RedLock Deprecated

Deprecated. Use the Prisma Cloud v2 integration instead.

Network Security · Prisma Cloud by Palo Alto Networks

Details

IDRedLock
ProviderPalo Alto Networks
CategoryNetwork Security
From Version5.0.0
Docker Imagedemisto/python3:3.10.10.49934
Supported ModulesAgentix XSIAM EDR Cortex Cloud Cloud Runtime Security

README

Configure Prisma Cloud (RedLock) in Cortex

Parameter Description Required
url Server API URL. See here for the relevant API URL for your tenant. True
username API Access Key True
password API Secret True
customer Customer name False
isFetch Fetch incidents False
incidentType Incident type False
fetch_time First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days, 3 months, 1 year) False
ruleName Fetch only incidents matching this rule name False
policyName Fetch only incidents matching this policy name False
policySeverity Fetch only incidents with this severity False
proxy Use system proxy settings False
unsecure Trust any certificate (not secure) False

Note: Further info on creating access keys for Prisma Cloud is available here.

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

redlock-search-alerts

Search alerts on the Prisma Cloud (RedLock) platform.
If no time-range arguments are given, the search will filter only alerts from the last 7 days.

Base Command

redlock-search-alerts

Input

Argument Name Description Required
time-range-date-from Start time for search in the following string format - MM/DD/YYYY, Should be provided along with time-range-date-to. If not both are provided, the time range will be set to the last 7 days and this argument will be ignored. Optional
time-range-date-to End time for search in the following format - MM/DD/YYYY, Should be provided along with time-range-date-from. If not both are provided, the time range will be set to the last 7 days and this argument will be ignored. Optional
time-range-value The amount of units to go back in time Optional
time-range-unit The search unit. login and epoch are only available if timeRangeValue is not provided. Optional
policy-name The policy name Optional
policy-label The policy label Optional
policy-compliance-standard The policy compliance standard Optional
cloud-account The cloud account name Optional
cloud-account-id The cloud account ID Optional
cloud-region The cloud region name Optional
alert-rule-name The alert rule name Optional
resource-id The resource ID Optional
resource-name The resource name Optional
resource-type The resource type Optional
alert-status The alert status Optional
alert-id The alert ID Optional
cloud-type The cloud type Optional
risk-grade The risk grade Optional
policy-type The policy type Optional
policy-severity The policy severity Optional

Context Output

Path Type Description
Redlock.Alert.ID string ID of returned alert
Redlock.Alert.Status string Status of returned alert
Redlock.Alert.AlertTime string Time of alert
Redlock.Alert.Policy.ID string The policy ID
Redlock.Alert.Policy.Name string The policy name
Redlock.Alert.Policy.Type string The policy type
Redlock.Alert.Policy.Severity string The policy severity
Redlock.Alert.Policy.Remediable boolean Whether or not the policy is remediable
Redlock.Alert.RiskDetail.Rating string The risk rating
Redlock.Alert.RiskDetail.Score string The risk score
Redlock.Metadata.CountOfAlerts number The number of alerts found

Command Example

!redlock-search-alerts alert-id=P-214016

Context Example

{
    "Redlock": {
        "Alert": {
            "AlertTime": "05/29/2020 14:16:15",
            "ID": "P-214016",
            "Policy": {
                "ID": "765988-b967-9djksb-830f-sdf98798sdf9",
                "Name": "AWS Security groups allow internet traffic gnoy",
                "Remediable": true,
                "Severity": "high",
                "Type": "config"
            },
            "Resource": {
                "Account": "testAWS",
                "AccountID": "9876654321",
                "ID": "sg-98vc98sd76sd",
                "Name": "demo-98787654432"
            },
            "RiskDetail": {
                "Rating": "F",
                "Score": 170
            },
            "Status": "open"
        },
        "Metadata": {
            "CountOfAlerts": 1
        }
    }
}

Human Readable Output

Alerts

ID Status FirstSeen LastSeen AlertTime PolicyName PolicyType PolicyDescription PolicySeverity PolicyRecommendation PolicyDeleted PolicyRemediable RiskRating ResourceName ResourceAccount ResourceType ResourceCloudType
P-214016 open 05/28/2020 01:17:31 05/29/2020 14:16:42 05/29/2020 14:16:15 AWS Security groups allow internet traffic gnoy config This policy identifies that Security Groups do not allow all traffic from internet. A Security Group acts as a virtual firewall that controls the traffic for one or more instances. Security groups should have restrictive ACLs to only allow incoming traffic from specific IPs to specific ports where the application is listening for connections. high If the Security Groups reported indeed need to restrict all traffic, follow the instructions below:
1. Log in to the AWS console
2. In the console, select the specific region from region drop down on the top right corner, for which the alert is generated
3. Navigate to the ‘VPC’ service
4. Click on the ‘Security Group’ specific to the alert
5. Click on ‘Inbound Rules’ and remove the row with the ip value as 0.0.0.0/0 or ::/0		 false true F demo-98787654432 testAWS SECURITY_GROUP aws

redlock-get-alert-details

Gets the details of an alert based on alert ID

Base Command

redlock-get-alert-details

Input

Argument Name Description Required
alert-id The alert ID Required
detailed Allows for retrieving entire / trimmed alert model Optional
resource_keys List of additional keys to return from the resource JSON, specified as a comma separated list (e.g. “key1,key2,key3”).
To preview all available resource JSON data, run redlock-get-alert-details with the “raw-response=true” option.		 Optional

Context Output

Path Type Description
Redlock.Alert.ID string The alert ID
Redlock.Alert.Status string The alert status
Redlock.Alert.AlertTime date The time of the alert
Redlock.Alert.Policy.ID string The policy ID
Redlock.Alert.Policy.Name string The policy name
Redlock.Alert.Policy.Type string The type of policy
Redlock.Alert.Policy.Severity string The policy severity
Redlock.Alert.Policy.Remediable boolean Whether or not the policy is remediable
Redlock.Alert.RiskDetail.Rating string The risk rating
Redlock.Alert.RiskDetail.Score string The risk score
Redlock.Alert.Resource.ID string The Resource ID of the cloud resource
Redlock.Alert.Resource.Name string The Resource Name of the cloud resource
Redlock.Alert.Resource.Account string The cloud account name where the resource resides
Redlock.Alert.Resource.AccountID string The cloud account ID where the resource resides
Redlock.Alert.Resource.Data json Additional keys from Resource.Data. Only appears when resource_keys argument is specified.

Command Example

!redlock-get-alert-details alert-id=P-214016

Context Example

{
    "Redlock": {
        "Alert": {
            "AlertTime": "05/29/2020 14:16:15",
            "ID": "P-214016",
            "Policy": {
                "ID": "765988-b967-9djksb-830f-sdf98798sdf9",
                "Name": null,
                "Remediable": false,
                "Severity": null,
                "Type": "config"
            },
            "Resource": {
                "Account": "testAWS",
                "AccountID": "9876654321",
                "ID": "sg-98vc98sd76sd",
                "Name": "demo-98787654432"
            },
            "RiskDetail": {
                "Rating": "F",
                "Score": 170
            },
            "Status": "open"
        }
    }
}

Human Readable Output

Alert

ID Status FirstSeen LastSeen AlertTime PolicyID PolicyName PolicyType PolicySystemDefault PolicyLabels PolicyDescription PolicySeverity PolicyRecommendation PolicyDeleted PolicyRemediable PolicyLastModifiedOn PolicyLastModifiedBy RiskScore RiskRating ResourceName ResourceRRN ResourceID ResourceAccount ResourceAccountID ResourceType ResourceRegionID ResourceApiName ResourceUrl ResourceData ResourceAccessKeyAge ResourceInactiveSinceTs ResourceCloudType
P-214016 open 05/28/2020 01:17:31 05/29/2020 14:16:42 05/29/2020 14:16:15     config false           false     170 F demo-98787654432   sg-98vc98sd76sd testAWS 9876654321 SECURITY_GROUP us-west-2 aws-ec2-describe-security-groups   vpcId: vpc-0824920b6d19bc
description: EKS created security group applied to ENI that is attached to EKS Control Plane master nodes, as well as any managed workloads.
tags: {u’value’: u’demo-98787654432’, u’key’: u’Name’},
{u’value’: u’cn-demo’, u’key’: u’aws:eks:cluster-name’},
{u’value’: u’owned’, u’key’: u’kubernetes.io/cluster/cn-demo’}
ipPermissions: {u’ipv4Ranges’: [{u’description’: u’kubernetes.io/rule/nlb/mtu=a7d568916a1b411ea83260a614b2e8ec’, u’cidrIp’: u’0.0.0.0/0’}], u’prefixListIds’: [], u’fromPort’: 3, u’ipRanges’: [u’0.0.0.0/0’], u’toPort’: 4, u’ipProtocol’: u’icmp’, u’userIdGroupPairs’: [], u’ipv6Ranges’: []},
{u’ipv4Ranges’: [{u’description’: u’kubernetes.io/rule/nlb/client=a7d568916a1b411ea83260a614b2e8ec’, u’cidrIp’: u’0.0.0.0/0’}, {u’description’: u’kubernetes.io/rule/nlb/health=a7d568916a1b411ea83260a614b2e8ec’, u’cidrIp’: u’192.168.0.0/16’}], u’prefixListIds’: [], u’fromPort’: 30463, u’ipRanges’: [u’0.0.0.0/0’, u’192.168.0.0/16’], u’toPort’: 30463, u’ipProtocol’: u’tcp’, u’userIdGroupPairs’: [], u’ipv6Ranges’: []},
{u’prefixListIds’: [], u’ipv4Ranges’: [{u’cidrIp’: u’x.x.x.x/16’}], u’ipRanges’: [u’x.x.x.x/16’], u’ipProtocol’: u’-1’, u’userIdGroupPairs’: [{u’userId’: u’9876654321’, u’groupId’: u’sg-0ce26260850e500d4’, u’description’: u’Allow unmanaged nodes to communicate with control plane (all ports)’}, {u’userId’: u’9876654321’, u’groupId’: u’sg-98vc98sd76sd’}], u’ipv6Ranges’: []}
groupName: demo-98787654432
ipPermissionsEgress: {u’prefixListIds’: [], u’ipv4Ranges’: [{u’cidrIp’: u’0.0.0.0/0’}], u’ipRanges’: [u’0.0.0.0/0’], u’ipProtocol’: u’-1’, u’userIdGroupPairs’: [], u’ipv6Ranges’: []}
ownerId: 9876654321
groupId: sg-98vc98sd76sd		     aws

redlock-dismiss-alerts

Dismiss the alerts matching the given filter. Must provide either policy IDs or alert IDs.

