finding of. Can be retrieved by running a command that has that RRN. name: rrn required: true - description: 'Comma separated list of finding types to look for. Available options are: guard_duty_host, guard_duty_iam, inspector_sbp, compliance_cis, host_vulnerability_cve. When left empty, will return all options.' isArray: true name: finding_types - description: 'Comma separated list of risk factors to look for. Available options are: CRITICAL_SEVERITY, HIGH_SEVERITY, MEDIUM_SEVERITY, HAS_FIX, REMOTE_EXECUTION, DOS, RECENT_VULNERABILITY, EXPLOIT_EXISTS, ATTACK_COMPLEXITY_LOW, ATTACK_VECTOR_NETWORK, REACHABLE_FROM_THE_INTERNET, LISTENING_PORTS, CONTAINER_IS_RUNNING_AS_ROOT, NO_MANDATORY_SECURITY_PROFILE_APPLIED, RUNNING_AS_PRIVILEGED_CONTAINER, PACKAGE_IN_USE. When left empty, will return all options.' isArray: true name: risk_factors - defaultValue: '50' description: Maximum number of entries to return. name: limit - auto: PREDEFINED description: Whether to retrieve all results. The "limit" argument will be ignored. name: all_results predefined: - 'true' - 'false' description: Get resource host finding list. name: prisma-cloud-host-finding-list outputs: - contextPath: PrismaCloud.HostFinding.accountId description: Host finding account ID. type: String - contextPath: PrismaCloud.HostFinding.regionId description: Host finding region ID. type: String - contextPath: PrismaCloud.HostFinding.findingId description: Host finding ID. type: String - contextPath: PrismaCloud.HostFinding.type description: Host finding type. type: String - contextPath: PrismaCloud.HostFinding.source description: Host finding source. type: String - contextPath: PrismaCloud.HostFinding.severity description: Host finding severity. type: String - contextPath: PrismaCloud.HostFinding.status description: Host finding status. type: String - contextPath: PrismaCloud.HostFinding.createdOn description: The date on which the host finding was created. type: Date - contextPath: PrismaCloud.HostFinding.updatedOn description: The date on which the host finding was updated. type: Date - contextPath: PrismaCloud.HostFinding.normalizedNames description: Host finding normalized names. type: Unknown - contextPath: PrismaCloud.HostFinding.scanId description: Host finding scan ID. type: String - contextPath: PrismaCloud.HostFinding.resourceCloudId description: Host finding resource cloud ID. type: String - contextPath: PrismaCloud.HostFinding.sourceData.accountId description: Host finding source data account ID. type: String - contextPath: PrismaCloud.HostFinding.sourceData.arn description: Host finding source data ARN. type: String - contextPath: PrismaCloud.HostFinding.title description: Host finding title. type: String - contextPath: PrismaCloud.HostFinding.description description: Host finding description. type: String - contextPath: PrismaCloud.HostFinding.resourceUrl description: Host finding resource URL. type: String - contextPath: PrismaCloud.HostFinding.rlUpdatedOn description: The date on which the RL was updated. type: Date - contextPath: PrismaCloud.HostFinding.externalFindingId description: External finding ID. type: String - contextPath: PrismaCloud.HostFinding.sourceData description: Host finding source data. type: Unknown - contextPath: PrismaCloud.HostFinding.score description: Host finding score. type: String - contextPath: PrismaCloud.HostFinding.count description: The number of host findings. type: Number - arguments: - description: User ID to look for. Must be provided with the "query" argument. name: user_id - description: 'IAM query to run in Prisma Cloud config API using RQL language. For more information see: https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-rql-reference/rql-reference/iam-query.' name: query - defaultValue: '50' description: Maximum number of entries to return. name: limit - description: Token of the next page to retrive. name: next_token description: Get permission list. You must provide either "query" or "next_token". name: prisma-cloud-permission-list outputs: - contextPath: PrismaCloud.PermissionPageToken.nextPageToken description: Next page token. type: String - contextPath: PrismaCloud.Permission.id description: Permission ID. type: String - contextPath: PrismaCloud.Permission.sourceCloudType description: Permission source cloud type. type: String - contextPath: PrismaCloud.Permission.sourceCloudAccount description: Permission source cloud account. type: String - contextPath: PrismaCloud.Permission.sourceResourceId description: Permission source resource ID. type: String - contextPath: PrismaCloud.Permission.destCloudType description: Permission destination cloud type. type: String - contextPath: PrismaCloud.Permission.destCloudServiceName description: Permission destination cloud service name. type: String - contextPath: PrismaCloud.Permission.destResourceType description: Permission destination resource type. type: String - contextPath: PrismaCloud.Permission.effectiveActionName description: Permission effective action name. type: String - contextPath: PrismaCloud.Permission.grantedByCloudType description: Permission granted by cloud type. type: String - contextPath: PrismaCloud.Permission.grantedByCloudPolicyId description: Permission granted by cloud policy ID. type: String - contextPath: PrismaCloud.Permission.grantedByCloudPolicyName description: Permission granted by cloud policy name. type: String - contextPath: PrismaCloud.Permission.grantedByCloudPolicyType description: Permission granted by cloud policy type. type: String - contextPath: PrismaCloud.Permission.grantedByCloudPolicyRrn description: Permission granted by cloud policy restricted resource name. type: String - contextPath: PrismaCloud.Permission.grantedByCloudEntityId description: Permission granted by cloud entity ID. type: String - contextPath: PrismaCloud.Permission.grantedByCloudEntityName description: Permission granted by cloud entity name. type: String - contextPath: PrismaCloud.Permission.grantedByCloudEntityRrn description: Permission granted by cloud entity restricted resource name. type: String - contextPath: PrismaCloud.Permission.sourcePublic description: Whether the permission source is public. type: Boolean - contextPath: PrismaCloud.Permission.sourceCloudRegion description: Permission source cloud region. type: String - contextPath: PrismaCloud.Permission.sourceCloudServiceName description: Permission source cloud service name. type: String - contextPath: PrismaCloud.Permission.sourceResourceName description: Permission source resource name. type: String - contextPath: PrismaCloud.Permission.sourceResourceType description: Permission source resource type. type: String - contextPath: PrismaCloud.Permission.sourceIdpService description: Permission source IDP service. type: String - contextPath: PrismaCloud.Permission.sourceIdpDomain description: Permission source IDP domain. type: String - contextPath: PrismaCloud.Permission.sourceIdpEmail description: Permission source IDP email. type: String - contextPath: PrismaCloud.Permission.sourceIdpUsername description: Permission source IDP username. type: String - contextPath: PrismaCloud.Permission.sourceIdpGroup description: Permission source IDP group. type: String - contextPath: PrismaCloud.Permission.sourceIdpRrn description: Permission source IDP restricted resource name. type: String - contextPath: PrismaCloud.Permission.sourceCloudResourceRrn description: Permission source cloud resource restricted resource name. type: String - contextPath: PrismaCloud.Permission.destCloudAccount description: Permission destination cloud account. type: String - contextPath: PrismaCloud.Permission.destCloudRegion description: Permission destination cloud region. type: String - contextPath: PrismaCloud.Permission.destResourceName description: Permission destination resource name. type: String - contextPath: PrismaCloud.Permission.destResourceId description: Permission destination resource ID. type: String - contextPath: PrismaCloud.Permission.destCloudResourceRrn description: Permission destination cloud resource restricted resource name. type: String - contextPath: PrismaCloud.Permission.grantedByCloudEntityType description: Permission granted by cloud entity type. type: String - contextPath: PrismaCloud.Permission.accessedResourcesCount description: Permission accessed resources count. type: String - contextPath: PrismaCloud.Permission.lastAccessDate description: Permission last access date. type: String - contextPath: PrismaCloud.Permission.lastAccessStatus description: Permission last access status. type: String - contextPath: PrismaCloud.Permission.isWildCardDestCloudResourceName description: Whether the destination cloud resource name is a wildcard. type: Boolean - contextPath: PrismaCloud.Permission.exceptions description: Permission exceptions. type: Unknown - contextPath: