Prisma Cloud Correlate Alerts Deprecated Hidden

Deprecated. Use Prisma Cloud Correlate Alerts v2 instead. Search alerts in Prisma Cloud for a specific asset ID and, if present in XSOAR, link them.

Prisma Cloud by Palo Alto Networks · 12 tasks · 2 inputs · 2 outputs

Details

IDPrisma Cloud Correlate Alerts
From Version6.0.0
Tasks12

README

Search alerts in Prisma Cloud for a specific asset ID and, if present in XSOAR, link them.
Supported Cortex XSOAR versions: 6.0.0 and later.

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

This playbook does not use any sub-playbooks.

Integrations

  • PrismaCloud v2

Scripts

  • SearchIncidentsV2
  • ToTable

Commands

  • linkIncidents
  • redlock-search-alerts

Playbook Inputs

Name Description Default Value Required
Prisma Cloud Attribution Attribution information from Prisma Cloud. PrismaCloud.Attribution Optional
Link Incidents Link found Prisma Cloud incidents to current one? True Optional

Playbook Outputs

Path Description Type
foundIncidents Found Prisma Cloud Incidents unknown
PrismaCloud.Alert Prisma Cloud Alert unknown

Playbook Image

Prisma Cloud Correlate Alerts

Inputs

  • Prisma Cloud Attribution — Attribution information from Prisma Cloud.
  • Link Incidents — Link found Prisma Cloud incidents to current one?

Outputs

  • foundIncidents — Found Prisma Cloud Incidents
  • PrismaCloud.Alert — Prisma Cloud Alert

Commands used

linkIncidents redlock-search-alerts

Flowchart

yes yes yes yes yes Start Start Prisma Cloud Alert Detection Prisma Cloud Alert Detection Are assets in Prisma Cloud found? Are assets in Prisma Clou... Done Prisma Cloud Alert Detection Done Prisma Cloud Alert D... Find Prisma Cloud Alerts for detected assets - redlock-search-alerts Find Prisma Cloud Alerts ... redlock-search-alerts Print Prisma Cloud Alerts - ToTable Print Prisma Cloud Alerts ToTable Find Prisma Cloud Incidents - SearchIncidentsV2 Find Prisma Cloud Incidents SearchIncidentsV2 Link Incidents - linkIncidents Link Incidents linkIncidents Prisma Cloud Alerts found? Prisma Cloud Alerts found? Are we linking found Prisma Cloud Incidents? Are we linking found Pris... Is Prisma Cloud enabled? Is Prisma Cloud enabled? Did we find any related Prisma Cloud incidents to link? Did we find any related P...

