Prisma Cloud - Find AWS Resource by Public IP v2

Find AWS resources by Public IP using Prisma Cloud inventory. Supported services: EC2, Network Load Balancer, ECS, Route53.

Prisma Cloud by Palo Alto Networks · 11 tasks · 1 input · 2 outputs

Details

ID	`Prisma Cloud - Find AWS Resource by Public IP v2`
From Version	6.8.0
Tasks	11

README

Find AWS resources by Public IP using Prisma Cloud inventory.
Supported services: EC2, Network Load Balancer, ECS, Route53.

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

This playbook does not use any sub-playbooks.

Integrations

PrismaCloud v2

Scripts

PrismaCloudAttribution

Commands

prisma-cloud-config-search

Playbook Inputs

Name	Description	Default Value	Required
PublicIPAddress	Public IP address to look up.		Required

Playbook Outputs

Path	Description	Type
PrismaCloud.Attribution	Prisma Cloud attributed asset information.	unknown
PrismaCloud.Config.data.tags	Prisma Cloud Tags information.	unknown

Playbook Image

Prisma Cloud - Find AWS Resource by Public IP v2

Inputs

PublicIPAddress — Public IP address to look up.

Outputs

PrismaCloud.Attribution — Prisma Cloud attributed asset information.
PrismaCloud.Config.data.tags — Prisma Cloud Tags information.

