Prisma Cloud - Find GCP Resource by FQDN Deprecated Hidden

Deprecated. Use Prisma Cloud - Find GCP Resource by FQDN v2 instead. Find GCP resources by FQDN using Prisma Cloud inventory. Supported services: Cloud DNS.
Prisma Cloud by Palo Alto Networks · 19 tasks · 2 inputs · 1 output
Details

ID	`Prisma Cloud - Find GCP Resource by FQDN`
From Version	6.0.0
Tasks	19
README

Find GCP resources by FQDN using Prisma Cloud inventory.
Supported services: Cloud DNS.
Supported Cortex XSOAR versions: 6.0.0 and later.
Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.
Sub-playbooks

This playbook does not use any sub-playbooks.
Integrations

PrismaCloud v2
Scripts

This playbook does not use any scripts.
Commands

redlock-search-config
Playbook Inputs

Name	Description	Default Value	Required
FQDN	FQDN to look up		Required
GCPDomains	GCP domains (comma separated)	.google.com	Optional
Playbook Outputs

Path	Description	Type
PrismaCloud.Attribution	Prisma Cloud attributed asset information.	unknown
Playbook Image

Prisma Cloud - Find GCP Resource by FQDN
Inputs

FQDN — FQDN to look up
GCPDomains — GCP domains (comma separated)
Outputs

PrismaCloud.Attribution — Prisma Cloud attributed asset information.
Commands used

