Prisma Cloud - Find GCP Resource by Public IP Deprecated Hidden

Deprecated. Use Prisma Cloud - Find GCP Resource by Public IP v2 instead. Find GCP resources by Public IP using Prisma Cloud inventory. Supported services: GCE, Load Balancing, GKE.

Prisma Cloud by Palo Alto Networks · 11 tasks · 1 input · 1 output

Details

ID	`Prisma Cloud - Find GCP Resource by Public IP`
From Version	6.0.0
Tasks	11

README

Find GCP resources by Public IP using Prisma Cloud inventory.
Supported services: GCE, Load Balancing, GKE.

Supported Cortex XSOAR versions: 6.0.0 and later.

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

This playbook does not use any sub-playbooks.

Integrations

PrismaCloud v2

Scripts

This playbook does not use any scripts.

Commands

redlock-search-config

Playbook Inputs

Name	Description	Default Value	Required
PublicIPAddress	Public IP Address to look up		Required

Playbook Outputs

Path	Description	Type
PrismaCloud.Attribution	Prisma Cloud attributed asset information.	unknown

Playbook Image

Prisma Cloud - Find GCP Resource by Public IP

Inputs

PublicIPAddress — Public IP Address to look up

Outputs

PrismaCloud.Attribution — Prisma Cloud attributed asset information.

Commands used

redlock-search-config

Flowchart

Source

playbook-Prisma_Cloud_-_Find_GCP_Resource_by_Public_IP.yml playbook-Prisma_Cloud_-_Find_GCP_Resource_by_Public_IP_v2.yml playbook-Prisma_Cloud_-_Find_GCP_Resource_by_Public_IP_v2_README.md

