Prisma Cloud - Find Azure Resource by Public IP Deprecated Hidden

Deprecated. Use Prisma Cloud - Find Azure Resource by Public IP v2 instead. Find Azure resources by Public IP using Prisma Cloud inventory. Supported services: Azure VM, Azure Load Balancer, Azure Application Gateway, Azure Web Apps.

Prisma Cloud by Palo Alto Networks · 11 tasks · 1 input · 1 output

Details

ID	`Prisma Cloud - Find Azure Resource by Public IP`
From Version	6.0.0
Tasks	11

README

Find Azure resources by Public IP using Prisma Cloud inventory.
Supported services: Azure VM, Azure Load Balancer, Azure Application Gateway, Azure Web Apps.

Supported Cortex XSOAR versions: 6.0.0 and later.

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

This playbook does not use any sub-playbooks.

Integrations

PrismaCloud v2

Scripts

This playbook does not use any scripts.

Commands

redlock-search-config

Playbook Inputs

Name	Description	Default Value	Required
PublicIPAddress	Public IP Address to look up		Required

Playbook Outputs

Path	Description	Type
PrismaCloud.Attribution	Prisma Cloud attributed asset information.	unknown

Playbook Image

Prisma Cloud - Find Azure Resource by Public IP

Inputs

PublicIPAddress — Public IP Address to look up

Outputs

PrismaCloud.Attribution — Prisma Cloud attributed asset information.

Commands used

redlock-search-config

Flowchart

Source

playbook-Prisma_Cloud_-_Find_Azure_Resource_by_Public_IP.yml playbook-Prisma_Cloud_-_Find_Azure_Resource_by_Public_IP_v2.yml playbook-Prisma_Cloud_-_Find_Azure_Resource_by_Public_IP_v2_README.md

