Prisma Cloud - Find GCP Resource by FQDN Deprecated Hidden

Deprecated. Use Prisma Cloud - Find GCP Resource by FQDN v2 instead. Find GCP resources by FQDN using Prisma Cloud inventory. Supported services: Cloud DNS.

Prisma Cloud by Palo Alto Networks · 19 tasks · 2 inputs · 1 output

Details

IDPrisma Cloud - Find GCP Resource by FQDN
From Version6.0.0
Tasks19

README

Find GCP resources by FQDN using Prisma Cloud inventory.
Supported services: Cloud DNS.

Supported Cortex XSOAR versions: 6.0.0 and later.

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

This playbook does not use any sub-playbooks.

Integrations

  • PrismaCloud v2

Scripts

This playbook does not use any scripts.

Commands

  • redlock-search-config

Playbook Inputs

Name Description Default Value Required
FQDN FQDN to look up   Required
GCPDomains GCP domains (comma separated) .google.com Optional

Playbook Outputs

Path Description Type
PrismaCloud.Attribution Prisma Cloud attributed asset information. unknown

Playbook Image

Prisma Cloud - Find GCP Resource by FQDN

Inputs

  • FQDN — FQDN to look up
  • GCPDomains — GCP domains (comma separated)

Outputs

  • PrismaCloud.Attribution — Prisma Cloud attributed asset information.

Commands used

redlock-search-config

Flowchart

yes yes yes yes yes Start Start Check Results Check Results Split Hostname from Domain Split Hostname from Domain Are results found? Are results found? Transform Results Transform Results Done Done Is Prisma Cloud enabled? Is Prisma Cloud enabled? Prepare for Search Prepare for Search Are there FQDNs in input? Are there FQDNs in input? Extract GCP FQDNs Extract GCP FQDNs Extract NON GCP FQDNs Extract NON GCP FQDNs Are there GCP FQDNs? Are there GCP FQDNs? Search in Prisma Cloud Inventory Search in Prisma Cloud In... Are there NON GCP FQDNs? Are there NON GCP FQDNs? Search NON GCP FQDNs Search NON GCP FQDNs Search GCP FQDNs Search GCP FQDNs Search Everything Search Everything Split GCP Domains Split GCP Domains Search Zone Name in Google Cloud DNS - redlock-search-config Search Zone Name in Googl... redlock-search-config