PrismaCloud.Permission.grantedByLevelType description: Permission granted by level type. type: String - contextPath: PrismaCloud.Permission.grantedByLevelId description: Permission granted by level ID. type: String - contextPath: PrismaCloud.Permission.grantedByLevelName description: Permission granted by level name. type: String - contextPath: PrismaCloud.Permission.grantedByLevelRrn description: Permission granted by level restricted resource name. type: String - arguments: - description: Start time for the search in the following string format - MM/DD/YYYY. name: time-range-date-from - description: End time for the search in the following format - MM/DD/YYYY. name: time-range-date-to - description: The number of units to go back in time. name: time-range-value - auto: PREDEFINED description: The search unit. login and epoch are only available if timeRangeValue is not provided. name: time-range-unit predefined: - hour - day - week - month - year - login - epoch - auto: PREDEFINED description: The policy name. name: policy-name predefined: - IAM password policy does not have a symbol - IAM password policy does not expire in 90 days - IAM password policy does not have a lowercase character - IAM password policy does not have a minimum of 14 characters - IAM password policy allows password reuse - Default Security Group does not restrict all traffic - IAM password policy does not have password expiration period - IAM password policy does not exist - Access keys are not rotated for 90 days - Security Groups allow internet traffic from internet to RDP port (3389) - Internet connectivity via tcp over insecure port - IAM policy allow full administrative privileges - Primitive IAM roles should not be used - Internet exposed instances - IAM user has both Console access and Access Keys - S3 buckets are accessible to public - Access logging not enabled on all CloudTrail buckets - CloudTrail trail is not integrated with CloudWatch Log - Security Groups allow internet traffic to SSH port (22) - CloudTrail logs are not encrypted using Customer Master Keys (CMKs) - Excessive login failures - VPC endpoints were not used for consuming S3 storage from within the VPC - Access logging not enabled on S3 buckets - S3 buckets do not have server side encryption - Account hijacking attempts - Security groups allow internet traffic - VPC subnets should not allow automatic public IP assignment - VPC Flow Logs not enabled - MFA not enabled for IAM users - Inactive users for more than 30 days - description: The policy label. name: policy-label - description: The number of alerts to return. name: limit - description: The policy compliance standard. name: policy-compliance-standard - description: The cloud account ID. name: cloud-account-id - description: The cloud account name. name: cloud-account - description: The cloud region name. name: cloud-region - description: The alert rule name. name: alert-rule-name - description: The resource ID. name: resource-id - description: The resource name. name: resource-name - description: The resource type. name: resource-type - auto: PREDEFINED defaultValue: open description: The alert status. name: alert-status predefined: - open - resolved - dismissed - description: The alert ID. name: alert-id - auto: PREDEFINED description: The cloud type. name: cloud-type predefined: - aws - azure - gcp - auto: PREDEFINED description: The risk grade. name: risk-grade predefined: - A - B - C - F deprecated: true - auto: PREDEFINED description: The policy type. name: policy-type predefined: - anomaly - audit_event - config - network - auto: PREDEFINED description: The policy severity. name: policy-severity predefined: - high - medium - low deprecated: true description: Search alerts on the Prisma Cloud platform. If no time-range arguments are given, the search will filter only alerts from the last 7 days. name: redlock-search-alerts outputs: - contextPath: PrismaCloud.AlertPageToken.nextPageToken description: Next page token. type: String - contextPath: PrismaCloud.Alert.id description: The ID of the returned alert. type: String - contextPath: PrismaCloud.Alert.status description: The status of the returned alert. type: String - contextPath: PrismaCloud.Alert.reason description: The reason for the returned alert. type: String - contextPath: PrismaCloud.Alert.lastSeen description: The time the returned alert was last seen. type: String - contextPath: PrismaCloud.Alert.firstSeen description: The time the returned alert was first seen. type: String - contextPath: PrismaCloud.Alert.lastUpdated description: The time the returned alert was last updated. type: String - contextPath: PrismaCloud.Alert.alertTime description: The time of the returned alert. type: String - contextPath: PrismaCloud.Alert.policy.policyId description: The policy ID of the returned alert. type: String - contextPath: PrismaCloud.Alert.policy.name description: The policy name of the returned alert. type: String - contextPath: PrismaCloud.Alert.policy.policyType description: The policy type of the returned alert. type: String - contextPath: PrismaCloud.Alert.policy.severity description: The policy severity of the returned alert. type: String - contextPath: PrismaCloud.Alert.policy.remediable description: Whether the policy is remediable. type: Boolean - contextPath: PrismaCloud.Alert.policy.description description: The policy description of the returned alert. type: String - contextPath: PrismaCloud.Alert.policy.recommendation description: The policy recommendation of the returned alert. type: String - contextPath: PrismaCloud.Alert.policy.remediation.description description: The policy remediation description of the returned alert. type: String - contextPath: PrismaCloud.Alert.policy.remediation.cliScriptTemplate description: The policy CLI script template description of the returned alert. type: String - contextPath: PrismaCloud.Alert.policy.systemDefault description: Whether the policy is the system default. type: Boolean - contextPath: PrismaCloud.Alert.policy.deleted description: Whether the policy was deleted. type: Boolean - contextPath: PrismaCloud.Alert.resource.resourceType description: The resource type of the returned alert. type: String - contextPath: PrismaCloud.Alert.resource.name description: The resource name of the returned alert. type: String - contextPath: PrismaCloud.Alert.resource.account description: The resource account of the returned alert. type: String - contextPath: PrismaCloud.Alert.resource.cloudType description: The resource cloud type of the returned alert. type: String - contextPath: PrismaCloud.Alert.resource.rrn description: The restricted resource name of the returned alert. type: String - arguments: - default: true description: The alert ID. name: alert-id required: true deprecated: true description: Gets the details of an alert based on the alert ID. name: redlock-get-alert-details - arguments: - description: Comma-separated list of string IDs to be dismissed. name: alert-id - description: The amount of time to snooze. Both snooze value and unit must be specified. name: snooze-value - auto: PREDEFINED description: The time unit for snoozing alert. Both snooze value and unit must be specified if snoozing. name: snooze-unit predefined: - hour - day - week - month - year - epoch - description: Reason for dismissal. name: dismissal-note required: true - description: Start time for the search in the following string format - MM/DD/YYYY. name: time-range-date-from - description: End time for the search in the following format - MM/DD/YYYY. name: time-range-date-to - description: The number of units to go back in time. name: time-range-value - auto: PREDEFINED description: The search unit. name: time-range-unit predefined: - hour - day - week - month - year - login - epoch - auto: PREDEFINED description: The policy name. name: policy-name predefined: - IAM password policy does not have a symbol - IAM password policy does not expire in 90 days - IAM password policy does not have a lowercase character - IAM password policy does not have a minimum of 14 characters - IAM password policy allows password reuse - Default Security Group does not restrict all traffic - IAM password policy does not have password expiration period - IAM password policy does not exist - Access keys are not rotated for 90 days - Security Groups allow internet traffic from internet to RDP port (3389) - Internet connectivity via tcp over insecure port - IAM policy allow full administrative privileges - Primitive IAM roles should not be used - Internet exposed instances - IAM user has both Console access and Access Keys - S3 buckets are accessible to public - Access logging not enabled on all CloudTrail buckets - CloudTrail trail is not integrated with CloudWatch Log - Security Groups allow internet traffic to SSH port (22) - CloudTrail logs are not encrypted