Base Command

redlock-dismiss-alerts

Input

Argument Name Description Required
alert-id Comma-separated list of string IDs to be dismissed Optional
dismissal-note Reason for dismissal. Required
snooze-value The amount of time to snooze. Both snooze value and unit must be specified. Optional
snooze-unit The time unit for if snoozing alert. Both snooze value and unit must be specified if snoozing. Optional
time-range-date-from Start time for search in the following string format - MM/DD/YYYY Optional
time-range-date-to End time for search in the following format - MM/DD/YYYY Optional
time-range-value The amount of units to go back in time Optional
time-range-unit The search unit Optional
policy-name The policy name Optional
policy-label The policy label Optional
policy-compliance-standard The policy compliance standard Optional
cloud-account The cloud account Optional
cloud-region The cloud region Optional
alert-rule-name The alert rule name Optional
resource-id The resource ID Optional
resource-name The resource name Optional
resource-type The resource type Optional
alert-status The alert status Optional
cloud-type The cloud type Optional
risk-grade The risk grade Optional
policy-type The policy type Optional
policy-severity The policy severity Optional
policy-id Comma-separated string of policy IDs Optional

Context Output

Path Type Description
Redlock.DismissedAlert.ID string The IDs of the dismissed alerts

Command Example

!redlock-dismiss-alerts dismissal-note="testing" alert-id=P-214016

Context Example

{
    "Redlock": {
        "DismissedAlert": {
            "ID": [
                "P-214016"
            ]
        }
    }
}

Human Readable Output

Alerts dismissed successfully. Dismissal Note: testing

redlock-reopen-alerts

Re-open the alerts matching the given filter. Must provide either policy IDs or alert IDs.

Base Command

redlock-reopen-alerts

Input

Argument Name Description Required
alert-id The IDs of alerts to reopen Optional
time-range-date-from Start time for search in the following string format - MM/DD/YYYY Optional
time-range-date-to End time for search in the following format - MM/DD/YYYY Optional
time-range-value The amount of units to go back in time Optional
time-range-unit The search unit Optional
policy-name The policy name Optional
policy-label The policy label Optional
policy-compliance-standard The policy compliance standard Optional
cloud-account The cloud account Optional
cloud-region The cloud region Optional
alert-rule-name The alert rule name Optional
resource-id The resource ID Optional
resource-name The resource name Optional
resource-type The resource type Optional
alert-status The alert status Optional
cloud-type The cloud type Optional
risk-grade The risk grade Optional
policy-type The policy type Optional
policy-severity The policy severity Optional

Context Output

Path Type Description
Redlock.ReopenedAlert.ID string IDs of the re-opened alerts

Command Example

!redlock-reopen-alerts alert-id=P-214016

Context Example

{
    "Redlock": {
        "ReopenedAlert": {
            "ID": [
                "P-214016"
            ]
        }
    }
}

Human Readable Output

Alerts re-opened successfully

redlock-list-alert-filters

List the acceptable filters and values for alerts

Base Command

redlock-list-alert-filters

Input

| Argument Name | Description | Required |
| — | — | — |

Context Output

There is no context output for this command.

Command Example


#### Context Example

{}


#### Human Readable Output

>### Filter options
>
>|Name|Options|Static|
>|---|---|---|
>| cloud.account |  | false |
>| alert.id |  | false |
>| cloud.region |  | false |
>| policy.label |  | false |
>| resource.id |  | false |
>| cloud.type | alibaba_cloud,aws,azure,gcp | true |
>| resource.name |  | false |
>| account.group |  | false |
>| risk.grade | A,B,C,F | true |
>| policy.complianceSection |  | false |
>| policy.remediable | true,false | true |
>| policy.name |  | false |
>| policy.type | anomaly,audit_event,config,network | true |
>| alert.status | dismissed,snoozed,open,resolved | true |
>| alertRule.name |  | false |
>| policy.subtype | build,run | true |
>| resource.type |  | false |
>| policy.complianceStandard |  | false |
>| cloud.accountId |  | false |
>| policy.severity | high,medium,low | true |
>| policy.rule.type | cft,k8s,tf | true |
>| cloud.service |  | false |
>| policy.complianceRequirement |  | false |

### redlock-get-remediation-details

***
Get remediation details for a given alert

#### Base Command

`redlock-get-remediation-details`

#### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| alert-id | The alert id to get remediation details for | Optional |

#### Context Output

| **Path** | **Type** | **Description** |
| --- | --- | --- |
| Redlock.Alert.Remediation.Description | string | Description of CLI remediation instructions |
| Redlock.Alert.ID | string | The ID of the alert for which the remediation details applies |
| Redlock.Alert.Remediation.CLI | string | Exact CLI command string |

#### Command Example

```!redlock-get-remediation-details alert-id=P-214016```

#### Context Example

{
“Redlock”: {
“Alert”: {
“ID”: “P-214016”,
“Remediation”: {
“CLI”: “aws –region us-west-2 ec2 revoke-security-group-ingress –group-id sg-984392384bkhjb –ip-permissions ‘[{"IpProtocol": "tcp", "IpRanges":[{"CidrIp": "0.0.0.0/0"}]}]’ ; aws –region us-west-1 ec2 authorize-security-group-ingress –group-id sg-98237498798 –ip-permissions ‘[{"IpProtocol": "tcp", "FromPort": 22, "ToPort": 22, "IpRanges":[{"CidrIp": "10.0.0.0/8", "Description": "Enforced by Redlock Remediation"}]}]’”,
“Description”: “"This CLI command requires ‘ec2:RevokeSecurityGroupIngress’ permission. Successful execution will update the security group to revoke the ingress rule records open to internet either on IPv4 or on IPv6 protocol."} To resolve the alert from Prisma Cloud’s console, add the permission.”
}
}
}
}


#### Human Readable Output

>### Remediation Details
>
>|ID|RemediationCLI|RemediationDescription|
>|---|---|---|
>| P-211648 | gcloud compute networks subnets update default --project=project1-111111 --region europe-north2 --enable-flow-logs | This CLI command requires 'compute.securityAdmin' permission. Successful execution will enables GCP VPC Flow logs for subnets to capture information about the IP traffic going to and from network interfaces in VPC Subnets. To resolve the alert from Prisma Cloud's console, add the permission. |

### redlock-get-rql-response

***
Run RQL query on Prisma Cloud

#### Base Command

`redlock-get-rql-response`

#### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| limit | determines the limit on the results. '; limit search records to {}' is appended to every query where {} is the value of limit or 1 if not passed | Optional |
| rql | the RQL query to run. Example RQL queries can be found here: https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-rql-reference/rql-reference/rql-examples. Note that `limit search records to 1` is automatically appended to each query and a `;` may need to be added to the end of the rql input to make the entire query valid.  The limit parameter adjusts this to be a value other than 1. | Required |

#### Context Output

| **Path** | **Type** | **Description** |
| --- | --- | --- |
| Redlock.RQL.Query | String | The |
| Redlock.RQL.Response.AccountId | Date | The cloud account ID. |
| Redlock.RQL.Response.AccountName | String | The cloud account name. |
| Redlock.RQL.Response.AllowDrillDown | Boolean | Flag to allow drill down. |
| Redlock.RQL.Response.CloudType | String | The cloud type. |
| Redlock.RQL.Response.Data | Object | The data object returned by the RQL response. Reference: https://api.docs.prismacloud.io/api/cloud/cspm/search/ |
| Redlock.RQL.Response.Deleted | Boolean | Flag if deleted. |
| Redlock.RQL.Response.HasAlert | Boolean | Flag to check if RQL response has alerts. |
| Redlock.RQL.Response.HasExtFindingRiskFactors | Boolean | Flag if query returns external risk factors. |
| Redlock.RQL.Response.HasExternalFinding | Boolean | Flag for external findings. |
| Redlock.RQL.Response.HasExternalIntegration | Boolean | Flag for external integration. |
| Redlock.RQL.Response.HasNetwork | Boolean | Flag for determining if network exists. |
| Redlock.RQL.Response.Id | String | The RQL response ID. |
| Redlock.RQL.Response.InsertTs | Date | The response time. |
| Redlock.RQL.Response.Name | String | The RQL response name. |
| Redlock.RQL.Response.RegionId | String | The cloud region ID. |
| Redlock.RQL.Response.RegionName | String | The cloud region name. |
| Redlock.RQL.Response.ResourceType | String | The resource type. |
| Redlock.RQL.Response.Rrn | String | The account RRN. |
| Redlock.RQL.Response.Service | String | The RQL response service. |
| Redlock.RQL.Response.StateId | String | The response state ID. |

#### Command Example

```!redlock-get-rql-response rql="config where api.name = 'aws-ec2-describe-instances' as X; config where api.name = 'aws-ec2-describe-security-groups' as Y; config where api.name = 'aws-ec2-describe-vpcs' as Z; filter 'not _Set.intersection($.X.vpcId,$.Y.vpcId) intersects (vpc-5b9a3c33,vpc-b8ba2dd0,vpc-b8ba2dd01)'; show X;"```