Source

playbook-Prisma_Cloud_-_Find_GCP_Resource_by_FQDN.yml playbook-Prisma_Cloud_-_Find_GCP_Resource_by_FQDN_v2.yml playbook-Prisma_Cloud_-_Find_GCP_Resource_by_FQDN_v2_README.md
Download History Raw 
description: |
  Find GCP resources by FQDN using Prisma Cloud inventory.
  Supported services: Cloud DNS.
id: Prisma Cloud - Find GCP Resource by FQDN v2
inputs:
- description: FQDN to look up.
  key: FQDN
  playbookInputQuery:
  required: true
  value: {}
- description: A comma-separated list of GCP domains.
  key: GCPDomains
  playbookInputQuery:
  required: false
  value:
    simple: .google.com
name: Prisma Cloud - Find GCP Resource by FQDN v2
outputs:
- contextPath: PrismaCloud.Attribution
  description: Prisma Cloud attributed asset information.
  type: unknown
starttaskid: "0"
tasks:
  "0":
    id: "0"
    ignoreworker: false
    nexttasks:
      '#none#':
      - "20"
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      id: 1b38336c-b52a-4df5-83a7-fd22c6c94bec
      iscommand: false
      name: ""
      version: -1
      description: ''
    taskid: 1b38336c-b52a-4df5-83a7-fd22c6c94bec
    timertriggers: []
    type: start
    view: |-
      {
        "position": {
          "x": 1830,
          "y": -1210
        }
      }
  "7":
    id: "7"
    ignoreworker: false
    nexttasks:
      '#none#':
      - "12"
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      id: 9e5711ae-e4a4-4227-80a3-e048538f6225
      iscommand: false
      name: Check Results
      type: title
      version: -1
      description: ''
    taskid: 9e5711ae-e4a4-4227-80a3-e048538f6225
    timertriggers: []
    type: title
    view: |-
      {
        "position": {
          "x": 1420,
          "y": 760
        }
      }
  "10":
    id: "10"
    ignoreworker: false
    nexttasks:
      '#none#':
      - "31"
    note: false
    quietmode: 0
    scriptarguments:
      append: {}
      key:
        simple: NONGCPSplitFQDN
      stringify: {}
      value:
        complex:
          root: NONGCPFQDN
          transformers:
          - args:
              groups:
                value:
                  simple: 0,1
              keys:
                value:
                  simple: hostname,domain
              regex:
                value:
                  simple: ([A-z0-9\-]*)\.(.*)
            operator: RegexGroups
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      description: Set a value in context under the key you entered. If no value is entered, the script doesn't do anything.
      id: be9c2e0f-f2dc-452e-8fa0-608e3c9218cb
      iscommand: false
      name: Split Hostname from Domain
      script: SetAndHandleEmpty
      type: regular
      version: -1
    taskid: be9c2e0f-f2dc-452e-8fa0-608e3c9218cb
    timertriggers: []
    type: regular
    view: |-
      {
        "position": {
          "x": -170,
          "y": 410
        }
      }
  "12":
    conditions:
    - condition:
      - - left:
            iscontext: true
            value:
              complex:
                accessor: Config
                root: PrismaCloud
          operator: isNotEmpty
      label: "yes"
    id: "12"
    ignoreworker: false
    nexttasks:
      '#default#':
      - "14"
      "yes":
      - "13"
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      description: Check whether results are found.
      id: 05e55ef7-185d-46a9-8afd-65fd936b0313
      iscommand: false
      name: Are results found?
      type: condition
      version: -1
    taskid: 05e55ef7-185d-46a9-8afd-65fd936b0313
    timertriggers: []
    type: condition
    view: |-
      {
        "position": {
          "x": 1420,
          "y": 920
        }
      }
  "13":
    id: "13"
    ignoreworker: false
    nexttasks:
      '#none#':
      - "14"
    note: false
    quietmode: 0
    scriptarguments:
      assets:
        complex:
          accessor: Config
          root: PrismaCloud
      fields: {}
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      description: Prisma Cloud Attribution
      id: 0b6958ef-6c13-4dba-8ab6-3ebf3c9ec5be
      iscommand: false
      name: Transform Results
      script: PrismaCloudAttribution
      type: regular
      version: -1
    taskid: 0b6958ef-6c13-4dba-8ab6-3ebf3c9ec5be
    timertriggers: []
    type: regular
    view: |-
      {
        "position": {
          "x": 1210,
          "y": 1090
        }
      }
  "14":
    id: "14"
    ignoreworker: false
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      id: 022d3033-de2f-479d-89ae-93f18c2e0d81
      iscommand: false
      name: Done
      type: title
      version: -1
      description: ''
    taskid: 022d3033-de2f-479d-89ae-93f18c2e0d81
    timertriggers: []
    type: title
    view: |-
      {
        "position": {
          "x": 1830,
          "y": 1270
        }
      }
  "15":
    conditions:
    - condition:
      - - left:
            iscontext: true
            value:
              complex:
                filters:
                - - left:
                      iscontext: true
                      value:
                        simple: modules.brand
                    operator: isEqualString
                    right:
                      value:
                        simple: PrismaCloud v2
                - - left:
                      iscontext: true
                      value:
                        simple: modules.state
