Prisma Cloud by Palo Alto Networks (v4.4.35)
Automate and unify security incident response across your cloud environments, while still giving a degree of control to dedicated cloud teams.
- Author
- Cortex XSOAR
- Support
- xsoar
- URL
- https://www.paloaltonetworks.com/cortex
- Categories
- Cloud Security
Automation Rules (11)
- AWS CloudTrail Misconfiguration
- AWS EC2 Instance Misconfiguration
- AWS IAM Policy Misconfiguration
- Azure AKS Misconfiguration
- Azure Network Misconfiguration
- Azure SQL Misconfiguration
- Azure Storage Misconfiguration
- GCP Compute Engine Misconfiguration
- GCP Kubernetes Engine Misconfiguration
- Prisma Cloud - VM Alert Prioritization
- Prisma Cloud Network API and Anomaly alerts
Incident fields (22)
- Prisma Cloud - Findings Results
- Prisma Cloud - IAM Results
- Prisma Cloud Dismissal Note
- Prisma Cloud ID
- Prisma Cloud Reason
- Prisma Cloud Rules
- Prisma Cloud Status
- Prisma Cloud Time
- RRN
- Resource API Name
- Resource Cloud Type
- Subscription Assigned By
- Subscription Created By
- Subscription Created On
- Subscription Description
- Subscription ID
- Subscription Name
- Subscription Type
- Subscription Updated By
- Subscription Updated On
- System Default
- VPC ID
Integrations (3)
- PrismaCloud IAM
- Prisma Cloud v2
- Prisma Cloud (RedLock) (Deprecated)
Layout rules (2)
- Prisma Cloud Network API and Anomaly
- Prisma Cloud V2 Layout Rule
Layouts (13)
- AWS CloudTrail Misconfiguration Incident
- AWS EC2 Instance Misconfiguration Incident
- AWS IAM Policy Misconfiguration Incident
- Azure AKS Misconfiguration Incident
- Azure Network Misconfiguration Incident
- Azure SQL Misconfiguration Incident
- Azure Storage Misconfiguration
- GCP Compute Engine Misconfiguration Incident
- GCP Kubernetes Engine Misconfiguration
- Prisma Cloud - Network API and Anomaly Incident Layout
- Prisma Cloud - VM Alert Prioritization
- Prisma Cloud Incident
- Prisma Cloud V2
Modeling rules (1)
- Palo Alto Prisma Cloud Modeling Rule
Parsing rules (1)
- Palo Alto Prisma Cloud Parsing Rule
Playbooks (55)
- Prisma Cloud - Find AWS Resource by FQDN
- Prisma Cloud - Find AWS Resource by FQDN v2
- Prisma Cloud - Find AWS Resource by Public IP
- Prisma Cloud - Find AWS Resource by Public IP v2
- Prisma Cloud - Find Azure Resource by FQDN
- Prisma Cloud - Find Azure Resource by FQDN v2
- Prisma Cloud - Find Azure Resource by Public IP
- Prisma Cloud - Find Azure Resource by Public IP v2
- Prisma Cloud - Find GCP Resource by FQDN
- Prisma Cloud - Find GCP Resource by FQDN v2
- Prisma Cloud - Find GCP Resource by Public IP
- Prisma Cloud - Find GCP Resource by Public IP v2
- Prisma Cloud - Find Public Cloud Resource by FQDN
- Prisma Cloud - Find Public Cloud Resource by Public IP
- Prisma Cloud - Find Public Cloud Resource by Public IP v2
- Prisma Cloud - Network API and Anomaly Incidents
- Prisma Cloud - VM Alert Prioritization
- Prisma Cloud Correlate Alerts
- Prisma Cloud Correlate Alerts v2
- Prisma Cloud Remediation - AWS CloudTrail Is Not Integrated With CloudWatch Logs
- Prisma Cloud Remediation - AWS CloudTrail Misconfiguration
- Prisma Cloud Remediation - AWS CloudTrail Misconfiguration v2
- Prisma Cloud Remediation - AWS CloudTrail Trail Misconfiguration
- Prisma Cloud Remediation - AWS CloudTrail is not Enabled on the Account
- Prisma Cloud Remediation - AWS EC2 Instance Misconfiguration
- Prisma Cloud Remediation - AWS EC2 Instance Misconfiguration v2
- Prisma Cloud Remediation - AWS EC2 Security Group Misconfiguration
- Prisma Cloud Remediation - AWS IAM Password Policy Misconfiguration
- Prisma Cloud Remediation - AWS IAM Policy Misconfiguration