#### Context Example

```json
{
    "Redlock": {
        "RQL": {
            "Query": "config where api.name = 'aws-ec2-describe-instances' as X; config where api.name = 'aws-ec2-describe-security-groups' as Y; config where api.name = 'aws-ec2-describe-vpcs' as Z; filter 'not _Set.intersection($.X.vpcId,$.Y.vpcId) intersects (vpc-5b9a3c33,vpc-b8ba2dd0,vpc-b8ba2dd01)'; show X; limit search records to 1",
            "Response": [
                {
                    "AccountId": "1234567890",
                    "AccountName": "AWS PAN RBC",
                    "AllowDrillDown": true,
                    "CloudType": "aws",
                    "Data": {
                        "AmiLaunchIndex": 0,
                        "Architecture": "x86_64",
                        "BlockDeviceMappings": [
                            {
                                "DeviceName": "/dev/xvda",
                                "Ebs": {
                                    "AttachTime": "2020-11-22T09:16:37.000Z",
                                    "DeleteOnTermination": true,
                                    "Status": "attached",
                                    "VolumeId": "vol"
                                }
                            },
                            {
                                "DeviceName": "/dev/xvdbg",
                                "Ebs": {
                                    "AttachTime": "2020-11-23T15:33:52.000Z",
                                    "DeleteOnTermination": false,
                                    "Status": "attached",
                                    "VolumeId": "vol"
                                }
                            },
                            {
                                "DeviceName": "/dev/xvdcp",
                                "Ebs": {
                                    "AttachTime": "2020-11-23T15:33:52.000Z",
                                    "DeleteOnTermination": false,
                                    "Status": "attached",
                                    "VolumeId": "vol"
                                }
                            }
                        ],
                        "CapacityReservationSpecification": {
                            "CapacityReservationPreference": "open"
                        },
                        "ClientToken": "fleet",
                        "CpuOptions": {
                            "CoreCount": 1,
                            "ThreadsPerCore": 2
                        },
                        "EbsOptimized": false,
                        "ElasticGpuAssociations": [],
                        "ElasticInferenceAcceleratorAssociations": [],
                        "EnaSupport": true,
                        "HibernationOptions": {
                            "Configured": false
                        },
                        "Hypervisor": "xen",
                        "IamInstanceProfile": {
                            "Arn": "arn",
                            "Id": "AIPARLTR3KMHTT67AZ27N"
                        },
                        "ImageId": "ami-008ad23b7f9a160e5",
                        "InstanceId": "i-123456789",
                        "InstanceType": "t3.medium",
                        "KeyName": "kubernetes",
                        "LaunchTime": "2020-11-22T09:16:36.000Z",
                        "Licenses": [],
                        "MetadataOptions": {
                            "HttpEndpoint": "enabled",
                            "HttpPutResponseHopLimit": 2,
                            "HttpTokens": "optional",
                            "State": "applied"
                        },
                        "Monitoring": {
                            "State": "disabled"
                        },
                        "NetworkInterfaces": [
                            {
                                "Association": {
                                    "IpOwnerId": "amazon",
                                    "PublicDnsName": "ec2-x-x-x-x.eu-west-1.compute.amazonaws.com",
                                    "PublicIp": "y.y.y.y"
                                },
                                "Attachment": {
                                    "AttachTime": "2020-11-22T09:16:36.000Z",
                                    "AttachmentId": "eni-attach-0146b63374e77b227",
                                    "DeleteOnTermination": true,
                                    "DeviceIndex": 0,
                                    "Status": "attached"
                                },
                                "Description": "",
                                "Groups": [
                                    {
                                        "GroupId": "sg-13456789987654",
                                        "GroupName": "test"
                                    },
                                    {
                                        "GroupId": "sg-1255598765432",
                                        "GroupName": "test"
                                    }
                                ],
                                "InterfaceType": "interface",
                                "Ipv6Addresses": [],
                                "MacAddress": "02:94:a1:55:69:43",
                                "NetworkInterfaceId": "eni-0a5537731ce0b7fa2",
                                "OwnerId": "1234567890",
                                "PrivateDnsName": "ip-x.x.x.x.eu-west-1.compute.internal",
                                "PrivateIpAddress": "x.x.x.x",
                                "PrivateIpAddresses": [
                                    {
                                        "Association": {
                                            "IpOwnerId": "amazon",
                                            "PublicDnsName": "ec2-x-x-x-x.eu-west-1.compute.amazonaws.com",
                                            "PublicIp": "y.y.y.y"
                                        },
                                        "Primary": true,
                                        "PrivateDnsName": "ip-x.x.x.x.eu-west-1.compute.internal",
                                        "PrivateIpAddress": "x.x.x.x"
                                    },
                                    {
                                        "Primary": false,
                                        "PrivateDnsName": "ip-x.x.x.x.eu-west-1.compute.internal",
                                        "PrivateIpAddress": "x.x.x.x"
                                    },
                                    {
                                        "Primary": false,
                                        "PrivateDnsName": "ip-x.x.x.x.eu-west-1.compute.internal",
                                        "PrivateIpAddress": "x.x.x.x"
                                    },
                                    {
                                        "Primary": false,
                                        "PrivateDnsName": "ip-x.x.x.x.eu-west-1.compute.internal",
                                        "PrivateIpAddress": "x.x.x.x"
                                    },
                                    {
                                        "Primary": false,
                                        "PrivateDnsName": "ip-a.a.a.a.eu-west-1.compute.internal",
                                        "PrivateIpAddress": "a.a.a.a"
                                    },
                                    {
                                        "Primary": false,
                                        "PrivateDnsName": "ip-z.z.z.z.eu-west-1.compute.internal",
                                        "PrivateIpAddress": "z.z.z.z"
                                    }
                                ],
                                "SourceDestCheck": true,
                                "Status": "in-use",
                                "SubnetId": "subnet-123456789",
                                "VpcId": "vpc-123456789"
                            },
                            {
                                "Attachment": {
                                    "AttachTime": "2020-11-23T15:34:00.000Z",
                                    "AttachmentId": "eni-attach-0251b661bb021effe",
                                    "DeleteOnTermination": true,
                                    "DeviceIndex": 1,
                                    "Status": "attached"
                                },
                                "Description": "aws-K8S-i-123456789",
                                "Groups": [
                                    {
                                        "GroupId": "sg-13456789987654",
                                        "GroupName": "test"
                                    },
                                    {
                                        "GroupId": "sg-1255598765432",
                                        "GroupName": "test"
                                    }
                                ],
                                "InterfaceType": "interface",
                                "Ipv6Addresses": [],
                                "MacAddress": "x:z:d",
                                "NetworkInterfaceId": "eni-xyz",
                                "OwnerId": "1234567890",
                                "PrivateDnsName": "ip-x.x.x.x.eu-west-1.compute.internal",
                                "PrivateIpAddress": "x.x.x.x",
                                "PrivateIpAddresses": [
                                    {
                                        "Primary": false,
                                        "PrivateDnsName": "ip-x.x.x.x.eu-west-1.compute.internal",
                                        "PrivateIpAddress": "x.x.x.x"
                                    },
                                    {
                                        "Primary": false,
                                        "PrivateDnsName": "ip-x.x.x.x.eu-west-1.compute.internal",
                                        "PrivateIpAddress": "x.x.x.x"
                                    },
                                    {
                                        "Primary": false,
                                        "PrivateDnsName": "ip-x.x.x.x.eu-west-1.compute.internal",
                                        "PrivateIpAddress": "x.x.x.x"
                                    },
                                    {
                                        "Primary": false,
                                        "PrivateDnsName": "ip-x.x.x.x.eu-west-1.compute.internal",
                                        "PrivateIpAddress": "x.x.x.x"
                                    },
                                    {
                                        "Primary": false,
                                        "PrivateDnsName": "ip-x.x.x.x.eu-west-1.compute.internal",
                                        "PrivateIpAddress": "x.x.x.x"
                                    },
                                    {
                                        "Primary": true,
                                        "PrivateDnsName": "ip-x.x.x.x.eu-west-1.compute.internal",
                                        "PrivateIpAddress": "x.x.x.x"
                                    }
                                ],
                                "SourceDestCheck": true,
                                "Status": "in-use",
                                "SubnetId": "subnet-123456789",
                                "VpcId": "vpc-123456789"
                            }
                        ],
                        "Placement": {
                            "AvailabilityZone": "eu-west-1c",
                            "GroupName": "",
                            "Tenancy": "default"
                        },
                        "PrivateDnsName": "ip-x.x.x.x.eu-west-1.compute.internal",
                        "PrivateIpAddress": "x.x.x.x",
                        "ProductCodes": [],
                        "PublicDnsName": "ec2-x-x-x-x.eu-west-1.compute.amazonaws.com",
                        "PublicIpAddress": "y.y.y.y",
                        "RootDeviceName": "/dev/xvda",
                        "RootDeviceType": "ebs",
                        "SecurityGroups": [
                            {
                                "GroupId": "sg-13456789987654",
                                "GroupName": "test"
                            },
                            {
                                "GroupId": "sg-1255598765432",
                                "GroupName": "test"
                            }
                        ],
                        "SourceDestCheck": true,
                        "State": {
                            "Code": 16,
                            "Name": "running"
                        },
                        "StateTransitionReason": "",
                        "StatusEvents": [],
                        "SubnetId": "subnet-123456789",
                        "Tags": [
                            {
                                "Key": "Name",
                                "Value": "cluster-ng-11111111-Node"
                            },
                            {
                                "Key": "test.com/nodegroup-name",
                                "Value": "ng-a143ec42"
                            },
                            {
                                "Key": "test.com/nodegroup-type",
                                "Value": "managed"
                            },
                            {
                                "Key": "aws:autoscaling:groupName",
                                "Value": "eks-123456789"