                    operator: isEqualString
                    right:
                      value:
                        simple: active
                root: modules
          operator: isExists
      label: "yes"
    id: "15"
    ignoreworker: false
    nexttasks:
      '#default#':
      - "14"
      "yes":
      - "16"
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      description: Check whether Prisma Cloud integration is enabled.
      id: dafe522e-ee63-4afc-8c72-ca43d85235f5
      iscommand: false
      name: Is Prisma Cloud enabled?
      type: condition
      version: -1
    taskid: dafe522e-ee63-4afc-8c72-ca43d85235f5
    timertriggers: []
    type: condition
    view: |-
      {
        "position": {
          "x": 1420,
          "y": -910
        }
      }
  "16":
    id: "16"
    ignoreworker: false
    nexttasks:
      '#none#':
      - "30"
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      id: f97e6138-3563-481d-8e39-92923c983aca
      iscommand: false
      name: Prepare for Search
      type: title
      version: -1
      description: ''
    taskid: f97e6138-3563-481d-8e39-92923c983aca
    timertriggers: []
    type: title
    view: |-
      {
        "position": {
          "x": 1120,
          "y": -740
        }
      }
  "20":
    conditions:
    - condition:
      - - left:
            iscontext: true
            value:
              complex:
                root: inputs.FQDN
          operator: isNotEmpty
      label: "yes"
    id: "20"
    ignoreworker: false
    nexttasks:
      '#default#':
      - "14"
      "yes":
      - "15"
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      description: Check if there are any FQDNs in the input.
      id: 839d174e-8d9d-48a1-88f0-a8f54febd290
      iscommand: false
      name: Are there FQDNs in input?
      type: condition
      version: -1
    taskid: 839d174e-8d9d-48a1-88f0-a8f54febd290
    timertriggers: []
    type: condition
    view: |-
      {
        "position": {
          "x": 1830,
          "y": -1080
        }
      }
  "22":
    id: "22"
    ignoreworker: false
    nexttasks:
      '#none#':
      - "23"
    note: false
    quietmode: 0
    scriptarguments:
      append:
        simple: "false"
      key:
        simple: GCPFQDN
      stringify: {}
      value:
        complex:
          filters:
          - - left:
                iscontext: true
                value:
                  simple: inputs.FQDN
              operator: StringContainsArray
              right:
                iscontext: true
                value:
                  simple: ProviderDomains
          root: inputs.FQDN
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      description: Set a value in context under the key you entered. If no value is entered, the script doesn't do anything.
      id: 5f258881-1ec8-480e-84bb-545163325e54
      iscommand: false
      name: Extract GCP FQDNs
      script: SetAndHandleEmpty
      type: regular
      version: -1
    taskid: 5f258881-1ec8-480e-84bb-545163325e54
    timertriggers: []
    type: regular
    view: |-
      {
        "position": {
          "x": 1120,
          "y": -410
        }
      }
  "23":
    id: "23"
    ignoreworker: false
    nexttasks:
      '#none#':
      - "25"
    note: false
    quietmode: 0
    scriptarguments:
      append:
        simple: "false"
      key:
        simple: NONGCPFQDN
      stringify: {}
      value:
        complex:
          filters:
          - - left:
                iscontext: true
                value:
                  simple: inputs.FQDN
              operator: notInList
              right:
                value:
                  simple: GCPFQDN
          root: inputs.FQDN
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      description: Set a value in context under the key you entered. If no value is entered, the script doesn't do anything.
      id: a33c242a-f55a-40ce-8673-e14b0999fd11
      iscommand: false
      name: Extract NON GCP FQDNs
      script: SetAndHandleEmpty
      type: regular
      version: -1
    taskid: a33c242a-f55a-40ce-8673-e14b0999fd11
    timertriggers: []
    type: regular
    view: |-
      {
        "position": {
          "x": 1120,
          "y": -240
        }
      }
  "24":
    conditions:
    - condition:
      - - left:
            iscontext: true
            value:
              complex:
                root: GCPFQDN
          operator: isNotEmpty
      label: "yes"
    id: "24"
    ignoreworker: false
    nexttasks:
      '#default#':
      - "7"
      "yes":
      - "28"
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      description: Check whether AWS FQDNs are present in the inputs.
      id: b2d1e182-58f7-4bc6-8386-958b46d6174e
      iscommand: false
      name: Are there GCP FQDNs?
      type: condition
      version: -1
    taskid: b2d1e182-58f7-4bc6-8386-958b46d6174e
    timertriggers: []
    type: condition
    view: |-
      {
        "position": {
          "x": 800,
          "y": 80
        }
      }
  "25":
    id: "25"
    ignoreworker: false
    nexttasks:
      '#none#':
      - "24"
      - "26"
      - "29"
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      id: c8ccd9f2-838a-4c69-8f73-a1674610d3b9
      iscommand: false
      name: Search in Prisma Cloud Inventory
      type: title
      version: -1
      description: ''
    taskid: c8ccd9f2-838a-4c69-8f73-a1674610d3b9
    timertriggers: []