redlock-search-config
Flowchart

Source

playbook-Prisma_Cloud_-_Find_GCP_Resource_by_FQDN.yml playbook-Prisma_Cloud_-_Find_GCP_Resource_by_FQDN_v2.yml playbook-Prisma_Cloud_-_Find_GCP_Resource_by_FQDN_v2_README.md
Download History Raw
description: |
  Deprecated. Use Prisma Cloud - Find GCP Resource by FQDN v2 instead.
  Find GCP resources by FQDN using Prisma Cloud inventory.
  Supported services: Cloud DNS.
id: Prisma Cloud - Find GCP Resource by FQDN
inputs:
- description: FQDN to look up
  key: FQDN
  playbookInputQuery:
  required: true
  value: {}
- description: GCP domains (comma separated)
  key: GCPDomains
  playbookInputQuery:
  required: false
  value:
    simple: .google.com
name: Prisma Cloud - Find GCP Resource by FQDN
outputs:
- contextPath: PrismaCloud.Attribution
  description: Prisma Cloud attributed asset information.
  type: unknown
starttaskid: "0"
tasks:
  "0":
    id: "0"
    ignoreworker: false
    nexttasks:
      '#none#':
      - "20"
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      id: 1b38336c-b52a-4df5-83a7-fd22c6c94bec
      iscommand: false
      name: ""
      version: -1
      description: ''
    taskid: 1b38336c-b52a-4df5-83a7-fd22c6c94bec
    timertriggers: []
    type: start
    view: |-
      {
        "position": {
          "x": 1830,
          "y": -1210
        }
      }
  "7":
    id: "7"
    ignoreworker: false
    nexttasks:
      '#none#':
      - "12"
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      id: 9e5711ae-e4a4-4227-80a3-e048538f6225
      iscommand: false
      name: Check Results
      type: title
      version: -1
      description: ''
    taskid: 9e5711ae-e4a4-4227-80a3-e048538f6225
    timertriggers: []
    type: title
    view: |-
      {
        "position": {
          "x": 1420,
          "y": 760
        }
      }
  "10":
    id: "10"
    ignoreworker: false
    nexttasks:
      '#none#':
      - "31"
    note: false
    quietmode: 0
    scriptarguments:
      append: {}
      key:
        simple: NONGCPSplitFQDN
      stringify: {}
      value:
        complex:
          root: NONGCPFQDN
          transformers:
          - args:
              groups:
                value:
                  simple: 0,1
              keys:
                value:
                  simple: hostname,domain
              regex:
                value:
                  simple: ([A-z0-9\-]*)\.(.*)
            operator: RegexGroups
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      description: Set a value in context under the key you entered. If no value is
        entered, the script doesn't do anything.
      id: be9c2e0f-f2dc-452e-8fa0-608e3c9218cb
      iscommand: false
      name: Split Hostname from Domain
      script: SetAndHandleEmpty
      type: regular
      version: -1
    taskid: be9c2e0f-f2dc-452e-8fa0-608e3c9218cb
    timertriggers: []
    type: regular
    view: |-
      {
        "position": {
          "x": -170,
          "y": 410
        }
      }
  "12":
    conditions:
    - condition:
      - - left:
            iscontext: true
            value:
              complex:
                accessor: Config
                root: PrismaCloud
          operator: isNotEmpty
      label: "yes"
    id: "12"
    ignoreworker: false
    nexttasks:
      '#default#':
      - "14"
      "yes":
      - "13"
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      description: Check whether results are found.
      id: 05e55ef7-185d-46a9-8afd-65fd936b0313
      iscommand: false
      name: Are results found?
      type: condition
      version: -1
    taskid: 05e55ef7-185d-46a9-8afd-65fd936b0313
    timertriggers: []
    type: condition
    view: |-
      {
        "position": {
          "x": 1420,
          "y": 920
        }
      }
  "13":
    id: "13"
    ignoreworker: false
    nexttasks:
      '#none#':
      - "14"
    note: false
    quietmode: 0
    scriptarguments:
      assets:
        complex:
          accessor: Config
          root: PrismaCloud
      fields: {}
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      description: Prisma Cloud Attribution
      id: 0b6958ef-6c13-4dba-8ab6-3ebf3c9ec5be
      iscommand: false
      name: Transform Results
      script: PrismaCloudAttribution
      type: regular
      version: -1
    taskid: 0b6958ef-6c13-4dba-8ab6-3ebf3c9ec5be
    timertriggers: []
    type: regular
    view: |-
      {
        "position": {
          "x": 1210,
          "y": 1090
        }
      }
  "14":
    id: "14"
    ignoreworker: false
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      id: 022d3033-de2f-479d-89ae-93f18c2e0d81
      iscommand: false
      name: Done
      type: title
      version: -1
      description: ''
    taskid: 022d3033-de2f-479d-89ae-93f18c2e0d81
    timertriggers: []
    type: title
    view: |-
      {
        "position": {
          "x": 1830,
          "y": 1270
        }
      }
  "15":
    conditions:
    - condition:
      - - left:
            iscontext: true
            value:
              complex:
                filters:
                - - left:
                      iscontext: true
                      value:
                        simple: modules.brand
                    operator: isEqualString
                    right:
                      value:
                        simple: PrismaCloud v2
                - - left:
                      iscontext: true
                      value:
                        simple: modules.state
                    operator: isEqualString
