Prisma Cloud - Find GCP Resource by Public IP v2

Find GCP resources by Public IP using Prisma Cloud inventory. Supported services: GCE, Load Balancing, GKE.
Prisma Cloud by Palo Alto Networks · 11 tasks · 1 input · 2 outputs
Details

ID	`Prisma Cloud - Find GCP Resource by Public IP v2`
From Version	6.8.0
Tasks	11
README

Find GCP resources by Public IP using Prisma Cloud inventory.
Supported services: GCE, Load Balancing, GKE.
Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.
Sub-playbooks

This playbook does not use any sub-playbooks.
Integrations

PrismaCloud v2
Scripts

PrismaCloudAttribution
Commands

prisma-cloud-config-search
Playbook Inputs

Name	Description	Default Value	Required
PublicIPAddress	Public IP address to look up.		Required
Playbook Outputs

Path	Description	Type
PrismaCloud.Attribution	Prisma Cloud attributed asset information.	unknown
PrismaCloud.Config.data.tags	Prisma Cloud Tags information.	unknown
Playbook Image

Prisma Cloud - Find GCP Resource by Public IP v2
Inputs

PublicIPAddress — Public IP address to look up.
Outputs

PrismaCloud.Attribution — Prisma Cloud attributed asset information.
PrismaCloud.Config.data.tags — Prisma Cloud Tags information.
Commands used

