PrismaCloud v2

Prisma Cloud secures infrastructure, workloads and applications, across the entire cloud-native technology stack.

Category

Network Security

Pack

PrismaCloud

Configuration parameters

• url — Server URL (required)
• credentials — Username / Access Key ID (required)
• proxy — Use system proxy settings
• insecure — Trust any certificate (not secure)
• incidentType — Incident type
• incidentFetchInterval — Incidents Fetch Interval
• max_fetch — Maximum number of incidents to fetch
• first_fetch — First fetch time interval
• look_back — Advanced: Time in minutes to look back when fetching incidents
• filters — Fetch only incidents matching these filters
• isFetch — Fetch incidents
• mirror_direction — Incident Mirroring Direction
• close_incident — Close Mirrored XSOAR Incident
• close_alert — Close Mirrored Prisma Cloud Alert
• output_old_format — Output results of V1 commands to the context data in the old format

Commands (47)

• get-modified-remote-data — Get the list of incidents that were modified since the last update time. This method is used for debugging purposes. The get-modified-remote-data command is used as part of the Mirroring feature that was introduced in Cortex XSOAR version 6.1.
• get-remote-data — Get remote data from a remote incident. This method does not update the current incident, and should be used for debugging purposes only.
• prisma-cloud-access-key-create — Adds a new access key for the current user. If you have API access, you can create up to two access keys.
• prisma-cloud-access-key-delete — Deletes the access key that has the specified ID.
• prisma-cloud-access-key-disable — Deactivates the access key that has the specified ID.
• prisma-cloud-access-key-enable — Activates the access key that has the specified ID. You cannot activate an expired access key.
• prisma-cloud-access-keys-list — Returns all access keys for your tenant if you have a Prisma Cloud System Admin role. Returns just your access keys if you don't have this role.
• prisma-cloud-account-list — List accounts.
• prisma-cloud-account-owner-list — Get the owners of the provided accounts.
• prisma-cloud-account-status-get — Get the statuses of the provided accounts.
• prisma-cloud-alert-dismiss — Dismiss or snooze the alerts matching the given filter. Either policy IDs or alert IDs must be provided. When no absolute time nor relative time arguments are provided, the default time range is all times. For snoozing, provide "snooze_unit" and "snooze_value" arguments.
• prisma-cloud-alert-filter-list — List the acceptable filters and values for alerts.
• prisma-cloud-alert-get-details — Gets the details of an alert based on the alert ID.
• prisma-cloud-alert-remediate — Remediates the alert with the specified ID, if that alert is associated with a remediable policy. In order to check what remediation would run, use the "prisma-cloud-remediation-command-list" command first.
• prisma-cloud-alert-reopen — Re-open the alerts matching the given filter. Either policy IDs or alert IDs must be provided. When no absolute time nor relative time arguments are provided, the default time range is all times.
• prisma-cloud-alert-search — Search alerts on the Prisma Cloud platform. When no absolute time nor relative time arguments are provided, the search will show alerts from the last 7 days.
• prisma-cloud-asset-alerts-get — Returns detailed information for the asset alerts with the given ID.
• prisma-cloud-asset-findings-get — Returns detailed information for the asset findings with the given ID.
• prisma-cloud-asset-generic-get — Returns detailed information for the asset with the given ID.
• prisma-cloud-asset-get — Returns detailed information for the asset with the given ID.
• prisma-cloud-asset-network-get — Returns detailed information for the asset network with the given ID.
• prisma-cloud-asset-relationships-get — Returns detailed information for the asset relationships with the given ID.
• prisma-cloud-asset-vulnerabilities-get — Returns detailed information for the asset vulnerabilities with the given ID.
• prisma-cloud-code-issues-list — Retrieves the code errors detected by Application Security during periodic scans. At least one filtering argument is required, excluding `search_scopes`, `search_term`, and `limit`. For example, `fixable_only` or 'branch`.
• prisma-cloud-config-search — Search configuration inventory on the Prisma Cloud platform using RQL language. Use this command for all queries that start with "config". When no absolute time nor relative time arguments are provided, the default time range is all times.
• prisma-cloud-error-file-list — This command is deprecated. Use prisma-cloud-code-issues-list instead.
• prisma-cloud-event-search — Search events inventory on the Prisma Cloud platform using RQL language. Use this command for all queries that start with "event". When no absolute time nor relative time arguments are provided, the default time range is all times. In order to reduce the returned data, set the "include_resource_json" argument to "false".
• prisma-cloud-host-finding-list — Get resource host finding list.
• prisma-cloud-network-search — Search networks inventory on the Prisma Cloud platform using RQL language. Use this command for all queries that start with "networks". When no absolute time nor relative time arguments are provided, the default time range is all times. In order to limit the results returning, use "limit search records to" at the end of the RQL query, followed by a value from one of these options: 1, 10, 100, 1000, and 10,000.
• prisma-cloud-permission-list — Get permission list. You must provide either "query" or "next_token".
• prisma-cloud-remediation-command-list — Generates and returns a list of remediation commands for the specified alerts and policies. Data returned for a successful call include fully constructed commands for remediation. Either a policy ID or alert IDs must be provided. The returned information can be retrieved in the UI by clicking the "Remediate" button under the "Actions" column for supported alerts. When no absolute time nor relative time arguments are provided, the default time range is all times.
• prisma-cloud-resource-get — Get resource details.
• prisma-cloud-resource-list — Returns all the resource lists. Maps to the Resource Lists under Settings > Resource Lists in the Console UI.
• prisma-cloud-trigger-scan — Trigger asynchronous scan of all resources to refresh the current state at Prisma Cloud Code Security. In order to use this command, the "Code Security" module needs to be enabled and accessible in the Prisma Cloud UI.
• prisma-cloud-user-roles-list — Retrieves user roles. Maps to Settings > Access Control > Roles in the Console UI.
• prisma-cloud-users-list — Lists all users and service accounts for your tenant. Maps to Settings > Access Control > Users in the Console UI.
• redlock-dismiss-alerts — Dismiss the alerts matching the given filter. Must provide either policy IDs or alert IDs.
• redlock-get-alert-details — Gets the details of an alert based on the alert ID.
• redlock-get-remediation-details — Gets remediation details for the given alert.
• redlock-get-rql-response — Returns the results of an RQL config query.
• redlock-list-alert-filters — List the acceptable filters and values for alerts.
• redlock-reopen-alerts — Re-open the alerts matching the given filter. Must provide either policy IDs or alert IDs.
• redlock-search-alerts — Search alerts on the Prisma Cloud platform. If no time-range arguments are given, the search will filter only alerts from the last 7 days.
• redlock-search-config — Search the configuration inventory on the Prisma Cloud platform using RQL language.
• redlock-search-event — Search events on the Prisma Cloud platform using RQL language.
• redlock-search-network — Search networks on the Prisma Cloud platform using RQL language.
• update-remote-system — Updates the remote incident with local incident changes. This method is only used for debugging purposes and will not update the current incident.