                    right:
                      value:
                        simple: active
                root: modules
          operator: isExists
      label: "yes"
    id: "15"
    ignoreworker: false
    nexttasks:
      '#default#':
      - "14"
      "yes":
      - "16"
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      description: Check whether Prisma Cloud integration is enabled.
      id: dafe522e-ee63-4afc-8c72-ca43d85235f5
      iscommand: false
      name: Is Prisma Cloud enabled?
      type: condition
      version: -1
    taskid: dafe522e-ee63-4afc-8c72-ca43d85235f5
    timertriggers: []
    type: condition
    view: |-
      {
        "position": {
          "x": 1420,
          "y": -910
        }
      }
  "16":
    id: "16"
    ignoreworker: false
    nexttasks:
      '#none#':
      - "30"
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      id: f97e6138-3563-481d-8e39-92923c983aca
      iscommand: false
      name: Prepare for Search
      type: title
      version: -1
      description: ''
    taskid: f97e6138-3563-481d-8e39-92923c983aca
    timertriggers: []
    type: title
    view: |-
      {
        "position": {
          "x": 1120,
          "y": -740
        }
      }
  "20":
    conditions:
    - condition:
      - - left:
            iscontext: true
            value:
              complex:
                root: inputs.FQDN
          operator: isNotEmpty
      label: "yes"
    id: "20"
    ignoreworker: false
    nexttasks:
      '#default#':
      - "14"
      "yes":
      - "15"
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      description: Check if there are any FQDNs in the input.
      id: 839d174e-8d9d-48a1-88f0-a8f54febd290
      iscommand: false
      name: Are there FQDNs in input?
      type: condition
      version: -1
    taskid: 839d174e-8d9d-48a1-88f0-a8f54febd290
    timertriggers: []
    type: condition
    view: |-
      {
        "position": {
          "x": 1830,
          "y": -1080
        }
      }
  "22":
    id: "22"
    ignoreworker: false
    nexttasks:
      '#none#':
      - "23"
    note: false
    quietmode: 0
    scriptarguments:
      append:
        simple: "false"
      key:
        simple: GCPFQDN
      stringify: {}
      value:
        complex:
          filters:
          - - left:
                iscontext: true
                value:
                  simple: inputs.FQDN
              operator: StringContainsArray
              right:
                iscontext: true
                value:
                  simple: ProviderDomains
          root: inputs.FQDN
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      description: Set a value in context under the key you entered. If no value is
        entered, the script doesn't do anything.
      id: 5f258881-1ec8-480e-84bb-545163325e54
      iscommand: false
      name: Extract GCP FQDNs
      script: SetAndHandleEmpty
      type: regular
      version: -1
    taskid: 5f258881-1ec8-480e-84bb-545163325e54
    timertriggers: []
    type: regular
    view: |-
      {
        "position": {
          "x": 1120,
          "y": -410
        }
      }
  "23":
    id: "23"
    ignoreworker: false
    nexttasks:
      '#none#':
      - "25"
    note: false
    quietmode: 0
    scriptarguments:
      append:
        simple: "false"
      key:
        simple: NONGCPFQDN
      stringify: {}
      value:
        complex:
          filters:
          - - left:
                iscontext: true
                value:
                  simple: inputs.FQDN
              operator: notInList
              right:
                value:
                  simple: GCPFQDN
          root: inputs.FQDN
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      description: Set a value in context under the key you entered. If no value is
        entered, the script doesn't do anything.
      id: a33c242a-f55a-40ce-8673-e14b0999fd11
      iscommand: false
      name: Extract NON GCP FQDNs
      script: SetAndHandleEmpty
      type: regular
      version: -1
    taskid: a33c242a-f55a-40ce-8673-e14b0999fd11
    timertriggers: []
    type: regular
    view: |-
      {
        "position": {
          "x": 1120,
          "y": -240
        }
      }
  "24":
    conditions:
    - condition:
      - - left:
            iscontext: true
            value:
              complex:
                root: GCPFQDN
          operator: isNotEmpty
      label: "yes"
    id: "24"
    ignoreworker: false
    nexttasks:
      '#default#':
      - "7"
      "yes":
      - "28"
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      description: Check whether AWS FQDNs are present in the inputs.
      id: b2d1e182-58f7-4bc6-8386-958b46d6174e
      iscommand: false
      name: Are there GCP FQDNs?
      type: condition
      version: -1
    taskid: b2d1e182-58f7-4bc6-8386-958b46d6174e
    timertriggers: []
    type: condition
    view: |-
      {
        "position": {
          "x": 800,
          "y": 80
        }
      }
  "25":
    id: "25"
    ignoreworker: false
    nexttasks:
      '#none#':
      - "24"
      - "26"
      - "29"
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      id: c8ccd9f2-838a-4c69-8f73-a1674610d3b9
      iscommand: false
      name: Search in Prisma Cloud Inventory
      type: title
      version: -1
      description: ''
    taskid: c8ccd9f2-838a-4c69-8f73-a1674610d3b9
    timertriggers: []
    type: title
    view: |-
      {
        "position": {
          "x": 1120,
          "y": -60
        }