Source

playbook-Prisma_Cloud_Correlate_Alerts.yml playbook-Prisma_Cloud_Correlate_Alerts_v2.yml playbook-Prisma_Cloud_Correlate_Alerts_v2_README.md
Download History Raw 
id: Prisma Cloud Correlate Alerts
version: -1
contentitemexportablefields:
  contentitemfields: {}
name: Prisma Cloud Correlate Alerts
description: Deprecated. Use Prisma Cloud Correlate Alerts v2 instead. Search alerts in Prisma Cloud for a specific asset ID and, if present
  in XSOAR, link them.
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: f0892a91-8613-4cdb-8618-330e16f69af8
    type: start
    task:
      id: f0892a91-8613-4cdb-8618-330e16f69af8
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "109"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 970,
          "y": 5650
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "109":
    id: "109"
    taskid: cb8e4a34-210c-4701-84e7-004595c7e4b8
    type: title
    task:
      id: cb8e4a34-210c-4701-84e7-004595c7e4b8
      version: -1
      name: Prisma Cloud Alert Detection
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "169"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 970,
          "y": 5810
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "110":
    id: "110"
    taskid: a8c93e03-4367-44d4-88f4-1c778a392639
    type: condition
    task:
      id: a8c93e03-4367-44d4-88f4-1c778a392639
      version: -1
      name: Are assets in Prisma Cloud found?
      description: Check if Prisma Cloud assets are present
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "111"
      "yes":
      - "112"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.Prisma Cloud Attribution
            iscontext: true
    view: |-
      {
        "position": {
          "x": 680,
          "y": 6110
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "111":
    id: "111"
    taskid: 00a2c3af-78b7-4b01-885f-d5c2e01d6af9
    type: title
    task:
      id: 00a2c3af-78b7-4b01-885f-d5c2e01d6af9
      version: -1
      name: Done Prisma Cloud Alert Detection
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 970,
          "y": 7590
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "112":
    id: "112"
    taskid: 6dc73a58-59f7-4511-8884-1358d318e01f
    type: regular
    task:
      id: 6dc73a58-59f7-4511-8884-1358d318e01f
      version: -1
      name: Find Prisma Cloud Alerts for detected assets
      description: Search alerts on the Prisma Cloud platform. If no time-range
        arguments are given, the search will filter only alerts from the last 7 days.
      script: PrismaCloud v2|||redlock-search-alerts
      type: regular
      iscommand: true
      brand: PrismaCloud v2
    nexttasks:
      '#none#':
      - "113"
    scriptarguments:
      alert-id: {}
      alert-rule-name: {}
      alert-status: {}
      cloud-account: {}
      cloud-region: {}
      cloud-type: {}
      policy-compliance-standard: {}
      policy-label: {}
      policy-name: {}
      policy-severity: {}
      policy-type: {}
      resource-id:
        complex:
          root: inputs.Prisma Cloud Attribution
          accessor: id
      resource-name: {}
      resource-type: {}
      risk-grade: {}
      time-range-date-from: {}
      time-range-date-to: {}
      time-range-unit: {}
      time-range-value: {}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 440,
          "y": 6295
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "113":
    id: "113"
    taskid: b6b02f01-2db2-4859-8756-3e7ad37c9072
    type: regular
    task:
      id: b6b02f01-2db2-4859-8756-3e7ad37c9072
      version: -1
      name: Print Prisma Cloud Alerts
      description: Convert an array to a nice table display. Usually, from the context.
      scriptName: ToTable
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "167"
    scriptarguments:
      columns: {}
      data:
        complex:
          root: PrismaCloud
          accessor: Alert
          transformers:
          - operator: SetIfEmpty
            args:
              applyIfEmpty:
                value:
                  simple: "true"
              defaultValue:
                value:
                  simple: '[]'
      title:
        simple: Prisma Cloud Alerts related to discovered assets
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 440,
          "y": 6490
        }
      }
    note: true
    evidencedata:
      description:
        simple: Prisma Cloud Alerts related to assets
      customfields: {}
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "114":
    id: "114"
    taskid: f8fef3ac-24cc-4da8-808c-f528da2e4018
    type: regular
    task:
      id: f8fef3ac-24cc-4da8-808c-f528da2e4018
      version: -1
      name: Find Prisma Cloud Incidents
      description: Searches Demisto incidents
      scriptName: SearchIncidentsV2
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "170"
    scriptarguments:
      details: {}
      fromclosedate: {}
      fromdate: {}
      fromduedate: {}
      id: {}
      level: {}
      name: {}
      notstatus: {}
      owner: {}
      page: {}
      query:
        complex:
          root: PrismaCloud.Alert
          accessor: id
          transformers:
          - operator: concat
            args:
              prefix:
                value:
                  simple: 'prismacloudid:'
              suffix: {}
      reason: {}
      size: {}
      sort: {}
      status: {}
      toclosedate: {}
      todate: {}
      toduedate: {}
      type:
        simple: Prisma Cloud
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -380,
          "y": 7030
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "115":
    id: "115"
    taskid: d4bbc5e9-ca03-4c23-8d1c-6db397ff37b0
    type: regular
    task:
      id: d4bbc5e9-ca03-4c23-8d1c-6db397ff37b0
      version: -1
      name: Link Incidents
      description: commands.local.cmd.linkIncidents
      script: Builtin|||linkIncidents
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "111"
    scriptarguments:
      action:
        simple: link
      incidentId: {}
      linkedIncidentIDs:
        complex:
          root: foundIncidents
          accessor: id
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -700,
          "y": 7400
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "167":
    id: "167"
    taskid: 9fe334d8-188b-4bf0-83a1-2d82effa470e
    type: condition
    task:
      id: 9fe334d8-188b-4bf0-83a1-2d82effa470e
      version: -1
      name: Prisma Cloud Alerts found?
      description: Check if Prisma Cloud alerts were found
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "111"
      "yes":
      - "168"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: PrismaCloud
                accessor: Alert
            iscontext: true
    view: |-
      {
        "position": {
          "x": 440,
          "y": 6670
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "168":
    id: "168"
    taskid: d2dfa186-ed78-4ed7-8d06-63ca91c91c0b
    type: condition
    task:
      id: d2dfa186-ed78-4ed7-8d06-63ca91c91c0b
      version: -1
      name: Are we linking found Prisma Cloud Incidents?
      description: Check if we should link Prisma Cloud incidents to the current incident.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "111"
      "yes":
      - "114"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: foundIncidents
            iscontext: true
      - - operator: isEqualString
          left:
            value:
              complex:
                root: inputs.Link Incidents
            iscontext: true
          right:
            value:
              simple: "True"
          ignorecase: true
    view: |-
      {
        "position": {
          "x": 80,
          "y": 6840
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "169":
    id: "169"
    taskid: e44f2a90-27f4-4584-8548-e285eac679a5
    type: condition
    task:
      id: e44f2a90-27f4-4584-8548-e285eac679a5
      version: -1
      name: Is Prisma Cloud enabled?
      description: Check if the Prisma Cloud integration is enabled
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "111"
      "yes":
      - "110"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: modules
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.brand
                      iscontext: true
                    right:
                      value:
                        simple: PrismaCloud v2
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.state
                      iscontext: true
                    right:
                      value:
                        simple: active
            iscontext: true
    view: |-
      {
        "position": {
          "x": 970,
          "y": 5940
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "170":
    id: "170"
    taskid: ff612a87-2f7a-4742-8630-ef241e51577e
    type: condition
    task:
      id: ff612a87-2f7a-4742-8630-ef241e51577e
      version: -1
      name: Did we find any related Prisma Cloud incidents to link?
      description: Check if any linkable incidents are found in XSOAR.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "111"
      "yes":
      - "115"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: foundIncidents
                accessor: id
            iscontext: true
    view: |-
      {
        "position": {
          "x": -380,
          "y": 7190
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
system: true
view: |-
  {
    "linkLabelsPosition": {
      "167_111_#default#": 0.17,
      "168_111_#default#": 0.19,
      "169_111_#default#": 0.17
    },
    "paper": {
      "dimensions": {
        "height": 2005,
        "width": 2050,
        "x": -700,
        "y": 5650
      }
    }
  }
inputs:
- key: Prisma Cloud Attribution
  value:
    complex:
      root: PrismaCloud
      accessor: Attribution
  required: false
  description: Attribution information from Prisma Cloud.
  playbookInputQuery:
- key: Link Incidents
  value:
    simple: "True"
  required: false
  description: Link found Prisma Cloud incidents to current one?
  playbookInputQuery:
outputs:
- contextPath: foundIncidents
  description: Found Prisma Cloud Incidents
  type: unknown
- contextPath: PrismaCloud.Alert
  description: Prisma Cloud Alert
  type: unknown
tests:
- No tests (deprecated)
fromversion: 6.0.0
deprecated: true
hidden: true