Download History Raw

description: |
  Deprecated. Use Prisma Cloud - Find GCP Resource by Public IP v2 instead.
  Find GCP resources by Public IP using Prisma Cloud inventory.
  Supported services: GCE, Load Balancing, GKE.
id: Prisma Cloud - Find GCP Resource by Public IP
inputs:
- description: Public IP Address to look up
  key: PublicIPAddress
  playbookInputQuery:
  required: true
  value: {}
name: Prisma Cloud - Find GCP Resource by Public IP
outputs:
- contextPath: PrismaCloud.Attribution
  description: Prisma Cloud attributed asset information.
  type: unknown
starttaskid: "0"
tasks:
  "0":
    id: "0"
    ignoreworker: false
    nexttasks:
      '#none#':
      - "16"
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      id: 40ae166d-0493-41d3-81e3-04b87913975e
      iscommand: false
      name: ""
      version: -1
      description: ''
    taskid: 40ae166d-0493-41d3-81e3-04b87913975e
    timertriggers: []
    type: start
    view: |-
      {
        "position": {
          "x": 1700,
          "y": -490
        }
      }
  "7":
    id: "7"
    ignoreworker: false
    nexttasks:
      '#none#':
      - "11"
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      id: 0cb94f5d-6592-46b9-8944-d690e893d4f0
      iscommand: false
      name: Check Results
      type: title
      version: -1
      description: ''
    taskid: 0cb94f5d-6592-46b9-8944-d690e893d4f0
    timertriggers: []
    type: title
    view: |-
      {
        "position": {
          "x": 760,
          "y": 320
        }
      }
  "8":
    id: "8"
    ignoreworker: false
    nexttasks:
      '#none#':
      - "7"
    note: false
    quietmode: 0
    scriptarguments:
      query:
        complex:
          root: inputs.PublicIPAddress
          transformers:
          - args:
              prefix:
                value:
                  simple: 'networkInterfaces[*].accessConfigs[*].natIP equals '
              suffix: {}
            operator: concat
          - args:
              separator:
                value:
                  simple: ' OR '
            operator: join
          - args:
              prefix:
                value:
                  simple: 'config from cloud.resource where cloud.type = ''gcp'' AND
                    cloud.service = ''Google Compute Engine'' AND api.name = ''gcloud-compute-instances-list''
                    AND json.rule = ( '
              suffix:
                value:
                  simple: ' )'
            operator: concat
      time-range-date-from: {}
      time-range-date-to: {}
      time-range-date-unit: {}
      time-range-date-value: {}
    separatecontext: false
    skipunavailable: false
    task:
      brand: PrismaCloud v2
      description: Search GCE instances in Prisma Cloud
      id: fc1bee60-2efe-45c8-8142-fac341a44269
      iscommand: true
      name: Search in GCE
      script: PrismaCloud v2|||redlock-search-config
      type: regular
      version: -1
    taskid: fc1bee60-2efe-45c8-8142-fac341a44269
    timertriggers: []
    type: regular
    view: |-
      {
        "position": {
          "x": 1230,
          "y": 150
        }
      }
  "11":
    conditions:
    - condition:
      - - left:
            iscontext: true
            value:
              complex:
                accessor: Config
                root: PrismaCloud
          operator: isNotEmpty
      label: "yes"
    id: "11"
    ignoreworker: false
    nexttasks:
      '#default#':
      - "13"
      "yes":
      - "12"
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      description: Check whether results are found.
      id: 4aa5d0c6-5377-44d3-8c4c-21a8fb48c98c
      iscommand: false
      name: Are Results Found?
      type: condition
      version: -1
    taskid: 4aa5d0c6-5377-44d3-8c4c-21a8fb48c98c
    timertriggers: []
    type: condition
    view: |-
      {
        "position": {
          "x": 760,
          "y": 460
        }
      }
  "12":
    id: "12"
    ignoreworker: false
    nexttasks:
      '#none#':
      - "13"
    note: false
    quietmode: 0
    scriptarguments:
      assets:
        complex:
          accessor: Config
          root: PrismaCloud
      fields: {}
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      description: Prisma Cloud Attribution
      id: c03a4b71-274f-4deb-8181-94b4f9a24fbc
      iscommand: false
      name: Transform Results
      script: PrismaCloudAttribution
      type: regular
      version: -1
    taskid: c03a4b71-274f-4deb-8181-94b4f9a24fbc
    timertriggers: []
    type: regular
    view: |-
      {
        "position": {
          "x": 570,
          "y": 630
        }
      }
  "13":
    id: "13"
    ignoreworker: false
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      id: bba7b4a9-db1c-4c8f-8027-5e866a59a9e0
      iscommand: false
      name: Done
      type: title
      version: -1
      description: ''
    taskid: bba7b4a9-db1c-4c8f-8027-5e866a59a9e0
    timertriggers: []
    type: title
    view: |-
      {
        "position": {
          "x": 1700,
          "y": 800
        }
      }
  "14":
    id: "14"
    ignoreworker: false
    nexttasks:
      '#none#':
      - "8"
      - "17"
      - "18"
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      id: 4e860905-c7fb-4773-88d2-d5e9ad1fb69f
      iscommand: false
      name: Search in Prisma Cloud
      type: title
      version: -1
      description: ''
    taskid: 4e860905-c7fb-4773-88d2-d5e9ad1fb69f
    timertriggers: []
    type: title
    view: |-
      {
        "position": {
          "x": 770,
          "y": 10
        }
      }
  "15":
    conditions:
    - condition:
      - - left:
            iscontext: true
            value:
              complex:
                filters:
                - - left:
                      iscontext: true
                      value:
                        simple: modules.brand
                    operator: isEqualString
                    right:
                      value:
                        simple: PrismaCloud v2
                - - left:
                      iscontext: true
                      value:
                        simple: modules.state
                    operator: isEqualString
                    right:
                      value:
                        simple: active
                root: modules
          operator: isExists
      label: "yes"
    id: "15"
    ignoreworker: false
    nexttasks:
      '#default#':
      - "13"
      "yes":
      - "14"
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      description: Check whether Prisma Cloud integration is enabled.
      id: ac7c817e-0ce6-4ce7-84da-0d024490e54c
      iscommand: false
      name: Is Prisma Cloud enabled?
      type: condition
      version: -1
    taskid: ac7c817e-0ce6-4ce7-84da-0d024490e54c
    timertriggers: []
    type: condition
    view: |-
      {
        "position": {
          "x": 1290,
          "y": -160
        }
      }
  "16":
    conditions:
    - condition:
      - - left:
            iscontext: true
            value:
              complex:
                root: inputs.PublicIPAddress
          operator: isNotEmpty
      label: "yes"
    id: "16"
    ignoreworker: false
    nexttasks:
      '#default#':
      - "13"
      "yes":
      - "15"
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      description: Check if there are any IP in the input.
      id: ab1813c3-3d15-49f5-8260-d0382f60da8a
      iscommand: false
      name: Are there IPs in input?
      type: condition
      version: -1
    taskid: ab1813c3-3d15-49f5-8260-d0382f60da8a
    timertriggers: []
    type: condition
    view: |-
      {
        "position": {
          "x": 1700,
          "y": -330
        }
      }
  "17":
    id: "17"
    ignoreworker: false
    nexttasks:
      '#none#':
      - "7"
    note: false
    quietmode: 0
    scriptarguments:
      query:
        complex:
          root: inputs.PublicIPAddress
          transformers:
          - args:
              prefix:
                value:
                  simple: 'globalForwardingRules[*].IPAddress equals '
              suffix: {}
            operator: concat
          - args:
              separator:
                value:
                  simple: ' OR '
            operator: join
          - args:
              prefix:
                value:
                  simple: 'config from cloud.resource where cloud.type = ''gcp'' AND
                    cloud.service = ''Google Cloud Load Balancing'' AND api.name =
                    ''gcloud-compute-global-forwarding-rule'' AND json.rule = ( '
              suffix:
                value:
                  simple: ' )'
            operator: concat
      time-range-date-from: {}
      time-range-date-to: {}
      time-range-date-unit: {}
      time-range-date-value: {}
      time-range-unit: {}
      time-range-value: {}
    separatecontext: false
    skipunavailable: false
    task:
      brand: PrismaCloud v2
      description: Search GCE instances in Prisma Cloud
      id: 1ef4f6a9-1e5b-410d-8d44-0fa35f15118f
      iscommand: true
      name: Search in Google Cloud Load Balancing
      script: PrismaCloud v2|||redlock-search-config
      type: regular
      version: -1
    taskid: 1ef4f6a9-1e5b-410d-8d44-0fa35f15118f
    timertriggers: []
    type: regular
    view: |-
      {
        "position": {
          "x": 770,
          "y": 150
        }
      }
  "18":
    id: "18"
    ignoreworker: false
    nexttasks:
      '#none#':
      - "7"
    note: false
    quietmode: 0
    scriptarguments:
      query:
        complex:
          root: inputs.PublicIPAddress
          transformers:
          - args:
              prefix:
                value:
                  simple: 'endpoint equals '
              suffix: {}
            operator: concat
          - args:
              separator:
                value:
                  simple: ' OR '
            operator: join
          - args:
              prefix:
                value:
                  simple: 'config from cloud.resource where cloud.type = ''gcp'' AND
                    cloud.service = ''Google Kubernetes Engine'' AND api.name = ''gcloud-container-describe-clusters''
                    AND json.rule = ( '
              suffix:
                value:
                  simple: ' )'
            operator: concat
      time-range-date-from: {}
      time-range-date-to: {}
      time-range-date-unit: {}
      time-range-date-value: {}
      time-range-unit: {}
      time-range-value: {}
    separatecontext: false
    skipunavailable: false
    task:
      brand: PrismaCloud v2
      description: Search GCE instances in Prisma Cloud
      id: 2c5ee418-ee55-4f6c-84b5-a21227fa2110
      iscommand: true
      name: Search in GKE
      script: PrismaCloud v2|||redlock-search-config
      type: regular
      version: -1
    taskid: 2c5ee418-ee55-4f6c-84b5-a21227fa2110
    timertriggers: []
    type: regular
    view: |-
      {
        "position": {
          "x": 340,
          "y": 150
        }
      }
version: -1
view: |-
  {
    "linkLabelsPosition": {
      "11_13_#default#": 0.12,
      "15_13_#default#": 0.23,
      "16_13_#default#": 0.34
    },
    "paper": {
      "dimensions": {
        "height": 1355,
        "width": 1740,
        "x": 340,
        "y": -490
      }
    }
  }
fromversion: 6.0.0
tests:
- No tests (deprecated)
deprecated: true
hidden: true