Download History Raw

description: |
  Deprecated. Use Prisma Cloud - Find Azure Resource by Public IP v2 instead.
  Find Azure resources by Public IP using Prisma Cloud inventory.
  Supported services: Azure VM, Azure Load Balancer, Azure Application Gateway, Azure Web Apps.
id: Prisma Cloud - Find Azure Resource by Public IP
inputs:
- description: Public IP Address to look up
  key: PublicIPAddress
  playbookInputQuery:
  required: true
  value: {}
name: Prisma Cloud - Find Azure Resource by Public IP
outputs:
- contextPath: PrismaCloud.Attribution
  description: Prisma Cloud attributed asset information.
  type: unknown
starttaskid: "0"
tasks:
  "0":
    id: "0"
    ignoreworker: false
    nexttasks:
      '#none#':
      - "16"
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      id: eea6468a-1ae8-4066-8c3b-d68ae31a0278
      iscommand: false
      name: ""
      version: -1
      description: ''
    taskid: eea6468a-1ae8-4066-8c3b-d68ae31a0278
    timertriggers: []
    type: start
    view: |-
      {
        "position": {
          "x": 1710,
          "y": -480
        }
      }
  "7":
    id: "7"
    ignoreworker: false
    nexttasks:
      '#none#':
      - "11"
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      id: c45dbc41-b306-40fb-8004-c91ca1fdf627
      iscommand: false
      name: Check Results
      type: title
      version: -1
      description: ''
    taskid: c45dbc41-b306-40fb-8004-c91ca1fdf627
    timertriggers: []
    type: title
    view: |-
      {
        "position": {
          "x": 850,
          "y": 320
        }
      }
  "10":
    id: "10"
    ignoreworker: false
    nexttasks:
      '#none#':
      - "7"
    note: false
    quietmode: 0
    scriptarguments:
      query:
        complex:
          root: inputs.PublicIPAddress
          transformers:
          - args:
              prefix:
                value:
                  simple: '[''properties.networkProfile''].networkInterfaces[*].publicIpAddress
                    equals '
              suffix: {}
            operator: concat
          - args:
              separator:
                value:
                  simple: ' OR '
            operator: join
          - args:
              prefix:
                value:
                  simple: 'config from cloud.resource where cloud.type = ''azure''
                    AND cloud.service = ''Azure Compute'' AND api.name = ''azure-vm-list''
                    AND json.rule = ( '
              suffix:
                value:
                  simple: ' )'
            operator: concat
      time-range-date-from: {}
      time-range-date-to: {}
      time-range-date-unit: {}
      time-range-date-value: {}
    separatecontext: false
    skipunavailable: false
    task:
      brand: PrismaCloud v2
      description: Search Azure VM instances in Prisma Cloud
      id: 747967fa-f4f0-4afb-8d24-bfe451752cfd
      iscommand: true
      name: Search in Azure Compute
      script: PrismaCloud v2|||redlock-search-config
      type: regular
      version: -1
    taskid: 747967fa-f4f0-4afb-8d24-bfe451752cfd
    timertriggers: []
    type: regular
    view: |-
      {
        "position": {
          "x": 1280,
          "y": 150
        }
      }
  "11":
    conditions:
    - condition:
      - - left:
            iscontext: true
            value:
              complex:
                accessor: Config
                root: PrismaCloud
          operator: isNotEmpty
      label: "yes"
    id: "11"
    ignoreworker: false
    nexttasks:
      '#default#':
      - "13"
      "yes":
      - "12"
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      description: Check whether results are found.
      id: 385cc47e-55cb-47cb-82f6-7a6a6ffcee37
      iscommand: false
      name: Are Results Found?
      type: condition
      version: -1
    taskid: 385cc47e-55cb-47cb-82f6-7a6a6ffcee37
    timertriggers: []
    type: condition
    view: |-
      {
        "position": {
          "x": 850,
          "y": 470
        }
      }
  "12":
    id: "12"
    ignoreworker: false
    nexttasks:
      '#none#':
      - "13"
    note: false
    quietmode: 0
    scriptarguments:
      assets:
        complex:
          accessor: Config
          root: PrismaCloud
      fields: {}
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      description: Prisma Cloud Attribution
      id: 8e61f71b-1962-4af9-8dda-c868f1716764
      iscommand: false
      name: Transform Results
      script: PrismaCloudAttribution
      type: regular
      version: -1
    taskid: 8e61f71b-1962-4af9-8dda-c868f1716764
    timertriggers: []
    type: regular
    view: |-
      {
        "position": {
          "x": 630,
          "y": 640
        }
      }
  "13":
    id: "13"
    ignoreworker: false
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      id: 32081987-a64a-4dc2-86cc-286562d974cf
      iscommand: false
      name: Done
      type: title
      version: -1
      description: ''
    taskid: 32081987-a64a-4dc2-86cc-286562d974cf
    timertriggers: []
    type: title
    view: |-
      {
        "position": {
          "x": 1710,
          "y": 810
        }
      }
  "14":
    id: "14"
    ignoreworker: false
    nexttasks:
      '#none#':
      - "10"
      - "17"
      - "18"
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      id: 41fee779-d27a-4881-81df-eb903fa87a42
      iscommand: false
      name: Search in Prisma Cloud
      type: title
      version: -1
      description: ''
    taskid: 41fee779-d27a-4881-81df-eb903fa87a42
    timertriggers: []
    type: title
    view: |-
      {
        "position": {
          "x": 850,
          "y": 10
        }
      }
  "15":
    conditions:
    - condition:
      - - left:
            iscontext: true