                            },
                            {
                                "Key": "aws:ec2:fleet-id",
                                "Value": "fleet-0987654321"
                            },
                            {
                                "Key": "aws:ec2launchtemplate:id",
                                "Value": "lt-123456789"
                            },
                            {
                                "Key": "aws:ec2launchtemplate:version",
                                "Value": "1"
                            },
                            {
                                "Key": "eks:cluster-name",
                                "Value": "cluster"
                            },
                            {
                                "Key": "eks:nodegroup-name",
                                "Value": "ng-a143ec42"
                            },
                            {
                                "Key": "test.com/cluster-autoscaler/cluster",
                                "Value": "owned"
                            },
                            {
                                "Key": "test.com/cluster-autoscaler/enabled",
                                "Value": "true"
                            },
                            {
                                "Key": "kubernetes.io/cluster/cluster",
                                "Value": "owned"
                            }
                        ],
                        "VirtualizationType": "hvm",
                        "VpcId": "vpc-123456789"
                    },
                    "Deleted": false,
                    "HasAlert": false,
                    "HasExtFindingRiskFactors": false,
                    "HasExternalFinding": false,
                    "HasExternalIntegration": false,
                    "HasNetwork": false,
                    "Id": "i-123456789",
                    "InsertTs": 1234567876543,
                    "Name": "cluster-ng-11111111-Node",
                    "RegionId": "eu-west-1",
                    "RegionName": "AWS Ireland",
                    "ResourceType": "Instance",
                    "Rrn": "rrn:somthing",
                    "Service": "Amazon EC2",
                    "StateId": "asdfghjklkjhgfdssaa"
                }
            ]
        }
    }
}

Human Readable Output

RQL Output

Account Deleted Region Resource Name Service
AWS PAN false AWS Ireland cluster-ng-11111111-Node Amazon EC2

redlock-search-config

Search configuration inventory on the Prisma Cloud (RedLock) platform using RQL language

Base Command

redlock-search-config

Input

Argument Name Description Required
time-range-date-from Start time for search in the following string format - MM/DD/YYYY. Optional
time-range-date-to End time for search in the following format - MM/DD/YYYY. Optional
time-range-value The number of units to go back in time for the search. Optional
time-range-unit The search unit. Possible values are: “hour”, “day”, “week”, “month”, “year”, “login”, and “epoch”. The login and epoch values are only available if the time-range-value argument is not provided. Optional
query Query to run in Prisma Cloud config API (use RQL). Required
limit The maximum number of entries to return. Default is 100. Optional

Context Output

Path Type Description
Redlock.Asset.accountId Date Cloud Account ID.
Redlock.Asset.accountName String Cloud account Name
Redlock.Asset.allowDrillDown Boolean  
Redlock.Asset.cloudType String Cloud type.
Redlock.Asset.deleted Boolean Whether the asset was delete.
Redlock.Asset.hasAlert Boolean Whether the asset has a Prisma Cloud alert.
Redlock.Asset.hasExtFindingRiskFactors Boolean Whether the asset has external finding risk factors.
Redlock.Asset.hasExternalFinding Boolean Whether the asset has an external finding.
Redlock.Asset.hasExternalIntegration Boolean Whether the asset has an external integration.
Redlock.Asset.hasNetwork Boolean Whether the asset has a network.
Redlock.Asset.id String The Redlock asset ID.
Redlock.Asset.data Unknown The Redlock asset specific data.
Redlock.Asset.insertTs Date The asset insert TS.
Redlock.Asset.name String The asset name.
Redlock.Asset.regionId String The cloud region ID of the asset.
Redlock.Asset.regionName String The cloud region name of the asset.
Redlock.Asset.resourceType String The cloud resource type of the asset.
Redlock.Asset.rrn String The cloud RRN of the asset.
Redlock.Asset.service String The state ID of the asset.
Redlock.Asset.stateId String State ID

Command Example

!redlock-search-config query=`config where cloud.type = "aws" and cloud.service = "Amazon EC2" and api.name = "aws-ec2-describe-instances" and cloud.region="AWS Paris"`

Context Example

{
    "Redlock": {
        "Asset": {
            "accountId": "1234568717",
            "accountName": "cloud-account-test",
            "allowDrillDown": true,
            "cloudType": "aws",
            "data": {
                "amiLaunchIndex": 0,
                "architecture": "x86_64",
                "blockDeviceMappings": [
                    {
                        "deviceName": "/dev/sda1",
                        "ebs": {
                            "attachTime": "2019-10-24T19:21:26.000Z",
                            "deleteOnTermination": true,
                            "status": "attached",
                            "volumeId": "vol-0d76d5536e9900a9d"
                        }
                    }
                ],
                "capacityReservationSpecification": {
                    "capacityReservationPreference": "open"
                },
                "clientToken": "",
                "cpuOptions": {
                    "coreCount": 1,
                    "threadsPerCore": 1
                },
                "ebsOptimized": false,
                "elasticGpuAssociations": [],
                "elasticInferenceAcceleratorAssociations": [],
                "enaSupport": true,
                "hibernationOptions": {
                    "configured": false
                },
                "hypervisor": "xen",
                "imageId": "ami-0bb607148d8cf36fb",
                "instanceId": "i-0b12b0f4ed4b78e0b",
                "instanceType": "t2.micro",
                "keyName": "server1",
                "launchTime": "2019-10-24T19:21:25.000Z",
                "licenses": [],
                "metadataOptions": {
                    "httpEndpoint": "enabled",
                    "httpPutResponseHopLimit": 1,
                    "httpTokens": "optional",
                    "state": "applied"
                },
                "monitoring": {
                    "state": "disabled"
                },
                "networkInterfaces": [
                    {
                        "association": {
                            "ipOwnerId": "amazon",
                            "publicDnsName": "ec2-x-x-x-x.eu-west-1.compute.amazonaws.com",
                            "publicIp": "35.180.1.1"
                        },
                        "attachment": {
                            "attachTime": "2019-10-24T19:21:25.000Z",
                            "attachmentId": "eni-attach-0f8b6f1a9db5563d8",
                            "deleteOnTermination": true,
                            "deviceIndex": 0,
                            "status": "attached"
                        },
                        "description": "",
                        "groups": [
                            {
                                "groupId": "sg-0528d34b26dc81",
                                "groupName": "SSH-HTTPS-IPSec"
                            }
                        ],
                        "interfaceType": "interface",
                        "ipv6Addresses": [],
                        "macAddress": "0e:da:ad:84:82:7e",
                        "networkInterfaceId": "eni-09e89a2e7923d7",
                        "ownerId": "1234",
                        "privateDnsName": "ip-172-31-34-235.eu-west-3.compute.internal",
                        "privateIpAddress": "172.31.34.235",
                        "privateIpAddresses": [
                            {
                                "association": {
                                    "ipOwnerId": "amazon",
                                    "publicDnsName": "ec2-x-x-x-x.eu-west-1.compute.amazonaws.com",
                                    "publicIp": "35.180.1.1"
                                },
                                "primary": true,
                                "privateDnsName": "ip-172-31-34-235.eu-west-3.compute.internal",
                                "privateIpAddress": "172.31.34.235"
                            }
                        ],
                        "sourceDestCheck": true,
                        "status": "in-use",
                        "subnetId": "subnet-89c025c4",
                        "vpcId": "vpc-079b3111"
                    }
                ],
                "placement": {
                    "availabilityZone": "eu-west-3c",
                    "groupName": "",
                    "tenancy": "default"
                },
                "privateDnsName": "ip-172-31-34-235.eu-west-3.compute.internal",
                "privateIpAddress": "172.31.34.235",
                "productCodes": [],
                "publicDnsName": "ec2-x-x-x-x.eu-west-1.compute.amazonaws.com",
                "publicIpAddress": "35.180.1.1",
                "rootDeviceName": "/dev/sda1",
                "rootDeviceType": "ebs",
                "securityGroups": [
                    {
                        "groupId": "sg-0528d34b26dc81415",
                        "groupName": "SSH-HTTPS-IPSec"
                    }
                ],
                "sourceDestCheck": true,
                "state": {
                    "code": 16,
                    "name": "running"
                },
                "stateTransitionReason": "",
                "statusEvents": [],
                "subnetId": "subnet-89c025c4",
                "tags": [
                    {
                        "key": "Name",
                        "value": "server1"
                    }
                ],
                "virtualizationType": "hvm",
                "vpcId": "vpc-079b3111"
            },
            "deleted": false,
            "hasAlert": false,
            "hasExtFindingRiskFactors": false,
            "hasExternalFinding": false,
            "hasExternalIntegration": false,
            "hasNetwork": false,
            "id": "i-0b12baaaaa4b78e0b",
            "insertTs": 1603440806825,
            "name": "server1",
            "regionId": "eu-west-3",
            "regionName": "AWS Paris",
            "resourceType": "Instance",
            "rrn": "rrn::instance:eu-west-3:12345:9db2db5fdba47606863c8da86d3ae594fb5aee2b:i-0b12b0f4ed4b78e0b",
            "service": "Amazon EC2",
            "stateId": "5e79fd1aaab84a26abbf5641d4a115edfb8f7353"
        }
    }
}

Human Readable Output

RQL Output

Account Deleted Region Resource Name Service
Felix - AWS - pan-lab false AWS Virginia tl-console Amazon EC2

redlock-search-event

Search events on the Prisma Cloud (RedLock) platform using RQL language.

Base Command

redlock-search-event

Input

Argument Name Description Required
time-range-date-from Start time for the search, in the following format - MM/DD/YYYY. Optional
time-range-date-to End time for the search, in the following format - MM/DD/YYYY. Optional
time-range-value The number of time range value units for the search. For example, 3 days, 5 weeks, etc. Optional
time-range-unit The search unit. Possible values are: “hour”, “week”, “month”, “year”, “login”, or “epoch”. The “login” and “epoch” options are only available if timeRangeValue
is not provided. Possible values are: hour, day, week, month, year, login, epoch.		 Optional
query Query to run in Prisma Cloud search API using RQL language. Required
limit Maximum number of entries to return. Default is 100. Optional

Context Output

Path Type Description
Redlock.Event Unknown Cloud audit events.

Command Example

!redlock-search-event query=`event from cloud.audit_logs where ip EXISTS AND ip IN (172.31.34.235)` time-range-date-from=10/29/2021 time-range-date-to=10/30/2021

Context Example

{
    "Redlock": {
        "Event": [
            {
                "account": "712829893241",
                "regionId": 4,
                "eventTs": 1642051966000,
                "subject": "ejb-iam-cloudops",
                "type": "CREATE",
                "source": "s3.amazonaws.com",
                "name": "CreateBucket",
                "id": 2557671673,
                "ip": "172.31.34.235",
                "accessKeyUsed": false,
                "cityId": -4,
                "cityName": "Private",
                "stateId": -4,
                "stateName": "Private",
                "countryId": -4,
                "countryName": "Private",
                "cityLatitude": -1.0,
                "cityLongitude": -1.0,
                "success": false,
                "internal": false,
                "location": "Private",
                "accountName": "aws-emea-tac",
                "regionName": "AWS Oregon",
                "dynamicData": {}
            }
        ]
    }
}

Human Readable Output

Event Details

Showing 1 out of 1243 events

accessKeyUsed account accountName cityId cityLatitude cityLongitude cityName countryId countryName dynamicData eventTs id internal ip location name regionId regionName source stateId stateName subject success type
false 712829893241 aws-emea-tac -4 -1.0 -1.0 Private -4 Private   1642051938000 2557671539 false 172.31.34.235 Private CreateBucket 4 AWS Oregon s3.amazonaws.com -4 Private ejb-iam-cloudops false CREATE

redlock-search-network