using Customer Master Keys (CMKs) - Excessive login failures - VPC endpoints were not used for consuming S3 storage from within the VPC - Access logging not enabled on S3 buckets - S3 buckets do not have server side encryption - Account hijacking attempts - Security groups allow internet traffic - VPC subnets should not allow automatic public IP assignment - VPC Flow Logs not enabled - MFA not enabled for IAM users - Inactive users for more than 30 days - description: The policy label. name: policy-label - description: The policy compliance standard. name: policy-compliance-standard - description: The cloud account. name: cloud-account - description: The cloud region. name: cloud-region - description: The alert rule name. name: alert-rule-name - description: The resource ID. name: resource-id - description: The resource name. name: resource-name - description: The resource type. name: resource-type - auto: PREDEFINED description: The alert status. name: alert-status predefined: - open - resolved - dismissed - auto: PREDEFINED description: The cloud type. name: cloud-type predefined: - aws - azure - gcp - auto: PREDEFINED description: The risk grade. name: risk-grade predefined: - A - B - C - F deprecated: true - auto: PREDEFINED description: The policy type. name: policy-type predefined: - anomaly - audit_event - config - network - auto: PREDEFINED description: The policy severity. name: policy-severity predefined: - high - medium - low - description: Comma-separated string of policy IDs. isArray: true name: policy-id deprecated: true description: Dismiss the alerts matching the given filter. Must provide either policy IDs or alert IDs. execution: true name: redlock-dismiss-alerts - arguments: - description: The IDs of alerts to reopen. name: alert-id - description: Start time for search in the following string format - MM/DD/YYYY. name: time-range-date-from - description: End time for search in the following format - MM/DD/YYYY. name: time-range-date-to - description: The number of units to go back in time. name: time-range-value - auto: PREDEFINED description: The search unit. name: time-range-unit predefined: - hour - day - week - month - year - login - epoch - auto: PREDEFINED description: The policy name. name: policy-name predefined: - IAM password policy does not have a symbol - IAM password policy does not expire in 90 days - IAM password policy does not have a lowercase character - IAM password policy does not have a minimum of 14 characters - IAM password policy allows password reuse - Default Security Group does not restrict all traffic - IAM password policy does not have password expiration period - IAM password policy does not exist - Access keys are not rotated for 90 days - Security Groups allow internet traffic from internet to RDP port (3389) - Internet connectivity via tcp over insecure port - IAM policy allow full administrative privileges - Primitive IAM roles should not be used - Internet exposed instances - IAM user has both Console access and Access Keys - S3 buckets are accessible to public - Access logging not enabled on all CloudTrail buckets - CloudTrail trail is not integrated with CloudWatch Log - Security Groups allow internet traffic to SSH port (22) - CloudTrail logs are not encrypted using Customer Master Keys (CMKs) - Excessive login failures - VPC endpoints were not used for consuming S3 storage from within the VPC - Access logging not enabled on S3 buckets - S3 buckets do not have server side encryption - Account hijacking attempts - Security groups allow internet traffic - VPC subnets should not allow automatic public IP assignment - VPC Flow Logs not enabled - MFA not enabled for IAM users - Inactive users for more than 30 days - description: The policy label. name: policy-label - description: The policy compliance standard. name: policy-compliance-standard - description: The cloud account. name: cloud-account - description: The cloud region. name: cloud-region - description: The alert rule name. name: alert-rule-name - description: The resource ID. name: resource-id - description: The resource name. name: resource-name - description: The resource type. name: resource-type - auto: PREDEFINED description: The alert status. name: alert-status predefined: - open - resolved - dismissed - auto: PREDEFINED description: The cloud type. name: cloud-type predefined: - aws - azure - gcp - auto: PREDEFINED description: The risk grade. name: risk-grade predefined: - A - B - C - F deprecated: true - auto: PREDEFINED description: The policy type. name: policy-type predefined: - anomaly - audit_event - config - network - auto: PREDEFINED description: The policy severity. name: policy-severity predefined: - high - medium - low deprecated: true description: Re-open the alerts matching the given filter. Must provide either policy IDs or alert IDs. execution: true name: redlock-reopen-alerts - arguments: - description: The alert ID for which to get remediation details. name: alert-id deprecated: true description: Gets remediation details for the given alert. name: redlock-get-remediation-details - deprecated: true description: List the acceptable filters and values for alerts. name: redlock-list-alert-filters - arguments: - description: Start time for the search, in the following string format - MM/DD/YYYY. name: time-range-date-from - description: End time for the search, in the following format - MM/DD/YYYY. name: time-range-date-to - description: The number of time range value units for the search. For example, 3 days, 5 weeks, etc. name: time-range-value - auto: PREDEFINED description: |- The search unit. The "login" and "epoch" options are only available if timeRangeValue is not provided. name: time-range-unit predefined: - hour - day - week - month - year - login - epoch - description: Query to run in Prisma Cloud config API using RQL language. name: query required: true - defaultValue: '100' description: Maximum number of entries to return. name: limit deprecated: true description: Search the configuration inventory on the Prisma Cloud platform using RQL language. name: redlock-search-config outputs: - contextPath: PrismaCloud.Config.accountId description: Cloud account ID. type: String - contextPath: PrismaCloud.Config.accountName description: Cloud account name. type: String - contextPath: PrismaCloud.Config.allowDrillDown description: Whether to allow drill down. type: Boolean - contextPath: PrismaCloud.Config.cloudType description: Cloud type. type: String - contextPath: PrismaCloud.Config.deleted description: Whether the asset was deleted. type: Boolean - contextPath: PrismaCloud.Config.hasExtFindingRiskFactors description: Whether the configuration has external finding risk factors. type: Boolean - contextPath: PrismaCloud.Config.hasExternalFinding description: Whether the configuration has an external finding. type: Boolean - contextPath: PrismaCloud.Config.hasExternalIntegration description: Whether the configuration has an external integration. type: Boolean - contextPath: PrismaCloud.Config.hasNetwork description: Whether the configuration has a network. type: Boolean - contextPath: PrismaCloud.Config.id description: Prisma Cloud configuration ID. type: String - contextPath: PrismaCloud.Config.assetId description: Prisma Cloud asset ID. type: String - contextPath: PrismaCloud.Config.data description: Prisma Cloud asset specific data. type: Unknown - contextPath: PrismaCloud.Config.insertTs description: Insert timestamp. type: Date - contextPath: PrismaCloud.Config.createdTs description: Created timestamp. type: Date - contextPath: PrismaCloud.Config.name description: Asset name. type: String - contextPath: PrismaCloud.Config.regionId description: Cloud region ID. type: String - contextPath: PrismaCloud.Config.regionName description: Cloud region Name. type: String - contextPath: PrismaCloud.Config.resourceType description: Cloud resource type. type: String - contextPath: PrismaCloud.Config.rrn description: Cloud restricted resource name. type: String - contextPath: PrismaCloud.Config.service description: Cloud service. type: String - contextPath: PrismaCloud.Config.stateId description: State ID. type: String - arguments: - description: The maximum number of records to return. '; limit search records to {}' is appended to every query where {} is the maximum number of records to return. If no value is provided, only 1 record is returned. name: limit - description: 'The RQL config query to run. Examples of RQL config queries can be found here: https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-rql-reference/rql-reference/config-query/config-query-examples.html. Note that ` limit search records to 1` is automatically appended to each query and a `;` may need to be added to the end of the RQL input to make the entire query valid. The limit parameter adjusts this to be a value