PrismaCloudAttribution

Recursively extracts specified fields from provided list of assets for Prisma Cloud attribution use case.

python · Prisma Cloud by Palo Alto Networks

Details

IDPrismaCloudAttribution
Languagepython
From Version6.0.0
Docker Imagedemisto/python3:3.12.13.10116658

README

Recursively extracts specified fields from provided list of assets for Prisma Cloud attribution use case.

Script Data

Name Description
Script Type python3
Tags  
Cortex XSOAR Version 6.0.0

Inputs

Argument Name Description
assets List of Prisma Cloud assets to return.
fields Fields to be returned (comma separated).

Outputs

Path Description Type
PrismaCloud.Attribution.accountId Cloud Account ID Unknown
PrismaCloud.Attribution.accountName Cloud Account Name Unknown
PrismaCloud.Attribution.cloudType Cloud Type Unknown
PrismaCloud.Attribution.fqdn FQDNs associated to the resource Unknown
PrismaCloud.Attribution.rrn Resource RRN Unknown
PrismaCloud.Attribution.ip IPs associated to the resource Unknown
PrismaCloud.Attribution.regionId Cloud Region ID Unknown
PrismaCloud.Attribution.hasAlert Resource has Prisma Cloud Alert Unknown
PrismaCloud.Attribution.resourceName Resource Name Unknown
PrismaCloud.Attribution.resourceType Resource Type Unknown
PrismaCloud.Attribution.service Cloud Service Unknown

Script Example

!PrismaCloudAttribution assets="${Redlock.Asset}"

Context Example

{
    "PrismaCloud": {
        "Attribution": [
            {
                "accountId": "123456",
                "accountName": "aws-user-personal",
                "cloudType": "aws",
                "fqdn": [
                    "application-lb-123456.us-east-1.elb.amazonaws.com"
                ],
                "hasAlert": false,
                "id": "arn:aws:elasticloadbalancing:us-east-1:123456:loadbalancer/app/application-lb/1398164320221c02",
                "ip": null,
                "regionId": "us-east-1",
                "resourceName": "application-lb",
                "resourceType": "Managed Load Balancer",
                "rrn": "rrn::managedLb:us-east-1:123456:b38d940663c047b02c2116be49695cf353976dff:arn%3Aaws%3Aelasticloadbalancing%3Aus-east-1%3A123456%3Aloadbalancer%2Fapp%2Fapplication-lb%2F1398164320221c02",
                "service": "Amazon Elastic Load Balancing"
            },
            {
                "accountId": "123456",
                "accountName": "aws-user-personal",
                "cloudType": "aws",
                "fqdn": [
                    "ec2.eu.compute-1.amazonaws.com"
                ],
                "hasAlert": false,
                "id": "i-654321b",
                "ip": [
                    "35.180.1.1"
                ],
                "regionId": "eu-west-3",
                "resourceName": "testvm",
                "resourceType": "Instance",
                "rrn": "rrn::instance:eu-west-3:123456:9db2db5fdba47606863c8da86d3ae594fb5aee2b:i-654321b",
                "service": "Amazon EC2"
            }
        ]
    }
}

Human Readable Output

Results

accountId accountName cloudType fqdn hasAlert id ip regionId resourceName resourceType rrn service
12345 aws-user-personal aws application-lb-624166765.us-east-1.elb.amazonaws.com false arn:aws:elasticloadbalancing:us-east-1:12345:loadbalancer/app/application-lb/1398164320221c02   us-east-1 application-lb Managed Load Balancer rrn::managedLb:us-east-1:12345:b38d940663c047b02c2116be49695cf353976dff:arn%3Aaws%3Aelasticloadbalancing%3Aus-east-1%3A12345%3Aloadbalancer%2Fapp%2Fapplication-lb%2F1398164320221c02 Amazon Elastic Load Balancing
12345 aws-user-personal aws ec2.eu.amazonaws.com false i-654321 35.180.1.1 eu-west-3 testvm Instance rrn::instance:eu-west-3:12345:9db2db5fdba47606863c8da86d3ae594fb5aee2b:i-654321 Amazon EC2

Source

PrismaCloudAttribution.py PrismaCloudAttribution_test.py PrismaCloudAttribution.yml
Download History Raw 
import json

import demistomock as demisto  # noqa # pylint: disable=unused-wildcard-import
from PrismaCloudAttribution import attribution_command

MOCK_RESULT = [
    {
        "accountId": "123456",
        "accountName": "aws-user-personal",
        "cloudType": "aws",
        "fqdn": ["application-lb-123456.us-east-1.elb.amazonaws.com"],
        "hasAlert": False,
        "id": "arn:aws:elasticloadbalancing:us-east-1:123456:loadbalancer/app/application-lb/1398164320221c02",
        "ip": None,
        "regionId": "us-east-1",
        "resourceName": "application-lb",
        "resourceType": "Managed Load Balancer",
        "rrn": (
            "rrn::managedLb:us-east-1:123456:b38d940663c047b02c2116be49695cf353976dff:arn%3Aaws"
            "%3Aelasticloadbalancing%3Aus-east-1%3A123456%3Aloadbalancer%2Fapp%2Fapplication-lb"
            "%2F1398164320221c02"
        ),
        "service": "Amazon Elastic Load Balancing",
    },
    {
        "accountId": "123456",
        "accountName": "aws-user-personal",
        "cloudType": "aws",
        "fqdn": ["ec2.eu.compute-1.amazonaws.com"],
        "hasAlert": False,
        "id": "i-654321b",
        "ip": ["35.180.1.1"],
        "regionId": "eu-west-3",
        "resourceName": "testvm",
        "resourceType": "Instance",
        "rrn": "rrn::instance:eu-west-3:123456:9db2db5fdba47606863c8da86d3ae594fb5aee2b:i-654321b",
        "service": "Amazon EC2",
    },
]


def util_load_json(path):
    with open(path, encoding="utf-8") as f:
        return json.loads(f.read())


def test_match_ip_in_cidr_indicators(mocker):
    """
    Given:
        - list of prisma cloud assets as returned by redlock-search-config
    When
        - extracting a subset of fields from Prisma Cloud asset list
    Then
        - the expected subset of fields is returned to Context
    """
    mock_assets = util_load_json("test_data/assets.json")

    result = attribution_command({"assets": mock_assets})

    assert result.outputs_prefix == "PrismaCloud.Attribution"
    assert result.outputs_key_field == "rrn"
    assert result.outputs == MOCK_RESULT