Search networks on the Prisma Cloud (RedLock) platform using RQL language.

Base Command

redlock-search-network

Input

Argument Name Description Required
time-range-date-from Start time for the search, in the following format - MM/DD/YYYY. Optional
time-range-date-to End time for the search, in the following format - MM/DD/YYYY. Optional
time-range-value The number of time range value units for the search. For example, 3 days, 5 weeks, etc. Optional
time-range-unit The search unit. Possible values are: “hour”, “week”, “month”, “year”, “login”, or “epoch”. The “login” and “epoch” options are only available if timeRangeValue
is not provided. Possible values are: hour, day, week, month, year, login, epoch.		 Optional
query Query to run in Prisma Cloud search API using RQL language. Required
cloud-type The cloud in which the network should be searched. Possible values are: aws, azure, gcp, alibaba_cloud, oci. Optional

Context Output

Path Type Description
Redlock.Network.Node Unknown Cloud network node.
Redlock.Network.Connection Unknown Cloud network connection.

Command Example

!redlock-search-network query="network from vpc.flow_record where bytes > 0" time-range-unit=hour time-range-value=2

Context Example

{
    "Redlock": {
        "Node": [
              {
                "id": 1422407688,
                "name": "aqwe",
                "ipAddr": "172.31.34.235",
                "grouped": false,
                "suspicious": false,
                "vulnerable": true,
                "iconId": "web_server",
                "metadata": {
                    "redlock_alert_count": 16,
                    "host_vulnerability_count": 0,
                    "vpc_name": [
                        {
                            "id": "vpc-ddf45bb4",
                            "name": "defaultwala"
                        }
                    ],
                    "initial": true,
                    "vpc_id": [
                        "vpc-ddf45bb4"
                    ],
                    "ip_addresses": [
                        "172.31.34.235",
                        "35.180.1.1"
                    ],
                    "inspector_rba_count": 0,
                    "region_id": [
                        "us-east-2"
                    ],
                    "guard_duty_iam_count": 0,
                    "net_iface_id": [
                        "eni-04fec4df10974b6fe"
                    ],
                    "guard_duty_host_count": 0,
                    "tags": [
                        "None"
                    ],
                    "rrn": "rrn::managedLb:us-east-2:123456789012:393ffce52a85f09fef1be815f4fe9ca3186b4540:arn%3Aaws%3Aelasticloadbalancing%3Aus-east-2%3A123456789012%3Aloadbalancer%2Fnet%2Faqwe%2Ffb23c6bcbaee17a1",
                    "security_groups": [
                        "Unavailable"
                    ],
                    "serverless_vulnerability_count": 0,
                    "instance_id": [
                        "N/A"
                    ],
                    "account_id": [
                        "123456789012"
                    ],
                    "cloud_type": [
                        "aws"
                    ],
                    "asset_role": [
                        "Web Server"
                    ],
                    "account_name": [
                        "RedlockSandbox"
                    ],
                    "resource_id": [
                        "arn:aws:elasticloadbalancing:us-east-2:123456789012:loadbalancer/net/aqwe/fb23c6bcbaee17a1"
                    ],
                    "inspector_sbp_count": 0,
                    "region_name": [
                        "AWS Ohio"
                    ],
                    "compliance_count": 0
                }
            }
        ],
        "Connection": [
            {
                "from": 994246246,
                "to": 1418248367,
                "label": "Postgres",
                "suspicious": false,
                "metadata": {
                    "account_id": [
                        "123456789012"
                    ],
                    "cloud_type": [
                        "aws"
                    ],
                    "bytes_attempted": 0,
                    "connection_overview_table": [
                        {
                            "port": "Postgres",
                            "traffic_volume": 83938,
                            "accepted": "yes"
                        }
                    ],
                    "region_id": [
                        "us-east-2"
                    ],
                    "bytes_accepted": 83938,
                    "to_ip_addresses": [
                        "172.31.34.235"
                    ],
                    "flow_class": [
                        "Postgres"
                    ],
                    "from_ip_addresses": [
                        "172.31.34.235"
                    ],
                    "bytes_rejected": 0
                }
            }
        ]
    }
}

Human Readable Output

Network Details

Node

grouped id ipAddr metadata name suspicious vulnerable
false 1411487329 172.31.34.235 redlock_alert_count: 5
vpc_name: {‘id’: ‘https://www.googleapis.com/compute/v1/projects/tac-prisma-cloud-and-compute/global/networks/us-central1’, ‘name’: ‘us-central1’}
vpc_id: https://www.googleapis.com/compute/v1/projects/tac-prisma-cloud-and-compute/global/networks/us-central1
ip_addresses: 172.31.34.235
inspector_rba_count: 0
secgroup_ids: 7466735050281694697,
5386953130680217005
guard_duty_iam_count: 0
asset_role: VM Instance
account_name: gcp-emea-tac
region_name: GCP Iowa
compliance_count: 0
host_vulnerability_count: 0
initial: true
region_id: us-central1
net_iface_id: gke-oldtac-nopublicclust-default-pool-f08b69f0-6g3n#nic0
guard_duty_host_count: 0
tags: {‘name’: ‘gke-oldtac-nopublicclusterhere-fc43a760-node’, ‘values’: [’’]},
{‘name’: ‘goog-gke-node’, ‘values’: [’’]}
rrn: rrn::instance:us-central1:tac-prisma-cloud-and-compute:7040cac26d62fa19dea22bcb6cd52dba6c213212:1397701696990493277
security_groups: {‘id’: ‘7466735050281694697’, ‘name’: ‘allow-ingress-from-iap-tac’},
{‘id’: ‘5386953130680217005’, ‘name’: ‘gke-oldtac-nopublicclusterhere-fc43a760-all’}
serverless_vulnerability_count: 0
instance_id: 1397701696990493277
account_id: tac-prisma-cloud-and-compute
cloud_type: gcp
resource_id: 1397701696990493277
inspector_sbp_count: 0		 gke-oldtac-nopublicclust-default-pool-f08b69f0-6g3n false true

Connection

from label metadata suspicious to
1418600304 Web bytes_attempted: 1473
connection_overview_table: {‘port’: ‘Web (443)’, ‘traffic_volume’: 43694, ‘accepted’: ‘yes’},
{‘port’: ‘Web (443)’, ‘traffic_volume’: 1473, ‘accepted’: ‘no’}
region_id: us-central1
countries: N/A
to_ip_addresses: 0.0.0.0
flow_class: Web (443)
states: N/A
account_id: tac-prisma-cloud-and-compute
cloud_type: gcp
asset_role: Internet IPs
bytes_accepted: 43694
isps: N/A
from_ip_addresses: 10.128.0.5
bytes_rejected: 0		 false -1977384788

redlock-list-scans

List DevOps Scans

Base Command

redlock-list-scans

Input

Argument Name Description Required
group_by Group by which to aggregate scan results. Possible values are: scanId, assetType, assetName, resourceList. Default is scanId. Optional
page_size Pagination size. Default is 25. Optional
page_number Pagination number. Default is 1. Optional
sort Sorting parameters. The sort order is ascending unless the field is prefixed with minus (-), in which case it is descending. Optional
filter_type Time filter type. Possible values are: to_now, absolute, relative. Default is relative. Optional
filter_time_amount Number of time units. Default is 1. Optional
to_now_time_unit The time unit for retrieving the list of IaC scans. Possible values are: epoch, login, hour, day, week, month, year. Default is day. Optional
filter_start_time Start time , for example: 11/01/2021 10:10:10. Optional
filter_end_time End time in Unix time (the number of seconds that have elapsed since the Unix epoch) for the absolute time type. Optional
filter_asset_type Asset type to search with. Optional
filter_asset_name Asset name to search with. Optional
filter_user User to filter with, example: ayman@example.domain. Optional
filter_status Status to filter with, example: passed. Possible values are: . Optional
relative_time_unit Relative Time unit. Possible values are: epoch, login, year. Default is login. Optional

Context Output

Path Type Description
Redlock.Scans.deployed Boolean Scan deployed attribute.
Redlock.Scans.fail Number Scan fail attribute.
Redlock.Scans.failureCriteria String Scan failure criteria attribute.
Redlock.Scans.matchedPoliciesSummary.high Number Scan matched policies summary attribute.
Redlock.Scans.matchedPoliciesSummary.low Number Scan matched low policies summary attribute.
Redlock.Scans.matchedPoliciesSummary.medium Number Scan matched medium policies summary attribute.
Redlock.Scans.merged Boolean Scan merged attribute.
Redlock.Scans.name String Scan name attribute.
Redlock.Scans.pass Number Scan pass attribute.
Redlock.Scans.scanAttributes.appliedAlertRules String Scan applied alert rules attribute.
Redlock.Scans.scanAttributes.branch String Scan Scan branch attribute.
Redlock.Scans.scanAttributes.org String Scan org attribute.
Redlock.Scans.scanAttributes.pullRequestId String Scan PR ID attribute.
Redlock.Scans.scanAttributes.repository String Scan repository attribute.
Redlock.Scans.scanAttributes.resourcesScanned String Scan resources scanned attribute.
Redlock.Scans.scanAttributes.templateType String Scan template type attribute.
Redlock.Scans.scanAttributes.triggeredOn String Scan triggered on attribute.
Redlock.Scans.scanAttributes.userId String Scan user id attribute.
Redlock.Scans.scanTime Date Scan scan time attribute.
Redlock.Scans.status String Scan status attribute.
Redlock.Scans.tags.name String Scan tags name attribute.
Redlock.Scans.tags.value String Scan tags value attribute.
Redlock.Scans.type String Scan type attribute.
Redlock.Scans.user String Scan user attribute.
Redlock.Scans.id String Scan id.
Redlock.Scans.links.self String Scan links.
Redlock.Scans.relationships.scanResult.links.related String Scan relationships scan result links .

Command Example

!redlock-list-scans filter_type="absolute" filter_start_time="01/01/2021 10:10:10" filter_end_time="10/08/2021 10:10:10" filter_asset_type="GitHub" filter_asset_name="Github Asset Dev" filter_user="user@domain.example"

Context Example

{
    "Redlock": {
        "Scans": [
            {
                "attributes": {
                    "deployed": false,
                    "fail": 1,
                    "failureCriteria": "H:1 or M:1 or L:1",
                    "matchedPoliciesSummary": {
                        "high": 1,
                        "low": 7,
                        "medium": 4
                    },
                    "merged": false,
                    "name": [
                        "Github Asset Dev"
                    ],
                    "pass": 0,
                    "resourceList": [],
                    "scanAttributes": {
                        "appliedAlertRules": "*",
                        "branch": "vulnerable",
                        "org": "my-devsecops",
                        "pullRequestId": "96",
                        "repository": "moon",
                        "resourcesScanned": "1",
                        "templateType": "k8s",
                        "triggeredOn": "Pull Request",
                        "userId": "my-devsecops"
                    },
                    "scanTime": "2021-09-27T11:26:23Z",
                    "status": "failed",
                    "tags": [
                        {
                            "name": "Org",
                            "value": "Engineering"
                        },
                        {
                            "name": "Team",
                            "value": "DevSecOps"
                        },
                        {
                            "name": "env",
                            "value": "QA"
                        },
                        {
                            "name": "phase",
                            "value": "testing"
                        }
                    ],
                    "type": [
                        "GitHub"
                    ],
                    "user": [
                        "user@domain.example"
                    ]
                },
                "id": "81bb4c30-0a83-4e33-bbf7-0bb96ca15b9d",
                "links": {
                    "self": "/v2/scans/81bb4c30-0a83-4e33-bbf7-0bb96ca15b9d"
                },
                "relationships": {
                    "scanResult": {
                        "links": {
                            "related": "/v2/scans/results"
                        }
                    }
                }
            }
        ]
    }
}

Human Readable Output

Scans List

ID Name Scan Time Type User
81bb4c30-0a83-4e33-bbf7-0bb96ca15b9d Github Asset Dev 2021-09-27T11:26:23Z GitHub user@domain.example

redlock-get-scan-status

Get scan status

Base Command

redlock-get-scan-status

Input

Argument Name Description Required
scan_id The scan ID. Required

Context Output

Path Type Description
Redlock.Scans.id String Scan ID
Redlock.Scans.status String Scan status

Command Example

!redlock-get-scan-status scan_id="81bb4c30-0a83-4e33-bbf7-0bb96ca15b9d"

Context Example

{
    "Redlock": {
        "Scans": {
            "attributes": {
                "status": "failed"
            },
            "id": "81bb4c30-0a83-4e33-bbf7-0bb96ca15b9d"
        }
    }
}

Human Readable Output

Scan Status

ID Status
81bb4c30-0a83-4e33-bbf7-0bb96ca15b9d failed

redlock-get-scan-results

Get scan results

Base Command

redlock-get-scan-results

Input

Argument Name Description Required