other than 1.' name: rql required: true deprecated: true description: Returns the results of an RQL config query. name: redlock-get-rql-response - arguments: - description: Start time for the search, in the following format - MM/DD/YYYY. name: time-range-date-from - description: End time for the search, in the following format - MM/DD/YYYY. name: time-range-date-to - description: The number of time range value units for the search. For example, 3 days, 5 weeks, etc. name: time-range-value - auto: PREDEFINED description: |- The search unit. The "login" and "epoch" options are only available if timeRangeValue is not provided. name: time-range-unit predefined: - hour - day - week - month - year - login - epoch - description: Query to run in Prisma Cloud search API using RQL language. name: query required: true - defaultValue: '100' description: Maximum number of entries to return. name: limit deprecated: true description: Search events on the Prisma Cloud platform using RQL language. name: redlock-search-event - arguments: - description: Start time for the search, in the following format - MM/DD/YYYY. name: time-range-date-from - description: End time for the search, in the following format - MM/DD/YYYY. name: time-range-date-to - description: The number of time range value units for the search. For example, 3 days, 5 weeks, etc. name: time-range-value - auto: PREDEFINED description: |- The search unit. The "login" and "epoch" options are only available if timeRangeValue is not provided. name: time-range-unit predefined: - hour - day - week - month - year - login - epoch - description: Query to run in Prisma Cloud search API using RQL language. name: query required: true - auto: PREDEFINED description: The cloud in which the network should be searched. name: cloud-type predefined: - aws - azure - gcp - alibaba_cloud - oci deprecated: true description: Search networks on the Prisma Cloud platform using RQL language. name: redlock-search-network - arguments: - default: false description: Date string representing the local time. The incident is only returned if it was modified after the last update time. isArray: false name: lastUpdate required: false secret: false deprecated: false description: Get the list of incidents that were modified since the last update time. This method is used for debugging purposes. The get-modified-remote-data command is used as part of the Mirroring feature that was introduced in Cortex XSOAR version 6.1. execution: false name: get-modified-remote-data - arguments: - default: false description: The remote incident ID. isArray: false name: id required: true secret: false - default: false defaultValue: '0' description: The UTC timestamp in seconds of the last update. The incident is only updated if it was modified after the last update time. isArray: false name: lastUpdate required: false secret: false deprecated: false description: Get remote data from a remote incident. This method does not update the current incident, and should be used for debugging purposes only. execution: false name: get-remote-data - arguments: [] deprecated: false description: Updates the remote incident with local incident changes. This method is only used for debugging purposes and will not update the current incident. execution: false name: update-remote-system - arguments: - description: Access key name. name: name required: true - description: Timestamp in milliseconds when access key expires. Default:0. name: expires-on deprecated: false description: Adds a new access key for the current user. If you have API access, you can create up to two access keys. execution: false name: prisma-cloud-access-key-create outputs: - contextPath: PrismaCloud.AccessKeys.id description: Access key ID. type: String - contextPath: PrismaCloud.AccessKeys.secretKey description: Access key secret. type: String - arguments: - description: Returns the metadata of the access key that has the specified ID. name: access-key - description: Maximum number of entries to return. name: limit deprecated: false description: Returns all access keys for your tenant if you have a Prisma Cloud System Admin role. Returns just your access keys if you don't have this role. execution: false name: prisma-cloud-access-keys-list outputs: - contextPath: PrismaCloud.AccessKeys.id description: Access key ID. type: String - contextPath: PrismaCloud.AccessKeys.createdBy description: The user who created the access key. type: String - contextPath: PrismaCloud.AccessKeys.createdTs description: Time access key was created. type: Number - contextPath: PrismaCloud.AccessKeys.expiresOn description: The time the access key expires. type: Number - contextPath: PrismaCloud.AccessKeys.lastUsedTime description: The last time the access key was used. type: Number - contextPath: PrismaCloud.AccessKeys.name description: The name of the access key. type: String - contextPath: PrismaCloud.AccessKeys.role description: Access key user role. type: Object - contextPath: PrismaCloud.AccessKeys.roleType description: User role permission type. type: String - contextPath: PrismaCloud.AccessKeys.status description: Access key status. type: String - contextPath: PrismaCloud.AccessKeys.username description: Access key user name. type: String - arguments: - description: Access key ID. name: access-key required: true deprecated: false description: Deactivates the access key that has the specified ID. execution: false name: prisma-cloud-access-key-disable - arguments: - description: Access key ID. name: access-key required: true deprecated: false description: Activates the access key that has the specified ID. You cannot activate an expired access key. execution: false name: prisma-cloud-access-key-enable - arguments: - description: Access key ID. name: access-key required: true deprecated: false description: Deletes the access key that has the specified ID. execution: false name: prisma-cloud-access-key-delete - arguments: - description: Unified Asset ID or RRN (Restricted Resource Name). name: asset_id required: true - auto: PREDEFINED description: External finding types. name: finding_type predefined: - COMPLIANCE_CIS - GUARD_DUTY_HOST - GUARD_DUTY_IAM - INSPECTOR_RBA - INSPECTOR_SBP - NETWORK_REACHABILITY - AZURE_SECURITY_CENTER_ALERTS - UNCLASSIFIED - COMMAND_AND_CONTROL - CREDENTIAL_ACCESS - CROSS_ACCOUNT_TRUST - DATA_EXFILTRATION - DEFENSE_EVASION - DISCOVERY - HIGH_PRIVILEGED_ROLE - INITIAL_ACCESS - INTERNET_EXPOSURE - KEYS_AND_SECRETS - LATERAL_MOVEMENT - MALWARE - MFA - MISCONFIGURATION - NETWORK_ANOMALY - PRIVILEGE_ESCALATION - RECONNAISSANCE - RESOURCE_HIJACKING - SSH_BRUTE_FORCE - UNAUTHORIZED_ACCESS - UNENCRYPTED_DATA - UNUSED_PRIVILEGES - USER_ANOMALY - WEAK_PASSWORD - SENSITIVE_DATA_EXPOSURE - INJECTIONS - VULNERABILITY_SCANNING - SHELLSHOCK - KNOWN_BOTS - UNKNOWN_BOTS - VIRTUAL_PATCHES - WEB_ATTACK - BOT_ACTIVITY - WEB_SCRAPING - CUSTOM - VULNERABILITY - HOST_VULNERABILITY_CVE - CONTAINER_IMAGE_VULNERABILITY_CVE - VIRTUAL_IMAGE_VULNERABILITY_CVE - SERVERLESS_VULNERABILITY - PACKAGE_VULNERABILITY - auto: PREDEFINED description: Comma-separated list of external finding risk factors. isArray: true name: risk_factors predefined: - CRITICAL_SEVERITY - HIGH_SEVERITY - MEDIUM_SEVERITY - HAS_FIX - REMOTE_EXECUTION - DOS - RECENT_VULNERABILITY - EXPLOIT_EXISTS - ATTACK_COMPLEXITY_LOW - ATTACK_VECTOR_NETWORK - REACHABLE_FROM_THE_INTERNET - LISTENING_PORTS - CONTAINER_IS_RUNNING_AS_ROOT - NO_MANDATORY_SECURITY_PROFILE_APPLIED - RUNNING_AS_PRIVILEGED_CONTAINER - PACKAGE_IN_USE - DOS_LOW - DOS_HIGH - EXPLOIT_EXISTS_IN_THE_WILD - EXPLOIT_EXISTS_POC - SENSITIVE_INFORMATION - ROOT_MOUNT - RUNTIME_SOCKET - HOST_ACCESS - description: Timeline item ID. name: timeline_item_id - description: Comma-separated list of alert IDs. isArray: true name: alert_ids - description: Limit number of records. name: limit - description: Permissions type. name: permission_type - description: Next page token. name: page_token - auto: PREDEFINED description: Filter Hyperion findings. name: prisma_cloud_findings_only predefined: - 'true' - 'false' - description: CVE ID, Package ID, or Layer ID. The value needs to be fetched from one of the groups by API calls. name: vulnerability_info_type_id - auto: PREDEFINED description: Supported vulnerability types. name: vulnerability_info_type predefined: - CVE - PACKAGE - LAYER description: Returns detailed information for the asset with the given ID. name: prisma-cloud-asset-get outputs: - contextPath: PrismaCloud.Asset.problem.title description: 'The title of the problem.' type: String - contextPath: PrismaCloud.Asset.problem.status.statusCode description: 'The status code of the problem.' type: Number - contextPath: PrismaCloud.Asset.problem.status.reasonPhrase description: 'The reason for the problem.' type: String - contextPath: PrismaCloud.Asset.problem.detail