            value:
              complex:
                filters:
                - - left:
                      iscontext: true
                      value:
                        simple: modules.brand
                    operator: isEqualString
                    right:
                      value:
                        simple: PrismaCloud v2
                - - left:
                      iscontext: true
                      value:
                        simple: modules.state
                    operator: isEqualString
                    right:
                      value:
                        simple: active
                root: modules
          operator: isExists
      label: "yes"
    id: "15"
    ignoreworker: false
    nexttasks:
      '#default#':
      - "13"
      "yes":
      - "14"
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      description: Check whether Prisma Cloud integration is enabled.
      id: 28701bd7-3772-4e66-8d50-e9438fd07044
      iscommand: false
      name: Is Prisma Cloud enabled?
      type: condition
      version: -1
    taskid: 28701bd7-3772-4e66-8d50-e9438fd07044
    timertriggers: []
    type: condition
    view: |-
      {
        "position": {
          "x": 1420,
          "y": -160
        }
      }
  "16":
    conditions:
    - condition:
      - - left:
            iscontext: true
            value:
              complex:
                root: inputs.PublicIPAddress
          operator: isNotEmpty
      label: "yes"
    id: "16"
    ignoreworker: false
    nexttasks:
      '#default#':
      - "13"
      "yes":
      - "15"
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      description: Check if there are any IP in the input.
      id: 156f032a-0995-4ada-8ccd-06a9d6da3f16
      iscommand: false
      name: Are there IPs in input?
      type: condition
      version: -1
    taskid: 156f032a-0995-4ada-8ccd-06a9d6da3f16
    timertriggers: []
    type: condition
    view: |-
      {
        "position": {
          "x": 1710,
          "y": -330
        }
      }
  "17":
    id: "17"
    ignoreworker: false
    nexttasks:
      '#none#':
      - "7"
    note: false
    quietmode: 0
    scriptarguments:
      query:
        complex:
          root: inputs.PublicIPAddress
          transformers:
          - args:
              prefix:
                value:
                  simple: 'properties.ipAddress equals '
              suffix: {}
            operator: concat
          - args:
              separator:
                value:
                  simple: ' OR '
            operator: join
          - args:
              prefix:
                value:
                  simple: 'config from cloud.resource where cloud.type = ''azure''
                    AND cloud.service = ''Azure Virtual Network'' AND api.name = ''azure-network-public-ip-address''
                    AND json.rule = ( '
              suffix:
                value:
                  simple: ' )'
            operator: concat
      time-range-date-from: {}
      time-range-date-to: {}
      time-range-date-unit: {}
      time-range-date-value: {}
      time-range-unit: {}
      time-range-value: {}
    separatecontext: false
    skipunavailable: false
    task:
      brand: PrismaCloud v2
      description: Search Azure VM instances in Prisma Cloud
      id: c6f7f040-449a-4734-8dce-733b84e70c14
      iscommand: true
      name: Search in Azure Public IP
      script: PrismaCloud v2|||redlock-search-config
      type: regular
      version: -1
    taskid: c6f7f040-449a-4734-8dce-733b84e70c14
    timertriggers: []
    type: regular
    view: |-
      {
        "position": {
          "x": 850,
          "y": 150
        }
      }
  "18":
    id: "18"
    ignoreworker: false
    nexttasks:
      '#none#':
      - "7"
    note: false
    quietmode: 0
    scriptarguments:
      query:
        complex:
          root: inputs.PublicIPAddress
          transformers:
          - args:
              prefix:
                value:
                  simple: 'properties.outboundIpAddresses equals '
              suffix: {}
            operator: concat
          - args:
              separator:
                value:
                  simple: ' OR '
            operator: join
          - args:
              prefix:
                value:
                  simple: 'config from cloud.resource where cloud.type = ''azure''
                    AND cloud.service = ''Azure App Service'' AND api.name = ''azure-app-service''
                    AND json.rule = ( '
              suffix:
                value:
                  simple: ' )'
            operator: concat
      time-range-date-from: {}
      time-range-date-to: {}
      time-range-date-unit: {}
      time-range-date-value: {}
      time-range-unit: {}
      time-range-value: {}
    separatecontext: false
    skipunavailable: false
    task:
      brand: PrismaCloud v2
      description: Search Azure VM instances in Prisma Cloud
      id: 9da485c0-2441-424e-87e6-10ec95671e6e
      iscommand: true
      name: Search in Azure App Service
      script: PrismaCloud v2|||redlock-search-config
      type: regular
      version: -1
    taskid: 9da485c0-2441-424e-87e6-10ec95671e6e
    timertriggers: []
    type: regular
    view: |-
      {
        "position": {
          "x": 400,
          "y": 150
        }
      }
version: -1
view: |-
  {
    "linkLabelsPosition": {
      "11_13_#default#": 0.12,
      "15_13_#default#": 0.19,
      "16_13_#default#": 0.22
    },
    "paper": {
      "dimensions": {
        "height": 1355,
        "width": 1690,
        "x": 400,
        "y": -480
      }
    }
  }
fromversion: 6.0.0
tests:
- No tests (deprecated)
deprecated: true
hidden: true