scan_id The scan ID. Required

Context Output

Path Type Description
Redlock.Scans.id String Scan ID
Redlock.Scans.results.attributes.blameList.file String Scan results blame list file
Redlock.Scans.results.attributes.blameList.locations.line Number Scan results blame list locations line
Redlock.Scans.results.attributes.blameList.locations.path String Scan results blame list locations path
Redlock.Scans.results.attributes.desc String Scan results description
Redlock.Scans.results.attributes.docUrl String Scan results doc URL
Redlock.Scans.results.attributes.files String Scan results files
Redlock.Scans.results.attributes.name String Scan results name
Redlock.Scans.results.attributes.policyId String Scan results policy ID
Redlock.Scans.results.attributes.rule String Scan results rule
Redlock.Scans.results.attributes.severity String Scan results severity
Redlock.Scans.results.attributes.systemDefault Boolean Scan results system default
Redlock.Scans.results.id String Scan results ID

Command Example

!redlock-get-scan-results scan_id="81bb4c30-0a83-4e33-bbf7-0bb96ca15b9d"

Context Example

{
    "Redlock": {
        "Scans": {
            "id": "81bb4c30-0a83-4e33-bbf7-0bb96ca15b9d",
            "results": [
                {
                    "attributes": {
                        "blameList": [
                            {
                                "file": "./my-devsecops-moon-405fc6e/iac/vulnerable-iac.yaml",
                                "locations": [
                                    {
                                        "line": 2,
                                        "path": "/kind"
                                    },
                                    {
                                        "line": 18,
                                        "path": "/spec/template/spec/containers"
                                    }
                                ]
                            }
                        ],
                        "desc": "Ensure that all capabilities are dropped.",
                        "docUrl": "https://some-url",
                        "files": [
                            "./my-devsecops-moon-405fc6e/iac/vulnerable-iac.yaml:[2,18]"
                        ],
                        "name": "All capabilities should be dropped",
                        "policyId": "cca6bb6a-4e05-47a1-acaa-29f198799aa2",
                        "rule": "($.kind equals Pod and (spec.containers[?any(securityContext.capabilities.drop does not exist or securityContext.capabilities.drop[*] does not contain ALL)] exists or spec. initContainers[?any(securityContext.capabilities.drop does not exist or securityContext.capabilities.drop[*] does not contain ALL )] exists)) or ($.kind is member of (Deployment, Job, DaemonSet, ReplicaSet, ReplicationController, StatefulSet) and (spec.template.spec.containers[?any(securityContext.capabilities.drop does not exist or securityContext.capabilities.drop[*] does not contain ALL)] exists or spec. initContainers[?any(securityContext.capabilities.drop does not exist or securityContext.capabilities.drop[*] does not contain ALL)] exists))",
                        "severity": "high",
                        "systemDefault": false
                    },
                    "id": "cca6bb6a-4e05-47a1-acaa-29f198799aa2"
                }
            ]
        }
    }
}

Human Readable Output

Scan Results

Description ID Name Policy ID Severity
Ensure that all capabilities are dropped. cca6bb6a-4e05-47a1-acaa-29f198799aa2 All capabilities should be dropped cca6bb6a-4e05-47a1-acaa-29f198799aa2 high

Configuration parameters

  • url — Server URL (required)
  • credentials — Username (required)
  • customer — Customer name
  • isFetch — Fetch incidents
  • incidentType — Incident type
  • ruleName — Fetch only incidents matching this rule name
  • policyName — Fetch only incidents matching this policy name
  • policySeverity — Fetch only incidents with this severity
  • fetch_time — First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days, 3 months, 1 year)
  • proxy — Use system proxy settings
  • unsecure — Trust any certificate (not secure)

Commands (13)

  • redlock-dismiss-alerts

    Dismiss the alerts matching the given filter. Must provide either policy IDs or alert IDs.

  • redlock-get-alert-details

    Gets the details of an alert based on alert ID

  • redlock-get-remediation-details

    Gets remediation details for the given alert.

  • redlock-get-rql-response

    Returns the results of an RQL config query.

  • redlock-get-scan-results Deprecated

    Returns scan result details for the completed scan that has the specified scan ID

  • redlock-get-scan-status Deprecated

    Returns the status of the asynchronous IaC scan job that has the specified scan ID.

  • redlock-list-alert-filters

    List the acceptable filters and values for alerts

  • redlock-list-scans Deprecated

    Returns a list of IaC scans that meet the given conditions.

  • redlock-reopen-alerts

    Re-open the alerts matching the given filter. Must provide either policy IDs or alert IDs.

  • redlock-search-alerts

    Search alerts on the Prisma Cloud (RedLock) platform. If no time-range arguments are given, the search will filter only alerts from the last 7 days.

  • redlock-search-config

    Search configuration inventory on the Prisma Cloud (RedLock) platform using RQL language.

  • redlock-search-event

    Search events on the Prisma Cloud (RedLock) platform using RQL language.

  • redlock-search-network

    Search networks on the Prisma Cloud (RedLock) platform using RQL language.

Source

RedLock.py RedLock_test.py RedLock.yml RedLock_description.md command_examples.txt
Download History Raw 
category: Network Security
provider: Palo Alto Networks
deprecated: true
sectionorder:
- Connect
- Collect
commonfields:
  id: RedLock
  version: -1
configuration:
- defaultvalue: https://api.prismacloud.io/
  display: Server URL
  name: url
  required: true
  type: 0
  section: Connect
- display: Username
  name: credentials
  required: true
  type: 9
  section: Connect
- display: Customer name
  name: customer
  type: 0
  section: Connect
  advanced: true
  required: false
- display: Fetch incidents
  name: isFetch
  type: 8
  section: Collect
  required: false
- display: Incident type
  name: incidentType
  type: 13
  section: Connect
  required: false
- display: Fetch only incidents matching this rule name
  name: ruleName
  type: 0
  section: Collect
  advanced: true
  required: false
- display: Fetch only incidents matching this policy name
  name: policyName
  type: 0
  section: Collect
  advanced: true
  required: false
- display: Fetch only incidents with this severity
  name: policySeverity
  type: 0
  section: Collect
  advanced: true
  required: false
- defaultvalue: 7 days
  display: First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days, 3 months, 1 year)
  name: fetch_time
  type: 0
  section: Collect
  required: false
- display: Use system proxy settings
  name: proxy
  type: 8
  section: Connect
  advanced: true
  required: false
- display: Trust any certificate (not secure)
  name: unsecure
  type: 8
  section: Connect
  advanced: true
  required: false
description: Deprecated. Use the Prisma Cloud v2 integration instead.
display: Prisma Cloud (RedLock) (Deprecated)
name: RedLock
script:
  commands:
  - arguments:
    - description: The maximum number of records to return. '; limit search records to {}' is appended to every query where {} is the maximum number of records to return. If no value is provided, only 1 record is returned.
      name: limit
    - description: 'The RQL config query to run. Examples of RQL config queries can be found here: https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-rql-reference/rql-reference/config-query/config-query-examples.html. Note that ` limit search records to 1` is automatically appended to each query and a `;` may need to be added to the end of the rql input to make the entire query valid.  The limit parameter adjusts this to be a value other than 1.'
      name: rql
      required: true
    description: Returns the results of an RQL config query.
    name: redlock-get-rql-response
    outputs:
    - contextPath: Redlock.RQL.Query
      description: The RQL query that was run.
      type: String
    - contextPath: Redlock.RQL.Response.AccountId
      description: The cloud account ID.
      type: Date
    - contextPath: Redlock.RQL.Response.AccountName
      description: The cloud account name.
      type: String
    - contextPath: Redlock.RQL.Response.AllowDrillDown
      description: Flag to allow drill down.
      type: Boolean
    - contextPath: Redlock.RQL.Response.CloudType
      description: The cloud type.
      type: String
    - contextPath: Redlock.RQL.Response.Data
      description: The data object returned by the RQL response.
      type: Object
    - contextPath: Redlock.RQL.Response.Deleted
      description: Flag if deleted.
      type: Boolean
    - contextPath: Redlock.RQL.Response.HasAlert
      description: Flag to check if RQL response has alerts.
      type: Boolean
    - contextPath: Redlock.RQL.Response.HasExtFindingRiskFactors
      description: Flag if query returns external risk factors.
      type: Boolean
    - contextPath: Redlock.RQL.Response.HasExternalFinding
      description: Flag for external findings.
      type: Boolean
    - contextPath: Redlock.RQL.Response.HasExternalIntegration
      description: Flag for external integration.
      type: Boolean
    - contextPath: Redlock.RQL.Response.HasNetwork
      description: Flag for determining if network exists.
      type: Boolean
    - contextPath: Redlock.RQL.Response.Id
      description: The RQL response ID.
      type: String
    - contextPath: Redlock.RQL.Response.InsertTs
      description: The response time.
      type: Date
    - contextPath: Redlock.RQL.Response.Name
      description: The RQL response name.
      type: String
    - contextPath: Redlock.RQL.Response.RegionId
      description: The cloud region ID.
      type: String
    - contextPath: Redlock.RQL.Response.RegionName
      description: The cloud region name.
      type: String
    - contextPath: Redlock.RQL.Response.ResourceType
      description: The resource type.
      type: String
    - contextPath: Redlock.RQL.Response.Rrn
      description: The account RRN.
      type: String
    - contextPath: Redlock.RQL.Response.Service
      description: The RQL response service.
      type: String
    - contextPath: Redlock.RQL.Response.StateId
      description: The response state ID.
      type: String
  - arguments:
    - description: Start time for search in the following string format -  MM/DD/YYYY
      name: time-range-date-from
    - description: End time for search in the following format -  MM/DD/YYYY
      name: time-range-date-to
    - description: The amount of units to go back in time
      name: time-range-value
    - auto: PREDEFINED
      description: The search unit. login and epoch are only available if timeRangeValue is not provided.
      name: time-range-unit
      predefined:
      - hour
      - day
      - week
      - month
      - year
      - login
      - epoch
    - auto: PREDEFINED
      description: The policy name
      name: policy-name
      predefined:
      - IAM password policy does not have a symbol
      - IAM password policy does not expire in 90 days
      - IAM password policy does not have a lowercase character
      - IAM password policy does not have a minimum of 14 characters
      - IAM password policy allows password reuse
      - Default Security Group does not restrict all traffic
      - IAM password policy does not have password expiration period
      - IAM password policy does not exist
      - Access keys are not rotated for 90 days
      - Security Groups allow internet traffic from internet to RDP port (3389)
      - Internet connectivity via tcp over insecure port
      - IAM policy allow full administrative privileges
      - Primitive IAM roles should not be used
      - Internet exposed instances
      - IAM user has both Console access and Access Keys
      - S3 buckets are accessible to public
      - Access logging not enabled on all CloudTrail buckets
      - CloudTrail trail is not integrated with CloudWatch Log
      - Security Groups allow internet traffic to SSH port (22)
      - CloudTrail logs are not encrypted using Customer Master Keys (CMKs)
      - Excessive login failures
      - VPC endpoints were not used for consuming S3 storage from within the VPC
      - Access logging not enabled on S3 buckets
      - S3 buckets do not have server side encryption
      - Account hijacking attempts
      - Security groups allow internet traffic
      - VPC subnets should not allow automatic public IP assignment
      - VPC Flow Logs not enabled
      - MFA not enabled for IAM users
      - Inactive users for more than 30 days
    - description: The policy label
      name: policy-label
    - description: The number of alerts to return
      name: limit
    - description: The policy compliance standard
      name: policy-compliance-standard
    - description: The cloud account ID.
      name: cloud-account-id
    - description: The cloud account name.
      name: cloud-account
    - description: The cloud region name.
      name: cloud-region
    - description: The alert rule name.
      name: alert-rule-name
    - description: The resource ID
      name: resource-id
    - description: The resource name
      name: resource-name
    - description: The resource type
      name: resource-type
    - auto: PREDEFINED
      defaultValue: open
      description: The alert status
      name: alert-status
      predefined:
      - open
      - resolved
      - dismissed
    - description: The alert ID
      name: alert-id
    - auto: PREDEFINED