description: 'The details of the problem.' type: String - contextPath: PrismaCloud.Asset.problem.instance description: 'The instance of the problem.' type: String - contextPath: PrismaCloud.Asset.problem.type description: 'The type of the problem.' type: String - contextPath: PrismaCloud.Asset.problem.parameters description: 'The parameters of the problem.' type: Unknown - contextPath: PrismaCloud.Asset.id description: 'The ID of the asset.' type: String - contextPath: PrismaCloud.Asset.prismaId description: 'The Prisma ID of the asset.' type: String - contextPath: PrismaCloud.Asset.appName description: 'The app name of the asset.' type: String - contextPath: PrismaCloud.Asset.externalAssetId description: 'The external asset ID of the asset.' type: String - contextPath: PrismaCloud.Asset.assetTypeId description: 'The asset type ID of the asset.' type: Number - contextPath: PrismaCloud.Asset.cloudType description: 'The cloud type of the asset.' type: String - contextPath: PrismaCloud.Asset.createdTs description: 'The creation timestamp of the asset.' type: Number - contextPath: PrismaCloud.Asset.insertTs description: 'The insertion timestamp of the asset.' type: Number - contextPath: PrismaCloud.Asset.data description: 'The data of the asset.' type: Unknown - contextPath: PrismaCloud.Asset.dynamicData description: 'The dynamic data of the asset.' type: Unknown - contextPath: PrismaCloud.Asset.riskGrade description: 'The risk grade of the asset.' type: String - contextPath: PrismaCloud.Asset.stateId description: 'The state ID of the asset.' type: String - contextPath: PrismaCloud.Asset.name description: 'The name of the asset.' type: String - contextPath: PrismaCloud.Asset.regionId description: 'The region ID of the asset.' type: String - contextPath: PrismaCloud.Asset.regionName description: 'The region name of the asset.' type: String - contextPath: PrismaCloud.Asset.altAssetId description: 'The alternative asset ID of the asset.' type: String - contextPath: PrismaCloud.Asset.url description: 'The URL of the asset.' type: String - contextPath: PrismaCloud.Asset.vpcId description: 'The VPC ID of the asset.' type: String - contextPath: PrismaCloud.Asset.vpcExternalAssetId description: 'The VPC external asset ID of the asset.' type: String - contextPath: PrismaCloud.Asset.vpcName description: 'The VPC name of the asset.' type: String - contextPath: PrismaCloud.Asset.tags description: 'The tags of the asset.' type: Unknown - contextPath: PrismaCloud.Asset.relationshipCounts description: 'The relationship counts of the asset.' type: Number - contextPath: PrismaCloud.Asset.vulnerabilityCounts description: 'The vulnerability counts of the asset.' type: Unknown - contextPath: PrismaCloud.Asset.accountName description: 'The account name of the asset.' type: String - contextPath: PrismaCloud.Asset.assetType description: 'The account type of the asset.' type: String - contextPath: PrismaCloud.Asset.serviceName description: 'The service name of the asset.' type: String - contextPath: PrismaCloud.Asset.resourceType description: 'The resource type of the asset.' type: String - contextPath: PrismaCloud.Asset.deleted description: 'The deletion state of the asset.' type: Boolean - contextPath: PrismaCloud.Asset.assetClassId description: 'The asset class ID of the asset.' type: String - contextPath: PrismaCloud.Asset.assetClass description: 'The asset class of the asset.' type: String - contextPath: PrismaCloud.Asset.attributes description: 'The attributes of the asset.' type: Unknown - contextPath: PrismaCloud.Asset.alertsCount.severity description: 'The severity of the alerts of the asset.' type: String - contextPath: PrismaCloud.Asset.alertsCount.count description: 'The alert count of the asset.' type: Number - contextPath: PrismaCloud.Asset.ipAddresses description: 'The IP addresses of the asset.' type: String - contextPath: PrismaCloud.Asset.trueInternetExposure description: 'The internet exposure state of the asset.' type: String - contextPath: PrismaCloud.Asset.dataSecurity description: 'The data security of the asset.' type: Unknown - arguments: - description: Unified asset ID or RRN (Restricted Resource Name). name: asset_id required: true - auto: PREDEFINED defaultValue: asset description: Asset domain service query type. name: type predefined: - external_finding - asset - asset_lite - alerts - alerts_counts - alert_summary - finding_summary - attack_path - attack_path_summary - raw_config - network - timeline - external_integration - asset_data_indicators - relationships - findings - vulnerabilities - permissions - package_info - labels - vulnerability_aggregates - process_info - vulnerabilities_group_by_type - asset_cwp_vulns - app_contexts - attributes - data_security - data_security_summary required: true - auto: PREDEFINED description: External finding types. name: finding_type predefined: - COMPLIANCE_CIS - GUARD_DUTY_HOST - GUARD_DUTY_IAM - INSPECTOR_RBA - INSPECTOR_SBP - NETWORK_REACHABILITY - AZURE_SECURITY_CENTER_ALERTS - UNCLASSIFIED - COMMAND_AND_CONTROL - CREDENTIAL_ACCESS - CROSS_ACCOUNT_TRUST - DATA_EXFILTRATION - DEFENSE_EVASION - DISCOVERY - HIGH_PRIVILEGED_ROLE - INITIAL_ACCESS - INTERNET_EXPOSURE - KEYS_AND_SECRETS - LATERAL_MOVEMENT - MALWARE - MFA - MISCONFIGURATION - NETWORK_ANOMALY - PRIVILEGE_ESCALATION - RECONNAISSANCE - RESOURCE_HIJACKING - SSH_BRUTE_FORCE - UNAUTHORIZED_ACCESS - UNENCRYPTED_DATA - UNUSED_PRIVILEGES - USER_ANOMALY - WEAK_PASSWORD - SENSITIVE_DATA_EXPOSURE - INJECTIONS - VULNERABILITY_SCANNING - SHELLSHOCK - KNOWN_BOTS - UNKNOWN_BOTS - VIRTUAL_PATCHES - WEB_ATTACK - BOT_ACTIVITY - WEB_SCRAPING - CUSTOM - VULNERABILITY - HOST_VULNERABILITY_CVE - CONTAINER_IMAGE_VULNERABILITY_CVE - VIRTUAL_IMAGE_VULNERABILITY_CVE - SERVERLESS_VULNERABILITY - PACKAGE_VULNERABILITY - auto: PREDEFINED description: Comma-separated list of external finding risk factors. isArray: true name: risk_factors predefined: - CRITICAL_SEVERITY - HIGH_SEVERITY - MEDIUM_SEVERITY - HAS_FIX - REMOTE_EXECUTION - DOS - RECENT_VULNERABILITY - EXPLOIT_EXISTS - ATTACK_COMPLEXITY_LOW - ATTACK_VECTOR_NETWORK - REACHABLE_FROM_THE_INTERNET - LISTENING_PORTS - CONTAINER_IS_RUNNING_AS_ROOT - NO_MANDATORY_SECURITY_PROFILE_APPLIED - RUNNING_AS_PRIVILEGED_CONTAINER - PACKAGE_IN_USE - DOS_LOW - DOS_HIGH - EXPLOIT_EXISTS_IN_THE_WILD - EXPLOIT_EXISTS_POC - SENSITIVE_INFORMATION - ROOT_MOUNT - RUNTIME_SOCKET - HOST_ACCESS - description: Timeline item ID. name: timeline_item_id - description: Comma-separated list of alert IDs. isArray: true name: alert_ids - description: Limit number of records. name: limit - description: Permissions type. name: permission_type - description: Next page token. name: page_token - auto: PREDEFINED description: Filter Hyperion findings. name: prisma_cloud_findings_only predefined: - 'true' - 'false' - description: CVE ID, package ID, or layer ID. The value needs to be fetched from one of the group by API calls. name: vulnerability_info_type_id - auto: PREDEFINED description: Supported vulnerability types. name: vulnerability_info_type predefined: - CVE - PACKAGE - LAYER description: Returns detailed information for the asset with the given ID. name: prisma-cloud-asset-generic-get - arguments: - description: Unified asset ID or RRN (Restricted Resource Name). name: asset_id required: true - auto: PREDEFINED description: External finding types. name: finding_type predefined: - COMPLIANCE_CIS - GUARD_DUTY_HOST - GUARD_DUTY_IAM - INSPECTOR_RBA - INSPECTOR_SBP - NETWORK_REACHABILITY - AZURE_SECURITY_CENTER_ALERTS - UNCLASSIFIED - COMMAND_AND_CONTROL - CREDENTIAL_ACCESS - CROSS_ACCOUNT_TRUST - DATA_EXFILTRATION - DEFENSE_EVASION - DISCOVERY - HIGH_PRIVILEGED_ROLE - INITIAL_ACCESS - INTERNET_EXPOSURE - KEYS_AND_SECRETS - LATERAL_MOVEMENT - MALWARE - MFA - MISCONFIGURATION - NETWORK_ANOMALY - PRIVILEGE_ESCALATION - RECONNAISSANCE - RESOURCE_HIJACKING - SSH_BRUTE_FORCE - UNAUTHORIZED_ACCESS - UNENCRYPTED_DATA - UNUSED_PRIVILEGES - USER_ANOMALY - WEAK_PASSWORD - SENSITIVE_DATA_EXPOSURE - INJECTIONS - VULNERABILITY_SCANNING - SHELLSHOCK - KNOWN_BOTS - UNKNOWN_BOTS - VIRTUAL_PATCHES - WEB_ATTACK - BOT_ACTIVITY - WEB_SCRAPING - CUSTOM - VULNERABILITY - HOST_VULNERABILITY_CVE - CONTAINER_IMAGE_VULNERABILITY_CVE - VIRTUAL_IMAGE_VULNERABILITY_CVE - SERVERLESS_VULNERABILITY - PACKAGE_VULNERABILITY - auto: PREDEFINED description: Comma-separated list of external finding risk factors. isArray: true name: risk_factors predefined: - CRITICAL_SEVERITY - HIGH_SEVERITY - MEDIUM_SEVERITY - HAS_FIX - REMOTE_EXECUTION - DOS - RECENT_VULNERABILITY - EXPLOIT_EXISTS - ATTACK_COMPLEXITY_LOW - ATTACK_VECTOR_NETWORK - REACHABLE_FROM_THE_INTERNET - LISTENING_PORTS - CONTAINER_IS_RUNNING_AS_ROOT - NO_MANDATORY_SECURITY_PROFILE_APPLIED - RUNNING_AS_PRIVILEGED_CONTAINER - PACKAGE_IN_USE - DOS_LOW - DOS_HIGH - EXPLOIT_EXISTS_IN_THE_WILD - EXPLOIT_EXISTS_POC - SENSITIVE_INFORMATION - ROOT_MOUNT - RUNTIME_SOCKET - HOST_ACCESS - description: Timeline item ID. name: timeline_item_id - description: Comma-separated list of alert IDs. isArray: true name: alert_ids - description: Limit number of records. name: limit - description: Permissions type. name: permission_type - description: Next page token. name: page_token - auto: PREDEFINED description: Filter Hyperion findings. name: prisma_cloud_findings_only predefined: - 'true' - 'false' - description: CVE ID, package ID, or layer ID. The value needs to be fetched from one of the group by API calls. name: vulnerability_info_type_id - auto: PREDEFINED description: Supported vulnerability types. name: vulnerability_info_type predefined: - CVE - PACKAGE - LAYER description: Returns detailed information for the asset findings with the given ID. name: prisma-cloud-asset-findings-get outputs: - contextPath: PrismaCloud.AssetFindings.problem.title description: 'The title of the problem.' type: String - contextPath: PrismaCloud.AssetFindings.problem.status.statusCode description: 'The status code of the problem.' type: Number - contextPath: PrismaCloud.AssetFindings.problem.status.reasonPhrase description: 'The reason for the problem.' type: String - contextPath: PrismaCloud.AssetFindings.problem.detail description: 'The details of the problem.' type: String - contextPath: PrismaCloud.AssetFindings.problem.instance description: 'The instance of the problem.' type: String - contextPath: PrismaCloud.AssetFindings.problem.type description: 'The type of the problem.' type: String - contextPath: PrismaCloud.AssetFindings.problem.parameters description: 'The parameters of the problem.' type: Unknown - contextPath: PrismaCloud.AssetFindings.accountId description: 'The account ID of the asset findings.' type: String - contextPath: PrismaCloud.AssetFindings.count description: 'The count of asset findings.' type: String - contextPath: PrismaCloud.AssetFindings.createdOn description: 'The created on of the asset findings.' type: Number - contextPath: PrismaCloud.AssetFindings.customerId description: 'The customer ID of the asset findings.' type: Number - contextPath: PrismaCloud.AssetFindings.cveId description: 'The CVE ID of the asset findings.' type: String - contextPath: PrismaCloud.AssetFindings.description description: 'The description of the asset findings.' type: String - contextPath: PrismaCloud.AssetFindings.externalId description: 'The external ID of the asset findings.' type: Number - contextPath: PrismaCloud.AssetFindings.id description: 'The ID of the asset findings.' type: String - contextPath: PrismaCloud.AssetFindings.normalizedName description: 'The normalized name of the asset findings.' type: String - contextPath: PrismaCloud.AssetFindings.normalizedNames description: 'The normalized names of the asset findings.' type: String - contextPath: PrismaCloud.AssetFindings.nvdUrl description: 'The nvd URL of the asset findings.' type: String - contextPath: PrismaCloud.AssetFindings.link description: 'The link of the asset findings.' type: String - contextPath: PrismaCloud.AssetFindings.rawData description: 'The raw data of the asset findings.' type: String - contextPath: PrismaCloud.AssetFindings.regionId description: 'The region ID of the asset findings.' type: String - contextPath: PrismaCloud.AssetFindings.resourceCloudId description: 'The resource cloud ID of the asset findings.' type: String - contextPath: PrismaCloud.AssetFindings.resourceId description: 'The resource ID of the asset findings.' type: Number - contextPath: PrismaCloud.AssetFindings.resourceUrl description: 'The resource URL of the asset findings.' type: String - contextPath: PrismaCloud.AssetFindings.riskFactors description: 'The risk factors of the asset findings.' type: String - contextPath: PrismaCloud.AssetFindings.rlUpdatedOn description: 'The rl updated on of the asset findings.' type: Number - contextPath: PrismaCloud.AssetFindings.scanId description: 'The scan ID of the asset findings.' type: String - contextPath: PrismaCloud.AssetFindings.score description: 'The score of the asset findings.' type: String - contextPath: PrismaCloud.AssetFindings.severity description: 'The severity of the asset findings.' type: String - contextPath: PrismaCloud.AssetFindings.source description: 'The source of the asset findings.' type: String - contextPath: PrismaCloud.AssetFindings.sourceData description: 'The source data of the asset findings.' type: Unknown - contextPath: PrismaCloud.AssetFindings.status description: 'The status of the asset findings.' type: String - contextPath: PrismaCloud.AssetFindings.title description: 'The title of the asset findings.' type: String - contextPath: PrismaCloud.AssetFindings.type description: 'The type of the asset findings.' type: String - contextPath: PrismaCloud.AssetFindings.packageName description: 'The package name of the asset findings.' type: String - contextPath: PrismaCloud.AssetFindings.updatedOn description: 'The updated on of the asset findings.' type: Number - arguments: - description: Unified asset ID or RRN (Restricted Resource Name). name: asset_id required: true - auto: PREDEFINED description: External finding types. name: finding_type predefined: - COMPLIANCE_CIS - GUARD_DUTY_HOST - GUARD_DUTY_IAM - INSPECTOR_RBA - INSPECTOR_SBP - NETWORK_REACHABILITY - AZURE_SECURITY_CENTER_ALERTS - UNCLASSIFIED - COMMAND_AND_CONTROL - CREDENTIAL_ACCESS - CROSS_ACCOUNT_TRUST - DATA_EXFILTRATION - DEFENSE_EVASION - DISCOVERY - HIGH_PRIVILEGED_ROLE - INITIAL_ACCESS - INTERNET_EXPOSURE - KEYS_AND_SECRETS - LATERAL_MOVEMENT - MALWARE - MFA - MISCONFIGURATION - NETWORK_ANOMALY - PRIVILEGE_ESCALATION - RECONNAISSANCE - RESOURCE_HIJACKING - SSH_BRUTE_FORCE - UNAUTHORIZED_ACCESS - UNENCRYPTED_DATA - UNUSED_PRIVILEGES - USER_ANOMALY - WEAK_PASSWORD - SENSITIVE_DATA_EXPOSURE - INJECTIONS - VULNERABILITY_SCANNING - SHELLSHOCK - KNOWN_BOTS - UNKNOWN_BOTS - VIRTUAL_PATCHES - WEB_ATTACK - BOT_ACTIVITY - WEB_SCRAPING - CUSTOM - VULNERABILITY - HOST_VULNERABILITY_CVE - CONTAINER_IMAGE_VULNERABILITY_CVE - VIRTUAL_IMAGE_VULNERABILITY_CVE - SERVERLESS_VULNERABILITY - PACKAGE_VULNERABILITY - auto: PREDEFINED description: Comma-separated list of external finding risk factors. isArray: true name: risk_factors predefined: - CRITICAL_SEVERITY - HIGH_SEVERITY - MEDIUM_SEVERITY - HAS_FIX - REMOTE_EXECUTION - DOS - RECENT_VULNERABILITY - EXPLOIT_EXISTS - ATTACK_COMPLEXITY_LOW - ATTACK_VECTOR_NETWORK - REACHABLE_FROM_THE_INTERNET - LISTENING_PORTS - CONTAINER_IS_RUNNING_AS_ROOT - NO_MANDATORY_SECURITY_PROFILE_APPLIED - RUNNING_AS_PRIVILEGED_CONTAINER - PACKAGE_IN_USE - DOS_LOW - DOS_HIGH - EXPLOIT_EXISTS_IN_THE_WILD - EXPLOIT_EXISTS_POC - SENSITIVE_INFORMATION - ROOT_MOUNT - RUNTIME_SOCKET - HOST_ACCESS - description: Timeline item ID. name: timeline_item_id - description: Comma-separated list of alert IDs. isArray: true name: alert_ids - description: Limit number of records. name: limit - description: Permissions type. name: permission_type - description: Next page token. name: page_token - auto: PREDEFINED description: Filter Hyperion findings. name: prisma_cloud_findings_only predefined: - 'true' - 'false' - description: CVE ID, package ID, or layer ID. The value needs to be fetched from one of the group by API calls. name: vulnerability_info_type_id - auto: PREDEFINED description: Supported vulnerability types. name: vulnerability_info_type predefined: - CVE - PACKAGE - LAYER description: Returns detailed information for the asset vulnerabilities with the given ID. name: prisma-cloud-asset-vulnerabilities-get outputs: - contextPath: PrismaCloud.AssetVulnerabilities.problem.title description: 'The title of the problem.' type: String - contextPath: PrismaCloud.AssetVulnerabilities.problem.status.statusCode description: 'The status code of the problem.' type: Number - contextPath: PrismaCloud.AssetVulnerabilities.problem.status.reasonPhrase description: 'The reason for the problem.' type: String - contextPath: PrismaCloud.AssetVulnerabilities.problem.detail description: 'The details of the problem.' type: String - contextPath: PrismaCloud.AssetVulnerabilities.problem.instance description: 'The instance of the problem.' type: String - contextPath: PrismaCloud.AssetVulnerabilities.problem.type description: 'The type of the problem.' type: String - contextPath: PrismaCloud.AssetVulnerabilities.problem.parameters description: 'The parameters of the problem.' type: Unknown - contextPath: PrismaCloud.AssetVulnerabilities.accountId description: 'The account ID of the asset vulnerability.' type: String - contextPath: PrismaCloud.AssetVulnerabilities.count description: 'The count of asset vulnerabilities.' type: String - contextPath: PrismaCloud.AssetVulnerabilities.createdOn description: 'The created on of the asset vulnerability.' type: Number - contextPath: PrismaCloud.AssetVulnerabilities.customerId description: 'The customer ID of the asset vulnerability.' type: Number - contextPath: PrismaCloud.AssetVulnerabilities.cveId description: 'The CVE ID of the asset vulnerability.' type: String - contextPath: PrismaCloud.AssetVulnerabilities.description description: 'The description of the asset vulnerability.' type: String - contextPath: PrismaCloud.AssetVulnerabilities.externalId description: 'The external ID of the asset vulnerability.' type: Number - contextPath: PrismaCloud.AssetVulnerabilities.id description: 'The ID of the asset vulnerability.' type: String - contextPath: PrismaCloud.AssetVulnerabilities.normalizedName description: 'The normalized name of the asset vulnerability.' type: String - contextPath: PrismaCloud.AssetVulnerabilities.normalizedNames description: 'The normalized names of the asset vulnerability.' type: String - contextPath: PrismaCloud.AssetVulnerabilities.nvdUrl description: 'The nvd URL of the asset vulnerability.' type: String - contextPath: PrismaCloud.AssetVulnerabilities.link description: 'The link of the asset vulnerability.' type: String - contextPath: PrismaCloud.AssetVulnerabilities.rawData description: 'The raw data of the asset vulnerability.' type: String - contextPath: PrismaCloud.AssetVulnerabilities.regionId description: 'The region ID of the asset vulnerability.' type: String - contextPath: PrismaCloud.AssetVulnerabilities.resourceCloudId description: 'The resource cloud ID of the asset vulnerability.' type: String - contextPath: PrismaCloud.AssetVulnerabilities.resourceId description: 'The resource ID of the asset vulnerability.' type: Number - contextPath: PrismaCloud.AssetVulnerabilities.resourceUrl description: 'The resource URL of the asset vulnerability.' type: String - contextPath: PrismaCloud.AssetVulnerabilities.riskFactors description: 'The risk factors of the asset vulnerability.' type: String - contextPath: PrismaCloud.AssetVulnerabilities.rlUpdatedOn description: 'The rl updated on of the asset vulnerability.' type: Number - contextPath: PrismaCloud.AssetVulnerabilities.scanId description: 'The scan ID of the asset vulnerability.' type: String - contextPath: PrismaCloud.AssetVulnerabilities.score description: 'The score of the asset vulnerability.' type: String - contextPath: PrismaCloud.AssetVulnerabilities.severity description: 'The severity of the asset vulnerability.' type: String - contextPath: PrismaCloud.AssetVulnerabilities.source description: 'The source of the asset vulnerability.' type: String - contextPath: PrismaCloud.AssetVulnerabilities.sourceData description: 'The source data of the asset vulnerability.' type: Unknown - contextPath: PrismaCloud.AssetVulnerabilities.status description: 'The status of the asset vulnerability.' type: String - contextPath: PrismaCloud.AssetVulnerabilities.title description: 'The title of the asset vulnerability.' type: String - contextPath: PrismaCloud.AssetVulnerabilities.type description: 'The type of the asset vulnerability.' type: String - contextPath: PrismaCloud.AssetVulnerabilities.packageName description: 'The package name of the asset vulnerability.' type: String - contextPath: PrismaCloud.AssetVulnerabilities.updatedOn description: 'The updated on of the asset vulnerability.' type: Number - arguments: - description: Unified asset ID or RRN (Restricted Resource Name). name: asset_id required: true - auto: PREDEFINED description: External finding types. name: finding_type predefined: - COMPLIANCE_CIS - GUARD_DUTY_HOST - GUARD_DUTY_IAM - INSPECTOR_RBA - INSPECTOR_SBP - NETWORK_REACHABILITY - AZURE_SECURITY_CENTER_ALERTS - UNCLASSIFIED - COMMAND_AND_CONTROL - CREDENTIAL_ACCESS - CROSS_ACCOUNT_TRUST - DATA_EXFILTRATION - DEFENSE_EVASION - DISCOVERY - HIGH_PRIVILEGED_ROLE - INITIAL_ACCESS - INTERNET_EXPOSURE - KEYS_AND_SECRETS - LATERAL_MOVEMENT - MALWARE - MFA - MISCONFIGURATION - NETWORK_ANOMALY - PRIVILEGE_ESCALATION - RECONNAISSANCE - RESOURCE_HIJACKING - SSH_BRUTE_FORCE - UNAUTHORIZED_ACCESS - UNENCRYPTED_DATA - UNUSED_PRIVILEGES - USER_ANOMALY - WEAK_PASSWORD - SENSITIVE_DATA_EXPOSURE - INJECTIONS - VULNERABILITY_SCANNING - SHELLSHOCK - KNOWN_BOTS - UNKNOWN_BOTS - VIRTUAL_PATCHES - WEB_ATTACK - BOT_ACTIVITY - WEB_SCRAPING - CUSTOM - VULNERABILITY - HOST_VULNERABILITY_CVE - CONTAINER_IMAGE_VULNERABILITY_CVE - VIRTUAL_IMAGE_VULNERABILITY_CVE - SERVERLESS_VULNERABILITY - PACKAGE_VULNERABILITY - auto: PREDEFINED description: Comma-separated list of external finding risk factors. isArray: true name: risk_factors predefined: - CRITICAL_SEVERITY - HIGH_SEVERITY - MEDIUM_SEVERITY - HAS_FIX - REMOTE_EXECUTION - DOS - RECENT_VULNERABILITY - EXPLOIT_EXISTS - ATTACK_COMPLEXITY_LOW - ATTACK_VECTOR_NETWORK - REACHABLE_FROM_THE_INTERNET - LISTENING_PORTS - CONTAINER_IS_RUNNING_AS_ROOT - NO_MANDATORY_SECURITY_PROFILE_APPLIED - RUNNING_AS_PRIVILEGED_CONTAINER - PACKAGE_IN_USE - DOS_LOW - DOS_HIGH - EXPLOIT_EXISTS_IN_THE_WILD - EXPLOIT_EXISTS_POC - SENSITIVE_INFORMATION - ROOT_MOUNT - RUNTIME_SOCKET - HOST_ACCESS - description: Timeline item ID. name: timeline_item_id - description: Comma-separated list of alert IDs. isArray: true name: alert_ids - description: Limit number of records. name: limit - description: Permissions type. name: permission_type - description: Next page token. name: page_token - auto: PREDEFINED description: Filter Hyperion findings. name: prisma_cloud_findings_only predefined: - 'true' - 'false' - description: CVE ID, package ID, or layer ID. The value needs to be fetched from one of the group by API calls. name: vulnerability_info_type_id - auto: PREDEFINED description: Supported vulnerability types. name: vulnerability_info_type predefined: - CVE - PACKAGE - LAYER description: Returns detailed information for the asset alerts with the given ID. name: prisma-cloud-asset-alerts-get outputs: - contextPath: PrismaCloud.AssetAlerts.problem.title description: 'The title of the problem.' type: String - contextPath: PrismaCloud.AssetAlerts.problem.status.statusCode description: 'The status code of the problem.' type: Number - contextPath: PrismaCloud.AssetAlerts.problem.status.reasonPhrase description: 'The reason for the problem.' type: String - contextPath: PrismaCloud.AssetAlerts.problem.detail description: 'The details of the problem.' type: String - contextPath: PrismaCloud.AssetAlerts.problem.instance description: 'The instance of the problem.' type: String - contextPath: PrismaCloud.AssetAlerts.problem.type description: 'The type of the problem.' type: String - contextPath: PrismaCloud.AssetAlerts.problem.parameters description: 'The parameters of the problem.' type: Unknown - contextPath: PrismaCloud.AssetAlerts.id description: 'The ID of the asset alert.' type: String - contextPath: PrismaCloud.AssetAlerts.severity description: 'The severity of the asset alert.' type: String - contextPath: PrismaCloud.AssetAlerts.policyId description: 'The policy ID of the asset alert.' type: String - contextPath: PrismaCloud.AssetAlerts.isHyperionPolicy description: 'The hyperion policy of the asset alert.' type: Boolean - contextPath: PrismaCloud.AssetAlerts.policyType description: 'The policy type of the asset alert.' type: String - contextPath: PrismaCloud.AssetAlerts.policyName description: 'The policy name of the asset alert.' type: String - contextPath: PrismaCloud.AssetAlerts.policyDescription description: 'The policy description of the asset alert.' type: String - contextPath: PrismaCloud.AssetAlerts.alertTime description: 'The alert time of the asset alert.' type: Number - arguments: - description: Unified asset ID or RRN (Restricted Resource Name). name: asset_id required: true - auto: PREDEFINED description: External finding types. name: finding_type predefined: - COMPLIANCE_CIS - GUARD_DUTY_HOST - GUARD_DUTY_IAM - INSPECTOR_RBA - INSPECTOR_SBP - NETWORK_REACHABILITY - AZURE_SECURITY_CENTER_ALERTS - UNCLASSIFIED - COMMAND_AND_CONTROL - CREDENTIAL_ACCESS - CROSS_ACCOUNT_TRUST - DATA_EXFILTRATION - DEFENSE_EVASION - DISCOVERY - HIGH_PRIVILEGED_ROLE - INITIAL_ACCESS - INTERNET_EXPOSURE - KEYS_AND_SECRETS - LATERAL_MOVEMENT - MALWARE - MFA - MISCONFIGURATION - NETWORK_ANOMALY - PRIVILEGE_ESCALATION - RECONNAISSANCE - RESOURCE_HIJACKING - SSH_BRUTE_FORCE - UNAUTHORIZED_ACCESS - UNENCRYPTED_DATA - UNUSED_PRIVILEGES - USER_ANOMALY - WEAK_PASSWORD - SENSITIVE_DATA_EXPOSURE - INJECTIONS - VULNERABILITY_SCANNING - SHELLSHOCK - KNOWN_BOTS - UNKNOWN_BOTS - VIRTUAL_PATCHES - WEB_ATTACK - BOT_ACTIVITY - WEB_SCRAPING - CUSTOM - VULNERABILITY - HOST_VULNERABILITY_CVE - CONTAINER_IMAGE_VULNERABILITY_CVE - VIRTUAL_IMAGE_VULNERABILITY_CVE - SERVERLESS_VULNERABILITY - PACKAGE_VULNERABILITY - auto: PREDEFINED description: Comma-separated list of external finding risk factors. isArray: true name: risk_factors predefined: - CRITICAL_SEVERITY - HIGH_SEVERITY - MEDIUM_SEVERITY - HAS_FIX - REMOTE_EXECUTION - DOS - RECENT_VULNERABILITY - EXPLOIT_EXISTS - ATTACK_COMPLEXITY_LOW - ATTACK_VECTOR_NETWORK - REACHABLE_FROM_THE_INTERNET - LISTENING_PORTS - CONTAINER_IS_RUNNING_AS_ROOT - NO_MANDATORY_SECURITY_PROFILE_APPLIED - RUNNING_AS_PRIVILEGED_CONTAINER - PACKAGE_IN_USE - DOS_LOW - DOS_HIGH - EXPLOIT_EXISTS_IN_THE_WILD - EXPLOIT_EXISTS_POC - SENSITIVE_INFORMATION - ROOT_MOUNT - RUNTIME_SOCKET - HOST_ACCESS - description: Timeline item ID. name: timeline_item_id - description: Comma-separated list of alert IDs. isArray: true name: alert_ids - description: Limit number of records. name: limit - description: Permissions type. name: permission_type - description: Next page token. name: page_token - auto: PREDEFINED description: Filter Hyperion findings. name: prisma_cloud_findings_only predefined: - 'true' - 'false' - description: CVE ID, package ID, or layer ID. The value needs to be fetched from one of the group by API calls. name: vulnerability_info_type_id - auto: PREDEFINED description: Supported vulnerability types. name: vulnerability_info_type predefined: - CVE - PACKAGE - LAYER description: Returns detailed information for the asset relationships with the given ID. name: prisma-cloud-asset-relationships-get outputs: - contextPath: PrismaCloud.AssetRelationships.assetId description: 'The asset ID of the asset relationship.' type: String - contextPath: PrismaCloud.AssetRelationships.relationshipType description: 'The relationship type of the asset relationship.' type: String - contextPath: PrismaCloud.AssetRelationships.assetTypeId description: 'The asset type ID of the asset relationship.' type: Number - contextPath: PrismaCloud.AssetRelationships.assetType description: 'The asset type of the asset relationship.' type: String - contextPath: PrismaCloud.AssetRelationships.assetName description: 'The asset name of the asset relationship.' type: String - contextPath: PrismaCloud.AssetRelationships.externalAssetId description: 'The external asset ID of the asset relationship.' type: String - contextPath: PrismaCloud.AssetRelationships.cloudId description: 'The cloud ID of the asset relationship.' type: String - contextPath: PrismaCloud.AssetRelationships.cloudName description: 'The cloud name of the asset relationship.' type: String - contextPath: PrismaCloud.AssetRelationships.pseudoAsset description: 'The pseudo asset of the asset relationship.' type: Boolean - contextPath: PrismaCloud.AssetRelationships.region description: 'The region of the asset relationship.' type: String - contextPath: PrismaCloud.AssetRelationships.cloudAccountId description: 'The cloud account ID of the asset relationship.' type: String - contextPath: PrismaCloud.AssetRelationships.assetClassId description: 'The asset class ID of the asset relationship.' type: String - contextPath: PrismaCloud.AssetRelationships.assetClass description: 'The asset class of the asset relationship.' type: String - contextPath: PrismaCloud.AssetRelationships.alertsCount.severity description: 'The severity of the alerts of the asset relationship.' type: String - contextPath: PrismaCloud.AssetRelationships.alertsCount.count description: 'The number of alerts of the asset relationships.' type: Number - contextPath: PrismaCloud.AssetRelationships.alertCountBySeverity.severity description: 'The severity of the alerts of the asset relationship.' type: String - contextPath: PrismaCloud.AssetRelationships.alertCountBySeverity.count description: 'The number of alerts by severity of the asset relationship.' type: Number - contextPath: PrismaCloud.AssetRelationships.vulnerabilityCounts description: 'The number of vulnerabilities of the asset relationship.' type: Unknown - contextPath: PrismaCloud.AssetRelationships.problem.title description: 'The title of the problem.' type: String - contextPath: PrismaCloud.AssetRelationships.problem.status.statusCode description: 'The status code of the problem.' type: Number - contextPath: PrismaCloud.AssetRelationships.problem.status.reasonPhrase description: 'The reason for the problem.' type: String - contextPath: PrismaCloud.AssetRelationships.problem.detail description: 'The details of the problem.' type: String - contextPath: PrismaCloud.AssetRelationships.problem.instance description: 'The instance of the problem.' type: String - contextPath: PrismaCloud.AssetRelationships.problem.type description: 'The type of the problem.' type: String - contextPath: PrismaCloud.AssetRelationships.problem.parameters description: 'The parameters of the problem.' type: Unknown - arguments: - description: Unified asset ID or RRN (Restricted Resource Name). name: asset_id required: true - auto: PREDEFINED description: External finding types. name: finding_type predefined: - COMPLIANCE_CIS - GUARD_DUTY_HOST - GUARD_DUTY_IAM - INSPECTOR_RBA - INSPECTOR_SBP - NETWORK_REACHABILITY - AZURE_SECURITY_CENTER_ALERTS - UNCLASSIFIED - COMMAND_AND_CONTROL - CREDENTIAL_ACCESS - CROSS_ACCOUNT_TRUST - DATA_EXFILTRATION - DEFENSE_EVASION - DISCOVERY - HIGH_PRIVILEGED_ROLE - INITIAL_ACCESS - INTERNET_EXPOSURE - KEYS_AND_SECRETS - LATERAL_MOVEMENT - MALWARE - MFA - MISCONFIGURATION - NETWORK_ANOMALY - PRIVILEGE_ESCALATION - RECONNAISSANCE - RESOURCE_HIJACKING - SSH_BRUTE_FORCE - UNAUTHORIZED_ACCESS - UNENCRYPTED_DATA - UNUSED_PRIVILEGES - USER_ANOMALY - WEAK_PASSWORD - SENSITIVE_DATA_EXPOSURE - INJECTIONS - VULNERABILITY_SCANNING - SHELLSHOCK - KNOWN_BOTS - UNKNOWN_BOTS - VIRTUAL_PATCHES - WEB_ATTACK - BOT_ACTIVITY - WEB_SCRAPING - CUSTOM - VULNERABILITY - HOST_VULNERABILITY_CVE - CONTAINER_IMAGE_VULNERABILITY_CVE - VIRTUAL_IMAGE_VULNERABILITY_CVE - SERVERLESS_VULNERABILITY - PACKAGE_VULNERABILITY - auto: PREDEFINED description: Comma-separated list of external finding risk factors. isArray: true name: risk_factors predefined: - CRITICAL_SEVERITY - HIGH_SEVERITY - MEDIUM_SEVERITY - HAS_FIX - REMOTE_EXECUTION - DOS - RECENT_VULNERABILITY - EXPLOIT_EXISTS - ATTACK_COMPLEXITY_LOW - ATTACK_VECTOR_NETWORK - REACHABLE_FROM_THE_INTERNET - LISTENING_PORTS - CONTAINER_IS_RUNNING_AS_ROOT - NO_MANDATORY_SECURITY_PROFILE_APPLIED - RUNNING_AS_PRIVILEGED_CONTAINER - PACKAGE_IN_USE - DOS_LOW - DOS_HIGH - EXPLOIT_EXISTS_IN_THE_WILD - EXPLOIT_EXISTS_POC - SENSITIVE_INFORMATION - ROOT_MOUNT - RUNTIME_SOCKET - HOST_ACCESS - description: Timeline item ID. name: timeline_item_id - description: Comma-separated list of alert IDs. isArray: true name: alert_ids - description: Limit number of records. name: limit - description: Permissions type. name: permission_type - description: Next page token. name: page_token - auto: PREDEFINED description: Filter Hyperion findings. name: prisma_cloud_findings_only predefined: - 'true' - 'false' - description: CVE ID, package ID, or layer ID. The value needs to be fetched from one of the group by API calls. name: vulnerability_info_type_id - auto: PREDEFINED description: Supported vulnerability types. name: vulnerability_info_type predefined: - CVE - PACKAGE - LAYER description: Returns detailed information for the asset network with the given ID. name: prisma-cloud-asset-network-get outputs: - contextPath: PrismaCloud.AssetNetwork.problem.title description: 'The title of the problem.' type: String - contextPath: PrismaCloud.AssetNetwork.problem.status.statusCode description: 'The status code of the problem.' type: Number - contextPath: PrismaCloud.AssetNetwork.problem.status.reasonPhrase description: 'The reason for the problem.' type: String - contextPath: PrismaCloud.AssetNetwork.problem.detail description: 'The details of the problem.' type: String - contextPath: PrismaCloud.AssetNetwork.problem.instance description: 'The instance of the problem.' type: String - contextPath: PrismaCloud.AssetNetwork.problem.type description: 'The type of the problem.' type: String - contextPath: PrismaCloud.AssetNetwork.problem.parameters description: 'The parameters of the problem.' type: Unknown - contextPath: PrismaCloud.AssetNetwork.id description: 'The ID of the asset network.' type: Number - contextPath: PrismaCloud.AssetNetwork.access description: 'The access of the asset network.' type: String - contextPath: PrismaCloud.AssetNetwork.direction description: 'The direction of the asset network.' type: String - contextPath: PrismaCloud.AssetNetwork.ips description: 'The IPS of the asset network.' type: String - contextPath: PrismaCloud.AssetNetwork.ports description: 'The ports of the asset network.' type: String - contextPath: PrismaCloud.AssetNetwork.protocol description: 'The protocol of the asset network.' type: String - contextPath: PrismaCloud.AssetNetwork.priority description: 'The priority of the asset network.' type: Number runonce: false tests: - Prisma Cloud V2 Test - Prisma Cloud V2 Basic Test defaultmapperin: RedLock-mapper defaultclassifier: RedLock fromversion: 6.5.0 hybrid:marketplacev2: true hybrid: false