    type: title
    view: |-
      {
        "position": {
          "x": 1120,
          "y": -60
        }
      }
  "26":
    conditions:
    - condition:
      - - left:
            iscontext: true
            value:
              complex:
                root: NONGCPFQDN
          operator: isNotEmpty
      label: "yes"
    id: "26"
    ignoreworker: false
    nexttasks:
      '#default#':
      - "7"
      "yes":
      - "27"
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      description: Check whether non GCP FQDNs are present in the inputs.
      id: a257d17c-44f0-403c-85ed-6ba2e4e426d3
      iscommand: false
      name: Are there NON GCP FQDNs?
      type: condition
      version: -1
    taskid: a257d17c-44f0-403c-85ed-6ba2e4e426d3
    timertriggers: []
    type: condition
    view: |-
      {
        "position": {
          "x": 70,
          "y": 80
        }
      }
  "27":
    id: "27"
    ignoreworker: false
    nexttasks:
      '#none#':
      - "10"
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      id: 92da9c96-25f8-45fb-8aa7-82941c74c64a
      iscommand: false
      name: Search NON GCP FQDNs
      type: title
      version: -1
      description: ''
    taskid: 92da9c96-25f8-45fb-8aa7-82941c74c64a
    timertriggers: []
    type: title
    view: |-
      {
        "position": {
          "x": -170,
          "y": 250
        }
      }
  "28":
    id: "28"
    ignoreworker: false
    nexttasks:
      '#none#':
      - "7"
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      id: 2b17b745-1701-47b4-8750-aa25a5840e28
      iscommand: false
      name: Search GCP FQDNs
      type: title
      version: -1
      description: ''
    taskid: 2b17b745-1701-47b4-8750-aa25a5840e28
    timertriggers: []
    type: title
    view: |-
      {
        "position": {
          "x": 630,
          "y": 250
        }
      }
  "29":
    id: "29"
    ignoreworker: false
    nexttasks:
      '#none#':
      - "7"
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      id: 96c8bc6c-ba1e-4aee-8d5d-bbccaefe12b6
      iscommand: false
      name: Search Everything
      type: title
      version: -1
      description: ''
    taskid: 96c8bc6c-ba1e-4aee-8d5d-bbccaefe12b6
    timertriggers: []
    type: title
    view: |-
      {
        "position": {
          "x": 1420,
          "y": 80
        }
      }
  "30":
    id: "30"
    ignoreworker: false
    nexttasks:
      '#none#':
      - "22"
    note: false
    quietmode: 0
    scriptarguments:
      append:
        simple: "false"
      key:
        simple: ProviderDomains
      stringify: {}
      value:
        complex:
          root: inputs.GCPDomains
          transformers:
          - args:
              delimiter:
                value:
                  simple: ','
            operator: splitAndTrim
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      description: Set a value in context under the key you entered. If no value is entered, the script doesn't do anything.
      id: 7e67b5d0-67c7-4af5-8f06-f00807bddc8b
      iscommand: false
      name: Split GCP Domains
      script: SetAndHandleEmpty
      type: regular
      version: -1
    taskid: 7e67b5d0-67c7-4af5-8f06-f00807bddc8b
    timertriggers: []
    type: regular
    view: |-
      {
        "position": {
          "x": 1120,
          "y": -590
        }
      }
  "31":
    id: "31"
    ignoreworker: false
    nexttasks:
      '#none#':
      - "7"
    note: false
    quietmode: 0
    scriptarguments:
      query:
        complex:
          accessor: domain
          root: NONGCPSplitFQDN
          transformers:
          - args:
              prefix:
                value:
                  simple: 'dnsName equals '
              suffix:
                value:
                  simple: .
            operator: concat
          - args:
              separator:
                value:
                  simple: ' OR '
            operator: join
          - args:
              prefix:
                value:
                  simple: 'config from cloud.resource where cloud.type = ''gcp'' AND cloud.service = ''Google Cloud DNS'' AND api.name = ''gcloud-dns-managed-zone'' AND json.rule = ( '
              suffix:
                value:
                  simple: ' )'
            operator: concat
    separatecontext: false
    skipunavailable: false
    task:
      brand: PrismaCloud v2
      description: Search configuration inventory on the Prisma Cloud platform using RQL language. Use this command for all queries that start with "config". When no absolute time nor relative time arguments are provided, the default time range is all times.
      id: 32767fe7-d8ea-422b-8bed-c3327a805dc7
      iscommand: true
      name: Search Zone Name in Google Cloud DNS
      script: PrismaCloud v2|||prisma-cloud-config-search
      type: regular
      version: -1
    taskid: 32767fe7-d8ea-422b-8bed-c3327a805dc7
    timertriggers: []
    type: regular
    view: |-
      {
        "position": {
          "x": -170,
          "y": 590
        }
      }
version: -1
view: |-
  {
    "linkLabelsPosition": {
      "12_14_#default#": 0.29,
      "15_14_#default#": 0.16,
      "24_7_#default#": 0.43,
      "26_7_#default#": 0.22
    },
    "paper": {
      "dimensions": {
        "height": 2545,
        "width": 2380,
        "x": -170,
        "y": -1210
      }
    }
  }
fromversion: 6.5.0
tests:
- No tests