      description: The cloud type
      name: cloud-type
      predefined:
      - aws
      - azure
      - gcp
    - auto: PREDEFINED
      description: The risk grade
      name: risk-grade
      predefined:
      - A
      - B
      - C
      - F
    - auto: PREDEFINED
      description: The policy type
      name: policy-type
      predefined:
      - anomaly
      - audit_event
      - config
      - network
    - auto: PREDEFINED
      description: The policy severity
      name: policy-severity
      predefined:
      - high
      - medium
      - low
    description: Search alerts on the Prisma Cloud (RedLock) platform. If no time-range arguments are given, the search will filter only alerts from the last 7 days.
    name: redlock-search-alerts
    outputs:
    - contextPath: Redlock.Alert.ID
      description: The ID of the returned alert.
      type: string
    - contextPath: Redlock.Alert.Status
      description: The status of the returned alert.
      type: string
    - contextPath: Redlock.Alert.AlertTime
      description: The time of the returned alert.
      type: string
    - contextPath: Redlock.Alert.Policy.ID
      description: The policy ID of the returned alert.
      type: string
    - contextPath: Redlock.Alert.Policy.Name
      description: The policy name of the returned alert.
      type: string
    - contextPath: Redlock.Alert.Policy.Type
      description: The policy type of the returned alert.
      type: string
    - contextPath: Redlock.Alert.Policy.Severity
      description: The policy severity of the returned alert.
      type: string
    - contextPath: Redlock.Alert.Policy.Remediable
      description: Whether or not the policy is remediable.
      type: boolean
    - contextPath: Redlock.Alert.RiskDetail.Rating
      description: The risk rating of the returned alert.
      type: string
    - contextPath: Redlock.Alert.RiskDetail.Score
      description: The risk score of the returned alert.
      type: string
    - contextPath: Redlock.Metadata.CountOfAlerts
      description: The number of alerts found.
      type: number
  - arguments:
    - default: true
      description: The alert ID
      name: alert-id
      required: true
    - description: Start time for search in the following string format -  MM/DD/YYYY, Should be provided along with time-range-date-to. If not both are provided, the time range will be set to the last 7 days and this argument will be ignored.
      name: time-range-date-from
    - description: End time for search in the following format -  MM/DD/YYYY, Should be provided along with time-range-date-from. If not both are provided, the time range will be set to the last 7 days and this argument will be ignored.
      name: time-range-date-to
    - auto: PREDEFINED
      defaultValue: 'true'
      description: Allows for retrieving entire / trimmed alert model
      name: detailed
      predefined:
      - 'true'
      - 'false'
    - description: List of additional keys to return from the resource JSON, specified as a comma separated list (e.g. "key1,key2,key3").  To preview all available resource JSON data, run redlock-get-alert-details with the "raw-response=true" option.
      name: resource_keys
    description: Gets the details of an alert based on alert ID
    name: redlock-get-alert-details
    outputs:
    - contextPath: Redlock.Alert.ID
      description: The alert ID
      type: string
    - contextPath: Redlock.Alert.Status
      description: The alert status
      type: string
    - contextPath: Redlock.Alert.AlertTime
      description: The time of the alert
      type: date
    - contextPath: Redlock.Alert.AlertRules
      description: Names of the alert rules that triggered this alert.
      type: string
    - contextPath: Redlock.Alert.Policy.ID
      description: The policy ID
      type: string
    - contextPath: Redlock.Alert.Policy.Name
      description: The policy name
      type: string
    - contextPath: Redlock.Alert.Policy.Type
      description: The type of policy
      type: string
    - contextPath: Redlock.Alert.Policy.Severity
      description: The policy severity
      type: string
    - contextPath: Redlock.Alert.Policy.Remediable
      description: Whether or not the policy is remediable
      type: boolean
    - contextPath: Redlock.Alert.RiskDetail.Rating
      description: The risk rating
      type: string
    - contextPath: Redlock.Alert.RiskDetail.Score
      description: The risk score
      type: string
    - contextPath: Redlock.Alert.Resource.AccountID
      description: The cloud account ID where the resource resides
      type: string
    - contextPath: Redlock.Alert.Resource.ID
      description: The Resource ID of the cloud resource
      type: string
    - contextPath: Redlock.Alert.Resource.Name
      description: The Resource Name of the cloud resource
      type: string
    - contextPath: Redlock.Alert.Resource.Data
      description: Additional keys from Resource.Data. Only appears when resource_keys argument is specified.
      type: json
    - contextPath: Redlock.Alert.Resource.Account
      description: The cloud account name where the resource resides
      type: string
  - arguments:
    - description: Comma-separated list of string IDs to be dismissed.
      name: alert-id
    - description: The amount of time to snooze. Both snooze value and unit must be specified.
      name: snooze-value
    - auto: PREDEFINED
      description: The time unit for if snoozing alert.  Both snooze value and unit must be specified if snoozing.
      name: snooze-unit
      predefined:
      - hour
      - day
      - week
      - month
      - year
      - epoch
    - description: Reason for dismissal.
      name: dismissal-note
      required: true
    - description: Start time for search in the following string format -  MM/DD/YYYY
      name: time-range-date-from
    - description: End time for search in the following format -  MM/DD/YYYY
      name: time-range-date-to
    - description: The amount of units to go back in time
      name: time-range-value
    - auto: PREDEFINED
      description: The search unit
      name: time-range-unit
      predefined:
      - hour
      - day
      - week
      - month
      - year
      - login
      - epoch
    - auto: PREDEFINED
      description: The policy name
      name: policy-name
      predefined:
      - IAM password policy does not have a symbol
      - IAM password policy does not expire in 90 days
      - IAM password policy does not have a lowercase character
      - IAM password policy does not have a minimum of 14 characters
      - IAM password policy allows password reuse
      - Default Security Group does not restrict all traffic
      - IAM password policy does not have password expiration period
      - IAM password policy does not exist
      - Access keys are not rotated for 90 days
      - Security Groups allow internet traffic from internet to RDP port (3389)
      - Internet connectivity via tcp over insecure port
      - IAM policy allow full administrative privileges
      - Primitive IAM roles should not be used
      - Internet exposed instances
      - IAM user has both Console access and Access Keys
      - S3 buckets are accessible to public
      - Access logging not enabled on all CloudTrail buckets
      - CloudTrail trail is not integrated with CloudWatch Log
      - Security Groups allow internet traffic to SSH port (22)
      - CloudTrail logs are not encrypted using Customer Master Keys (CMKs)
      - Excessive login failures
      - VPC endpoints were not used for consuming S3 storage from within the VPC
      - Access logging not enabled on S3 buckets
      - S3 buckets do not have server side encryption
      - Account hijacking attempts
      - Security groups allow internet traffic
      - VPC subnets should not allow automatic public IP assignment
      - VPC Flow Logs not enabled
      - MFA not enabled for IAM users
      - Inactive users for more than 30 days
    - description: The policy label
      name: policy-label
    - description: The policy compliance standard
      name: policy-compliance-standard
    - description: The cloud account
      name: cloud-account
    - description: The cloud region
      name: cloud-region
    - description: The alert rule name
      name: alert-rule-name
    - description: The resource ID
      name: resource-id
    - description: The resource name
      name: resource-name
    - description: The resource type
      name: resource-type
    - auto: PREDEFINED
      description: The alert status
      name: alert-status
      predefined:
      - open
      - resolved
      - dismissed
    - auto: PREDEFINED
      description: The cloud type
      name: cloud-type
      predefined:
      - aws
      - azure
      - gcp
    - auto: PREDEFINED
      description: The risk grade
      name: risk-grade
      predefined:
      - A
      - B
      - C
      - F
    - auto: PREDEFINED
      description: The policy type
      name: policy-type
      predefined:
      - anomaly
      - audit_event
      - config
      - network
    - auto: PREDEFINED
      description: The policy severity
      name: policy-severity
      predefined:
      - high
      - medium
      - low
    - description: Comma-separated string of policy IDs.
      name: policy-id
    description: Dismiss the alerts matching the given filter. Must provide either policy IDs or alert IDs.
    execution: true
    name: redlock-dismiss-alerts
    outputs:
    - contextPath: Redlock.DismissedAlert.ID
      description: The IDs of the dismissed alerts
      type: string
  - arguments:
    - description: The IDs of alerts to reopen
      name: alert-id
    - description: Start time for search in the following string format -  MM/DD/YYYY
      name: time-range-date-from
    - description: End time for search in the following format -  MM/DD/YYYY
      name: time-range-date-to
    - description: The amount of units to go back in time
      name: time-range-value
    - auto: PREDEFINED
      description: The search unit
      name: time-range-unit
      predefined:
      - hour
      - day
      - week
      - month
      - year
      - login
      - epoch
    - auto: PREDEFINED
      description: The policy name
      name: policy-name
      predefined:
      - IAM password policy does not have a symbol
      - IAM password policy does not expire in 90 days
      - IAM password policy does not have a lowercase character
      - IAM password policy does not have a minimum of 14 characters
      - IAM password policy allows password reuse
      - Default Security Group does not restrict all traffic
      - IAM password policy does not have password expiration period
      - IAM password policy does not exist
      - Access keys are not rotated for 90 days
      - Security Groups allow internet traffic from internet to RDP port (3389)
      - Internet connectivity via tcp over insecure port
      - IAM policy allow full administrative privileges
      - Primitive IAM roles should not be used
      - Internet exposed instances
      - IAM user has both Console access and Access Keys
      - S3 buckets are accessible to public
      - Access logging not enabled on all CloudTrail buckets
      - CloudTrail trail is not integrated with CloudWatch Log
      - Security Groups allow internet traffic to SSH port (22)
      - CloudTrail logs are not encrypted using Customer Master Keys (CMKs)
      - Excessive login failures
      - VPC endpoints were not used for consuming S3 storage from within the VPC
      - Access logging not enabled on S3 buckets
      - S3 buckets do not have server side encryption
      - Account hijacking attempts
      - Security groups allow internet traffic
      - VPC subnets should not allow automatic public IP assignment
      - VPC Flow Logs not enabled
      - MFA not enabled for IAM users
      - Inactive users for more than 30 days
    - description: The policy label
      name: policy-label
    - description: The policy compliance standard
      name: policy-compliance-standard
    - description: The cloud account
      name: cloud-account
    - description: The cloud region
      name: cloud-region
    - description: The alert rule name
      name: alert-rule-name
    - description: The resource ID
      name: resource-id
    - description: The resource name
      name: resource-name
    - description: The resource type
      name: resource-type
    - auto: PREDEFINED
      description: The alert status
      name: alert-status
      predefined:
      - open
      - resolved
      - dismissed
    - auto: PREDEFINED
      description: The cloud type
      name: cloud-type
      predefined:
      - aws
      - azure
      - gcp
    - auto: PREDEFINED
      description: The risk grade
      name: risk-grade
      predefined:
      - A
      - B
      - C
      - F
    - auto: PREDEFINED
      description: The policy type
      name: policy-type
      predefined:
      - anomaly
      - audit_event
      - config
      - network
    - auto: PREDEFINED
      description: The policy severity
      name: policy-severity
      predefined:
      - high
      - medium
      - low
    description: Re-open the alerts matching the given filter.  Must provide either policy IDs or alert IDs.
    execution: true
    name: redlock-reopen-alerts
    outputs:
    - contextPath: Redlock.ReopenedAlert.ID
      description: IDs of the re-opened alerts
      type: string
  - description: List the acceptable filters and values for alerts
    name: redlock-list-alert-filters
  - arguments:
    - description: The alert ID for which to get remediation details.
      name: alert-id
    description: Gets remediation details for the given alert.
    name: redlock-get-remediation-details
    outputs:
    - contextPath: Redlock.Alert.Remediation.Description
      description: Description of CLI remediation instructions.