- Prisma Cloud Remediation - AWS IAM Policy Misconfiguration v2
- Prisma Cloud Remediation - AWS IAM User Policy Misconfiguration
- Prisma Cloud Remediation - AWS Inactive Users For More Than 30 Days
- Prisma Cloud Remediation - AWS Security Groups Allows Internet Traffic To TCP Port
- Prisma Cloud Remediation - Azure AKS Cluster Misconfiguration
- Prisma Cloud Remediation - Azure AKS Misconfiguration
- Prisma Cloud Remediation - Azure AKS Misconfiguration v2
- Prisma Cloud Remediation - Azure Network Misconfiguration
- Prisma Cloud Remediation - Azure Network Misconfiguration v2
- Prisma Cloud Remediation - Azure Network Security Group Misconfiguration
- Prisma Cloud Remediation - Azure SQL Database Misconfiguration
- Prisma Cloud Remediation - Azure SQL Misconfiguration
- Prisma Cloud Remediation - Azure SQL Misconfiguration v2
- Prisma Cloud Remediation - Azure Storage Blob Misconfiguration
- Prisma Cloud Remediation - Azure Storage Misconfiguration
- Prisma Cloud Remediation - Azure Storage Misconfiguration v2
- Prisma Cloud Remediation - GCP Compute Engine Instance Misconfiguration
- Prisma Cloud Remediation - GCP Compute Engine Misconfiguration
- Prisma Cloud Remediation - GCP Compute Engine Misconfiguration v2
- Prisma Cloud Remediation - GCP Kubernetes Engine Cluster Misconfiguration
- Prisma Cloud Remediation - GCP Kubernetes Engine Misconfiguration
- Prisma Cloud Remediation - GCP Kubernetes Engine Misconfiguration v2
- Prisma Cloud Remediation - GCP VPC Network Firewall Misconfiguration
- Prisma Cloud Remediation - GCP VPC Network Misconfiguration
- Prisma Cloud Remediation - GCP VPC Network Misconfiguration v2
- Prisma Cloud Remediation - GCP VPC Network Project Misconfiguration
Scripts (1)
- PrismaCloudAttribution
README
Prisma Cloud
Automate and unify security incident response across your cloud environments, while still giving a degree of control to dedicated cloud teams.
Cloud adoption has expanded the threat surface and created disparate ecosystems that hamper visibility into security vulnerabilities across the network. In addition, cloud provisioning is often managed by multiple teams, making it hard for security teams to keep pace.
The pack includes playbooks that automate Prisma Cloud alert response and custom incident fields, views and layouts to facilitate analyst investigation. The remediation playbooks orchestrate across multiple native cloud integrations (AWS, GCP, Azure) to automate actions like changing policies, revoking access, creating new rules etc.
With this content pack, you can significantly reduce the time your Security Analysts/Cloud Operations team spend on Cloud Security alerts and standardize the way you manage misconfiguration incidents.
What does this pack do?
The playbooks included in this Pack help automate the remediation of alerts generated from the Prisma Cloud platform.
- Take action on, remediate, and resolve incidents/ alerts from Prisma Cloud.
- Track configuration issues across all your Cloud environments.
- Ensure your Cloud environments are compliant and up to date with the latest compliance standards.
- Configure your Cloud environments using industry best practices.
As part of this pack, you will also get out-of-the-box Prisma Cloud incident views, segregated alert layouts and playbooks. All of these are easily customizable to suit the needs of your organization.
For more information, visit our Cortex XSOAR Developer Docs
<~XSIAM>
This pack includes Cortex XSIAM content.
It supports Prisma Cloud alerts ingestion and modeling.
For additional details regarding Prisma Cloud alerts ingestion & Prisma Cloud Collector configuration, see Ingest Alerts from Prisma Cloud.
</~XSIAM>