      }
  "26":
    conditions:
    - condition:
      - - left:
            iscontext: true
            value:
              complex:
                root: NONGCPFQDN
          operator: isNotEmpty
      label: "yes"
    id: "26"
    ignoreworker: false
    nexttasks:
      '#default#':
      - "7"
      "yes":
      - "27"
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      description: Check whether non GCP FQDNs are present in the inputs.
      id: a257d17c-44f0-403c-85ed-6ba2e4e426d3
      iscommand: false
      name: Are there NON GCP FQDNs?
      type: condition
      version: -1
    taskid: a257d17c-44f0-403c-85ed-6ba2e4e426d3
    timertriggers: []
    type: condition
    view: |-
      {
        "position": {
          "x": 70,
          "y": 80
        }
      }
  "27":
    id: "27"
    ignoreworker: false
    nexttasks:
      '#none#':
      - "10"
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      id: 92da9c96-25f8-45fb-8aa7-82941c74c64a
      iscommand: false
      name: Search NON GCP FQDNs
      type: title
      version: -1
      description: ''
    taskid: 92da9c96-25f8-45fb-8aa7-82941c74c64a
    timertriggers: []
    type: title
    view: |-
      {
        "position": {
          "x": -170,
          "y": 250
        }
      }
  "28":
    id: "28"
    ignoreworker: false
    nexttasks:
      '#none#':
      - "7"
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      id: 2b17b745-1701-47b4-8750-aa25a5840e28
      iscommand: false
      name: Search GCP FQDNs
      type: title
      version: -1
      description: ''
    taskid: 2b17b745-1701-47b4-8750-aa25a5840e28
    timertriggers: []
    type: title
    view: |-
      {
        "position": {
          "x": 630,
          "y": 250
        }
      }
  "29":
    id: "29"
    ignoreworker: false
    nexttasks:
      '#none#':
      - "7"
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      id: 96c8bc6c-ba1e-4aee-8d5d-bbccaefe12b6
      iscommand: false
      name: Search Everything
      type: title
      version: -1
      description: ''
    taskid: 96c8bc6c-ba1e-4aee-8d5d-bbccaefe12b6
    timertriggers: []
    type: title
    view: |-
      {
        "position": {
          "x": 1420,
          "y": 80
        }
      }
  "30":
    id: "30"
    ignoreworker: false
    nexttasks:
      '#none#':
      - "22"
    note: false
    quietmode: 0
    scriptarguments:
      append:
        simple: "false"
      key:
        simple: ProviderDomains
      stringify: {}
      value:
        complex:
          root: inputs.GCPDomains
          transformers:
          - args:
              delimiter:
                value:
                  simple: ','
            operator: splitAndTrim
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      description: Set a value in context under the key you entered. If no value is
        entered, the script doesn't do anything.
      id: 7e67b5d0-67c7-4af5-8f06-f00807bddc8b
      iscommand: false
      name: Split GCP Domains
      script: SetAndHandleEmpty
      type: regular
      version: -1
    taskid: 7e67b5d0-67c7-4af5-8f06-f00807bddc8b
    timertriggers: []
    type: regular
    view: |-
      {
        "position": {
          "x": 1120,
          "y": -590
        }
      }
  "31":
    id: "31"
    ignoreworker: false
    nexttasks:
      '#none#':
      - "7"
    note: false
    quietmode: 0
    scriptarguments:
      query:
        complex:
          accessor: domain
          root: NONGCPSplitFQDN
          transformers:
          - args:
              prefix:
                value:
                  simple: 'dnsName equals '
              suffix:
                value:
                  simple: .
            operator: concat
          - args:
              separator:
                value:
                  simple: ' OR '
            operator: join
          - args:
              prefix:
                value:
                  simple: 'config from cloud.resource where cloud.type = ''gcp'' AND
                    cloud.service = ''Google Cloud DNS'' AND api.name = ''gcloud-dns-managed-zone''
                    AND json.rule = ( '
              suffix:
                value:
                  simple: ' )'
            operator: concat
      time-range-date-from: {}
      time-range-date-to: {}
      time-range-unit: {}
      time-range-value: {}
    separatecontext: false
    skipunavailable: false
    task:
      brand: PrismaCloud v2
      description: Search configuration inventory on the Prisma Cloud platform using
        RQL language. Use this command for all queries that start with "config". When
        no absolute time nor relative time arguments are provided, the default time range
        is all times.
      id: 32767fe7-d8ea-422b-8bed-c3327a805dc7
      iscommand: true
      name: Search Zone Name in Google Cloud DNS
      script: PrismaCloud v2|||redlock-search-config
      type: regular
      version: -1
    taskid: 32767fe7-d8ea-422b-8bed-c3327a805dc7
    timertriggers: []
    type: regular
    view: |-
      {
        "position": {
          "x": -170,
          "y": 590
        }
      }
version: -1
view: |-
  {
    "linkLabelsPosition": {
      "12_14_#default#": 0.29,
      "15_14_#default#": 0.16,
      "24_7_#default#": 0.43,
      "26_7_#default#": 0.22
    },
    "paper": {
      "dimensions": {
        "height": 2545,
        "width": 2380,
        "x": -170,
        "y": -1210
      }
    }
  }
fromversion: 6.0.0
tests:
- No tests (deprecated)
deprecated: true
hidden: true