      type: string
    - contextPath: Redlock.Alert.ID
      description: The ID of the alert to which the remediation details apply.
      type: string
    - contextPath: Redlock.Alert.Remediation.CLI
      description: The exact CLI command string.
      type: string
  - arguments:
    - description: Start time for the search, in the following string format -  MM/DD/YYYY
      name: time-range-date-from
    - description: End time for the search, in the following format -  MM/DD/YYYY
      name: time-range-date-to
    - description: The number of time range value units for the search. For example, 3 days, 5 weeks, etc.
      name: time-range-value
    - auto: PREDEFINED
      description: |-
        The search unit. Possible values are: "hour", "week", "month", "year", "login", or "epoch". The "login" and "epoch" options are only available if timeRangeValue
        is not provided.
      name: time-range-unit
      predefined:
      - hour
      - day
      - week
      - month
      - year
      - login
      - epoch
    - description: Query to run in Prisma Cloud config API using RQL language.
      name: query
      required: true
    - defaultValue: '100'
      description: Maximum number of entries to return.
      name: limit
    description: Search configuration inventory on the Prisma Cloud (RedLock) platform using RQL language.
    name: redlock-search-config
    outputs:
    - contextPath: Redlock.Asset.accountId
      description: Cloud Account ID
      type: Date
    - contextPath: Redlock.Asset.accountName
      description: Cloud Account Name
      type: String
    - contextPath: Redlock.Asset.allowDrillDown
      description: Flag to allow drill down.
      type: Boolean
    - contextPath: Redlock.Asset.cloudType
      description: Cloud Type
      type: String
    - contextPath: Redlock.Asset.deleted
      description: Asset was deleted?
      type: Boolean
    - contextPath: Redlock.Asset.hasAlert
      description: Asset has Prisma Cloud alert?
      type: Boolean
    - contextPath: Redlock.Asset.hasExtFindingRiskFactors
      description: Has External Finding Risk Factors?
      type: Boolean
    - contextPath: Redlock.Asset.hasExternalFinding
      description: Has External Finding?
      type: Boolean
    - contextPath: Redlock.Asset.hasExternalIntegration
      description: Has External Integration?
      type: Boolean
    - contextPath: Redlock.Asset.hasNetwork
      description: Has Network?
      type: Boolean
    - contextPath: Redlock.Asset.id
      description: Redlock Asset ID
      type: String
    - contextPath: Redlock.Asset.data
      description: Redlock Asset specific data
      type: Unknown
    - contextPath: Redlock.Asset.insertTs
      description: Insert Ts
      type: Date
    - contextPath: Redlock.Asset.name
      description: Asset Name
      type: String
    - contextPath: Redlock.Asset.regionId
      description: Cloud Region ID
      type: String
    - contextPath: Redlock.Asset.regionName
      description: Cloud Region Name
      type: String
    - contextPath: Redlock.Asset.resourceType
      description: Cloud Resource type
      type: String
    - contextPath: Redlock.Asset.rrn
      description: Cloud RRN
      type: String
    - contextPath: Redlock.Asset.service
      description: Cloud service
      type: String
    - contextPath: Redlock.Asset.stateId
      description: State ID
      type: String
  - arguments:
    - description: Start time for the search, in the following format -  MM/DD/YYYY.
      name: time-range-date-from
    - description: End time for the search, in the following format -  MM/DD/YYYY.
      name: time-range-date-to
    - description: The number of time range value units for the search. For example, 3 days, 5 weeks, etc.
      name: time-range-value
    - auto: PREDEFINED
      description: |-
        The search unit. Possible values are: "hour", "week", "month", "year", "login", or "epoch". The "login" and "epoch" options are only available if timeRangeValue
        is not provided.
      name: time-range-unit
      predefined:
      - hour
      - day
      - week
      - month
      - year
      - login
      - epoch
    - description: Query to run in Prisma Cloud search API using RQL language.
      name: query
      required: true
    - defaultValue: '100'
      description: Maximum number of entries to return.
      name: limit
    description: Search events on the Prisma Cloud (RedLock) platform using RQL language.
    name: redlock-search-event
    outputs:
    - contextPath: Redlock.Event
      description: Cloud audit events.
      type: Unknown
  - arguments:
    - description: Start time for the search, in the following format -  MM/DD/YYYY.
      name: time-range-date-from
    - description: End time for the search, in the following format -  MM/DD/YYYY.
      name: time-range-date-to
    - description: The number of time range value units for the search. For example, 3 days, 5 weeks, etc.
      name: time-range-value
    - auto: PREDEFINED
      description: |-
        The search unit. Possible values are: "hour", "week", "month", "year", "login", or "epoch". The "login" and "epoch" options are only available if timeRangeValue
        is not provided.
      name: time-range-unit
      predefined:
      - hour
      - day
      - week
      - month
      - year
      - login
      - epoch
    - description: Query to run in Prisma Cloud search API using RQL language.
      name: query
      required: true
    - auto: PREDEFINED
      description: The cloud in which the network should be searched.
      name: cloud-type
      predefined:
      - aws
      - azure
      - gcp
      - alibaba_cloud
      - oci
    description: Search networks on the Prisma Cloud (RedLock) platform using RQL language.
    name: redlock-search-network
    outputs:
    - contextPath: Redlock.Network.Node
      description: Cloud network node.
      type: Unknown
    - contextPath: Redlock.Network.Connection
      description: Cloud network connection.
      type: Unknown
  - arguments:
    - auto: PREDEFINED
      defaultValue: scanId
      description: Group by which to aggregate scan results.
      name: group_by
      predefined:
      - scanId
      - ' assetType'
      - assetName
      - resourceList
    - defaultValue: '25'
      description: Pagination size.
      name: page_size
    - defaultValue: '1'
      description: Pagination number.
      name: page_number
    - description: Sorting parameters. The sort order is ascending unless the field is prefixed with minus (-), in which case it is descending.
      name: sort
    - auto: PREDEFINED
      defaultValue: relative
      description: Time filter type.
      name: filter_type
      predefined:
      - to_now
      - absolute
      - relative
    - defaultValue: '1'
      description: Number of time units.
      name: filter_time_amount
    - auto: PREDEFINED
      defaultValue: day
      description: The time unit for retrieving the list of IaC scans.
      name: to_now_time_unit
      predefined:
      - epoch
      - login
      - year
    - description: 'Start time, for example: 11/01/2021 10:10:10.'
      name: filter_start_time
    - description: End time in Unix time (the number of seconds that have elapsed since the Unix epoch) for the absolute time type.
      name: filter_end_time
    - description: Asset type to search with.
      name: filter_asset_type
    - description: Asset name to search with.
      name: filter_asset_name
    - description: 'User to filter with, example: ayman@example.domain'
      name: filter_user
    - auto: PREDEFINED
      description: 'Status to filter with, example: passed'
      name: filter_status
      predefined:
      - passed
      - failed
      - processing
      - errored
      - failed_n_merged
      - failed_n_deployed
    - auto: PREDEFINED
      defaultValue: login
      description: Relative Time unit
      name: relative_time_unit
      predefined:
      - hour
      - day
      - week
      - month
      - year
    deprecated: true
    description: Returns a list of IaC scans that meet the given conditions.
    name: redlock-list-scans
    outputs:
    - contextPath: Redlock.Scans.deployed
      description: Scan deployed attribute.
      type: Boolean
    - contextPath: Redlock.Scans.fail
      description: Scan fail attribute.
      type: Number
    - contextPath: Redlock.Scans.failureCriteria
      description: Scan failure criteria attribute.
      type: String
    - contextPath: Redlock.Scans.matchedPoliciesSummary.high
      description: Scan matched policies summary attribute.
      type: Number
    - contextPath: Redlock.Scans.matchedPoliciesSummary.low
      description: Scan matched low policies summary attribute.
      type: Number
    - contextPath: Redlock.Scans.matchedPoliciesSummary.medium
      description: Scan matched medium policies summary attribute.
      type: Number
    - contextPath: Redlock.Scans.merged
      description: Scan merged attribute.
      type: Boolean
    - contextPath: Redlock.Scans.name
      description: Scan name attribute.
      type: String
    - contextPath: Redlock.Scans.pass
      description: Scan pass attribute.
      type: Number
    - contextPath: Redlock.Scans.scanAttributes.appliedAlertRules
      description: Scan applied alert rules attribute.
      type: String
    - contextPath: Redlock.Scans.scanAttributes.branch
      description: Scan Scan branch attribute.
      type: String
    - contextPath: Redlock.Scans.scanAttributes.org
      description: Scan org attribute.
      type: String
    - contextPath: Redlock.Scans.scanAttributes.pullRequestId
      description: Scan PR ID attribute.
      type: String
    - contextPath: Redlock.Scans.scanAttributes.repository
      description: Scan repository attribute.
      type: String
    - contextPath: Redlock.Scans.scanAttributes.resourcesScanned
      description: Scan resources scanned attribute.
      type: String
    - contextPath: Redlock.Scans.scanAttributes.templateType
      description: Scan template type attribute.
      type: String
    - contextPath: Redlock.Scans.scanAttributes.triggeredOn
      description: Scan triggered on attribute.
      type: String
    - contextPath: Redlock.Scans.scanAttributes.userId
      description: Scan user id attribute.
      type: String
    - contextPath: Redlock.Scans.scanTime
      description: Scan scan time attribute.
      type: Date
    - contextPath: Redlock.Scans.status
      description: Scan status attribute.
      type: String
    - contextPath: Redlock.Scans.tags.name
      description: Scan tags name attribute.
      type: String
    - contextPath: Redlock.Scans.tags.value
      description: Scan tags value attribute.
      type: String
    - contextPath: Redlock.Scans.type
      description: Scan type attribute.
      type: String
    - contextPath: Redlock.Scans.user
      description: Scan user attribute.
      type: List
    - contextPath: Redlock.Scans.id
      description: Scan id.
      type: String
    - contextPath: Redlock.Scans.links.self
      description: Scan links.
      type: String
    - contextPath: Redlock.Scans.relationships.scanResult.links.related
      description: Scan relationships scan result links .
      type: String
  - arguments:
    - description: The scan ID. The scan ID can be retrieved by the redlock-list-scans command.
      name: scan_id
      required: true
    deprecated: true
    description: Returns the status of the asynchronous IaC scan job that has the specified scan ID.
    name: redlock-get-scan-status
    outputs:
    - contextPath: Redlock.Scans.id
      description: Scan ID
      type: String
    - contextPath: Redlock.Scans.status
      description: Scan status
      type: String
  - arguments:
    - description: The scan ID. Scan Id can be retrieved by the redlock-list-scans command.
      name: scan_id
      required: true
    deprecated: true
    description: Returns scan result details for the completed scan that has the specified scan ID
    name: redlock-get-scan-results
    outputs:
    - contextPath: Redlock.Scans.id
      description: Scan ID
      type: String
    - contextPath: Redlock.Scans.results.attributes.blameList.file
      description: Scan results blame list file
      type: String
    - contextPath: Redlock.Scans.results.attributes.blameList.locations.line
      description: Scan results blame list locations line
      type: Number
    - contextPath: Redlock.Scans.results.attributes.blameList.locations.path
      description: Scan results blame list locations path
      type: String
    - contextPath: Redlock.Scans.results.attributes.desc
      description: Scan results description
      type: String
    - contextPath: Redlock.Scans.results.attributes.docUrl
      description: Scan results doc URL
      type: String
    - contextPath: Redlock.Scans.results.attributes.files
      description: Scan results files
      type: String
    - contextPath: Redlock.Scans.results.attributes.name
      description: Scan results name
      type: String
    - contextPath: Redlock.Scans.results.attributes.policyId
      description: Scan results policy ID
      type: String
    - contextPath: Redlock.Scans.results.attributes.rule
      description: Scan results rule
      type: String
    - contextPath: Redlock.Scans.results.attributes.severity
      description: Scan results severity
      type: String
    - contextPath: Redlock.Scans.results.attributes.systemDefault
      description: Scan results system default
      type: Boolean
    - contextPath: Redlock.Scans.results.id
      description: Scan results ID
      type: String
  dockerimage: demisto/python3:3.10.10.49934
  isfetch: true
  runonce: false
  script: '-'
  subtype: python3
  type: python
tests:
- RedLockTest
defaultmapperin: RedLock-mapper
defaultclassifier: RedLock
fromversion: 5.0.0