Commands used

prisma-cloud-config-search

Flowchart

Source

playbook-Prisma_Cloud_-_Find_AWS_Resource_by_Public_IP_v2.yml

Download History Raw

id: Prisma Cloud - Find AWS Resource by Public IP v2
version: -1
contentitemexportablefields:
  contentitemfields: {}
name: Prisma Cloud - Find AWS Resource by Public IP v2
description: |
  Find AWS resources by Public IP using Prisma Cloud inventory.
  Supported services: EC2, Network Load Balancer, ECS, Route53.
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: e920dbbc-fa5f-4b9c-8090-2106cb2f2210
    type: start
    task:
      id: e920dbbc-fa5f-4b9c-8090-2106cb2f2210
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "16"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1770,
          "y": -510
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "1":
    id: "1"
    taskid: de96f7c5-4fb1-4d90-8034-81ab5b7674f3
    type: regular
    task:
      id: de96f7c5-4fb1-4d90-8034-81ab5b7674f3
      version: -1
      name: Search in EC2 Instances
      description: Search EC2 instances in Prisma Cloud.
      script: PrismaCloud v2|||prisma-cloud-config-search
      type: regular
      iscommand: true
      brand: PrismaCloud v2
    nexttasks:
      '#none#':
      - "7"
    scriptarguments:
      query:
        complex:
          root: inputs.PublicIPAddress
          transformers:
          - operator: concat
            args:
              prefix:
                value:
                  simple: 'publicIpAddress equals '
              suffix: {}
          - operator: join
            args:
              separator:
                value:
                  simple: ' OR '
          - operator: concat
            args:
              prefix:
                value:
                  simple: 'config from cloud.resource where cloud.type = ''aws'' AND cloud.service = ''Amazon EC2'' AND api.name = ''aws-ec2-describe-instances'' AND json.rule = ( '
              suffix:
                value:
                  simple: ' )'
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 920,
          "y": 120
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "7":
    id: "7"
    taskid: 622e2b20-4603-4ca2-8e0b-e81dafacc956
    type: title
    task:
      id: 622e2b20-4603-4ca2-8e0b-e81dafacc956
      version: -1
      name: Check Results
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "11"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 920,
          "y": 290
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "9":
    id: "9"
    taskid: ee7204ef-7e0a-4c66-8c62-0b782d188861
    type: regular
    task:
      id: ee7204ef-7e0a-4c66-8c62-0b782d188861
      version: -1
      name: Search in EC2 NLB
      description: Search EC2 Elastic Load Balancers in Prisma Cloud.
      script: PrismaCloud v2|||prisma-cloud-config-search
      type: regular
      iscommand: true
      brand: PrismaCloud v2
    nexttasks:
      '#none#':
      - "7"
    scriptarguments:
      query:
        complex:
          root: inputs.PublicIPAddress
          transformers:
          - operator: concat
            args:
              prefix:
                value:
                  simple: 'availabilityZones[*].loadBalancerAddresses[*].ipAddress equals '
              suffix: {}
          - operator: join
            args:
              separator:
                value:
                  simple: ' OR '
          - operator: concat
            args:
              prefix:
                value:
                  simple: 'config from cloud.resource where cloud.type = ''aws'' AND cloud.service = ''Amazon Elastic Load Balancing'' AND api.name = ''aws-elbv2-describe-load-balancers'' AND json.rule = ( '
              suffix:
                value:
                  simple: ' )'
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1380,
          "y": 120
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "11":
    id: "11"
    taskid: 5d1e8ec3-2a63-48e1-8612-618b8b18f1aa
    type: condition
    task:
      id: 5d1e8ec3-2a63-48e1-8612-618b8b18f1aa
      version: -1
      name: Are Results Found?
      description: Check whether results are found.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "13"
      "yes":
      - "12"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: PrismaCloud
                accessor: Config
            iscontext: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 920,
          "y": 430
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "12":
    id: "12"
    taskid: 27ec017b-ae1f-44b9-85c2-0e4f530fff48
    type: regular
    task:
      id: 27ec017b-ae1f-44b9-85c2-0e4f530fff48
      version: -1
      name: Transform Results
      description: Prisma Cloud Attribution
      scriptName: PrismaCloudAttribution
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "13"
    scriptarguments:
      assets:
        complex:
          root: PrismaCloud
          accessor: Config
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 660,
          "y": 600
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "13":
    id: "13"
    taskid: 8cd43035-2b66-4a07-80e7-ef5e174f94e3
    type: title
    task:
      id: 8cd43035-2b66-4a07-80e7-ef5e174f94e3
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1770,
          "y": 770
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "14":
    id: "14"
    taskid: f4ac9ede-8ee3-4998-8f1d-c75143fe801d
    type: title
    task:
      id: f4ac9ede-8ee3-4998-8f1d-c75143fe801d
      version: -1
      name: Search in Prisma Cloud
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "1"
      - "9"
      - "17"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 920,
          "y": -20
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "15":
    id: "15"
    taskid: d168a138-6f37-4b36-8efd-5ca469637e29
    type: condition
    task:
      id: d168a138-6f37-4b36-8efd-5ca469637e29
      version: -1
      name: Is Prisma Cloud enabled?
      description: Check whether Prisma Cloud integration is enabled.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "13"
      "yes":
      - "14"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: modules
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.brand
                      iscontext: true
                    right:
                      value:
                        simple: PrismaCloud v2
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.state
                      iscontext: true
                    right:
                      value:
                        simple: active
            iscontext: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1420,
          "y": -190
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "16":
    id: "16"
    taskid: 141f9c6c-6fed-473a-8818-4d3e026f0327
    type: condition
    task:
      id: 141f9c6c-6fed-473a-8818-4d3e026f0327
      version: -1
      name: Are there IPs in input?
      description: Check if there are any IPs in the input.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "13"
      "yes":
      - "15"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.PublicIPAddress
            iscontext: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1770,
          "y": -360
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "17":
    id: "17"
    taskid: 2c81386b-6119-4a6e-891b-331896018e4c
    type: regular
    task:
      id: 2c81386b-6119-4a6e-891b-331896018e4c
      version: -1
      name: Search in Route53 Hosted Zones
      description: Search EC2 instances in Prisma Cloud.
      script: PrismaCloud v2|||prisma-cloud-config-search
      type: regular
      iscommand: true
      brand: PrismaCloud v2
    nexttasks:
      '#none#':
      - "7"
    scriptarguments:
      query:
        complex:
          root: inputs.PublicIPAddress
          transformers:
          - operator: concat
            args:
              prefix:
                value:
                  simple: 'resourceRecordSet[*].resourceRecords[*].value equals '
              suffix: {}
          - operator: join
            args:
              separator:
                value:
                  simple: ' OR '
          - operator: concat
            args:
              prefix:
                value:
                  simple: 'config from cloud.resource where cloud.type = ''aws'' AND cloud.service = ''Amazon Route53'' AND api.name = ''aws-route53-list-hosted-zones'' AND json.rule = ( '
              suffix:
                value:
                  simple: ' )'
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 450,
          "y": 120
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
view: |-
  {
    "linkLabelsPosition": {
      "11_13_#default#": 0.13,
      "15_13_#default#": 0.2,
      "16_13_#default#": 0.25
    },
    "paper": {
      "dimensions": {
        "height": 1345,
        "width": 1700,
        "x": 450,
        "y": -510
      }
    }
  }
inputs:
- key: PublicIPAddress
  value: {}
  required: true
  description: Public IP address to look up.
  playbookInputQuery:
outputs:
- contextPath: PrismaCloud.Attribution
  description: Prisma Cloud attributed asset information.
  type: unknown
- contextPath: PrismaCloud.Config.data.tags
  description: Prisma Cloud Tags information.
  type: unknown
tests:
- No tests (auto formatted)
fromversion: 6.8.0