prisma-cloud-config-search
Flowchart

Source

playbook-Prisma_Cloud_-_Find_GCP_Resource_by_Public_IP_v2.yml
Download History Raw
id: Prisma Cloud - Find GCP Resource by Public IP v2
version: -1
contentitemexportablefields:
  contentitemfields: {}
name: Prisma Cloud - Find GCP Resource by Public IP v2
description: |
  Find GCP resources by Public IP using Prisma Cloud inventory.
  Supported services: GCE, Load Balancing, GKE.
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: 40ae166d-0493-41d3-81e3-04b87913975e
    type: start
    task:
      id: 40ae166d-0493-41d3-81e3-04b87913975e
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "16"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1700,
          "y": -490
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "7":
    id: "7"
    taskid: 0cb94f5d-6592-46b9-8944-d690e893d4f0
    type: title
    task:
      id: 0cb94f5d-6592-46b9-8944-d690e893d4f0
      version: -1
      name: Check Results
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "11"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 760,
          "y": 320
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "8":
    id: "8"
    taskid: fc1bee60-2efe-45c8-8142-fac341a44269
    type: regular
    task:
      id: fc1bee60-2efe-45c8-8142-fac341a44269
      version: -1
      name: Search in GCE
      description: Search GCE instances in Prisma Cloud.
      script: PrismaCloud v2|||prisma-cloud-config-search
      type: regular
      iscommand: true
      brand: PrismaCloud v2
    nexttasks:
      '#none#':
      - "7"
    scriptarguments:
      query:
        complex:
          root: inputs.PublicIPAddress
          transformers:
          - operator: concat
            args:
              prefix:
                value:
                  simple: 'networkInterfaces[*].accessConfigs[*].natIP equals '
              suffix: {}
          - operator: join
            args:
              separator:
                value:
                  simple: ' OR '
          - operator: concat
            args:
              prefix:
                value:
                  simple: 'config from cloud.resource where cloud.type = ''gcp'' AND cloud.service = ''Google Compute Engine'' AND api.name = ''gcloud-compute-instances-list'' AND json.rule = ( '
              suffix:
                value:
                  simple: ' )'
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1230,
          "y": 150
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "11":
    id: "11"
    taskid: 4aa5d0c6-5377-44d3-8c4c-21a8fb48c98c
    type: condition
    task:
      id: 4aa5d0c6-5377-44d3-8c4c-21a8fb48c98c
      version: -1
      name: Are Results Found?
      description: Check whether results are found.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "13"
      "yes":
      - "12"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: PrismaCloud
                accessor: Config
            iscontext: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 760,
          "y": 460
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "12":
    id: "12"
    taskid: c03a4b71-274f-4deb-8181-94b4f9a24fbc
    type: regular
    task:
      id: c03a4b71-274f-4deb-8181-94b4f9a24fbc
      version: -1
      name: Transform Results
      description: Prisma Cloud Attribution.
      scriptName: PrismaCloudAttribution
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "13"
    scriptarguments:
      assets:
        complex:
          root: PrismaCloud
          accessor: Config
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 570,
          "y": 630
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "13":
    id: "13"
    taskid: bba7b4a9-db1c-4c8f-8027-5e866a59a9e0
    type: title
    task:
      id: bba7b4a9-db1c-4c8f-8027-5e866a59a9e0
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1700,
          "y": 800
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "14":
    id: "14"
    taskid: 4e860905-c7fb-4773-88d2-d5e9ad1fb69f
    type: title
    task:
      id: 4e860905-c7fb-4773-88d2-d5e9ad1fb69f
      version: -1
      name: Search in Prisma Cloud
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "8"
      - "17"
      - "18"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 770,
          "y": 10
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "15":
    id: "15"
    taskid: ac7c817e-0ce6-4ce7-84da-0d024490e54c
    type: condition
    task:
      id: ac7c817e-0ce6-4ce7-84da-0d024490e54c
      version: -1
      name: Is Prisma Cloud enabled?
      description: Check whether Prisma Cloud integration is enabled.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "13"
      "yes":
      - "14"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: modules
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.brand
                      iscontext: true
                    right:
                      value:
                        simple: PrismaCloud v2
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.state
                      iscontext: true
                    right:
                      value:
                        simple: active
            iscontext: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1290,
          "y": -160
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "16":
    id: "16"
    taskid: ab1813c3-3d15-49f5-8260-d0382f60da8a
    type: condition
    task:
      id: ab1813c3-3d15-49f5-8260-d0382f60da8a
      version: -1
      name: Are there IPs in input?
      description: Check if there are any IPs in the input.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "13"
      "yes":
      - "15"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.PublicIPAddress
            iscontext: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1700,
          "y": -330
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "17":
    id: "17"
    taskid: 1ef4f6a9-1e5b-410d-8d44-0fa35f15118f
    type: regular
    task:
      id: 1ef4f6a9-1e5b-410d-8d44-0fa35f15118f
      version: -1
      name: Search in Google Cloud Load Balancing
      description: Search GCE instances in Prisma Cloud.
      script: PrismaCloud v2|||prisma-cloud-config-search
      type: regular
      iscommand: true
      brand: PrismaCloud v2
    nexttasks:
      '#none#':
      - "7"
    scriptarguments:
      query:
        complex:
          root: inputs.PublicIPAddress
          transformers:
          - operator: concat
            args:
              prefix:
                value:
                  simple: 'globalForwardingRules[*].IPAddress equals '
              suffix: {}
          - operator: join
            args:
              separator:
                value:
                  simple: ' OR '
          - operator: concat
            args:
              prefix:
                value:
                  simple: 'config from cloud.resource where cloud.type = ''gcp'' AND cloud.service = ''Google Cloud Load Balancing'' AND api.name = ''gcloud-compute-global-forwarding-rule'' AND json.rule = ( '
              suffix:
                value:
                  simple: ' )'
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 770,
          "y": 150
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "18":
    id: "18"
    taskid: 2c5ee418-ee55-4f6c-84b5-a21227fa2110
    type: regular
    task:
      id: 2c5ee418-ee55-4f6c-84b5-a21227fa2110
      version: -1
      name: Search in GKE
      description: Search GCE instances in Prisma Cloud.
      script: PrismaCloud v2|||prisma-cloud-config-search
      type: regular
      iscommand: true
      brand: PrismaCloud v2
    nexttasks:
      '#none#':
      - "7"
    scriptarguments:
      query:
        complex:
          root: inputs.PublicIPAddress
          transformers:
          - operator: concat
            args:
              prefix:
                value:
                  simple: 'endpoint equals '
              suffix: {}
          - operator: join
            args:
              separator:
                value:
                  simple: ' OR '
          - operator: concat
            args:
              prefix:
                value:
                  simple: 'config from cloud.resource where cloud.type = ''gcp'' AND cloud.service = ''Google Kubernetes Engine'' AND api.name = ''gcloud-container-describe-clusters'' AND json.rule = ( '
              suffix:
                value:
                  simple: ' )'
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 340,
          "y": 150
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
view: |-
  {
    "linkLabelsPosition": {
      "11_13_#default#": 0.12,
      "15_13_#default#": 0.23,
      "16_13_#default#": 0.34
    },
    "paper": {
      "dimensions": {
        "height": 1355,
        "width": 1740,
        "x": 340,
        "y": -490
      }
    }
  }
inputs:
- key: PublicIPAddress
  value: {}
  required: true
  description: Public IP address to look up.
  playbookInputQuery:
outputs:
- contextPath: PrismaCloud.Attribution
  description: Prisma Cloud attributed asset information.
  type: unknown
- contextPath: PrismaCloud.Config.data.tags
  description: Prisma Cloud Tags information.
  type: unknown
tests:
- No tests (auto formatted)
fromversion: 6.8.0