PrismaCloudComputeParseCloudDiscoveryAlert

Parse Cloud Discovery alert raw JSON data.

python · Prisma Cloud Compute by Palo Alto Networks

Details

IDPrismaCloudComputeParseCloudDiscoveryAlert
Languagepython
From Version5.0.0
Docker Imagedemisto/python3:3.12.13.10116658
TagsPrisma Cloud Compute

README

Parse Cloud Discovery alert raw JSON data

Script Data

Name Description
Script Type python3
Tags Prisma Cloud Compute
Cortex XSOAR Version 5.0.0

Used In

This script is used in the following playbooks and scripts.

  • Prisma Cloud Compute - Cloud Discovery Alert

Inputs

Argument Name Description
alert_raw_json The compliance alert raw JSON

Outputs

Path Description Type
PrismaCloudCompute.CloudDiscoveryAlert.time Time represents the alert creation timestamp Date
PrismaCloudCompute.CloudDiscoveryAlert.credentialId CredentialID is the id reference of the credential used String
PrismaCloudCompute.CloudDiscoveryAlert.provider Provider is the cloud provider for example: AWS, GCP String
PrismaCloudCompute.CloudDiscoveryAlert.serviceType ServiceType is the cloud service type for example: ECR, GCR String
PrismaCloudCompute.CloudDiscoveryAlert.region Region is the region that was scanned, for example: GCP - “us-east-1”, Azure - “westus” String
PrismaCloudCompute.CloudDiscoveryAlert.project Project is the GCP project that was scanned String
PrismaCloudCompute.CloudDiscoveryAlert.registry Registry is the Azure registry that was scanned, for example: testcloudscanregistry.azurecr.io String
PrismaCloudCompute.CloudDiscoveryAlert.protected Protected is the number of protected entities (registries, functions, clusters) Number
PrismaCloudCompute.CloudDiscoveryAlert.total Total is total number of entities found in cloud scan Number
PrismaCloudCompute.CloudDiscoveryAlert.err Err holds any error found during a scan String
PrismaCloudCompute.CloudDiscoveryAlert.entities.name Name is the name of the entity String
PrismaCloudCompute.CloudDiscoveryAlert.entities.protected Protected indicates if the entity is protected Number
PrismaCloudCompute.CloudDiscoveryAlert.entities.lastModified LastModified is the modification time of the function Date
PrismaCloudCompute.CloudDiscoveryAlert.entities.runtime Runtime is runtime environment for the function, e.g. nodejs String
PrismaCloudCompute.CloudDiscoveryAlert.entities.version Version is the version of the entity String
PrismaCloudCompute.CloudDiscoveryAlert.entities.arn The Amazon Resource Name (ARN) assigned to the entity String
PrismaCloudCompute.CloudDiscoveryAlert.entities.status Status is the current status of entity String
PrismaCloudCompute.CloudDiscoveryAlert.entities.runningTasksCount RunningTasksCount is the number of running tasks in ecs cluster Number
PrismaCloudCompute.CloudDiscoveryAlert.entities.activeServicesCount ActiveServicesCount is the number of active services in ecs cluster Number
PrismaCloudCompute.CloudDiscoveryAlert.entities.createdAt CreatedAt is the time when the entity was created Date
PrismaCloudCompute.CloudDiscoveryAlert.entities.nodesCount NodesCount is the number of nodes in the cluster (aks, gke) Number
PrismaCloudCompute.CloudDiscoveryAlert.entities.resourceGroup ResourceGroup is the the azure resource group containing the entity String
PrismaCloudCompute.CloudDiscoveryAlert.entities.containerGroup ContainerGroup is the azure aci container group the container belongs to String
PrismaCloudCompute.CloudDiscoveryAlert.entities.image Image is the image of an aci container String
PrismaCloudCompute.CloudDiscoveryAlert.collections Collections are the matched result collections String
PrismaCloudCompute.CloudDiscoveryAlert.accountID AccountID is the cloud account ID Date

Source

PrismaCloudComputeParseCloudDiscoveryAlert.py PrismaCloudComputeParseCloudDiscoveryAlert_test.py PrismaCloudComputeParseCloudDiscoveryAlert.yml
Download History Raw 
args:
- description: The compliance alert raw JSON.
  name: alert_raw_json
  required: true
tags:
- Prisma Cloud Compute
comment: Parse Cloud Discovery alert raw JSON data.
commonfields:
  id: PrismaCloudComputeParseCloudDiscoveryAlert
  version: -1
name: PrismaCloudComputeParseCloudDiscoveryAlert
outputs:
- contextPath: PrismaCloudCompute.CloudDiscoveryAlert.time
  description: 'Time represents the alert creation timestamp.'
  type: Date
- contextPath: PrismaCloudCompute.CloudDiscoveryAlert.credentialId
  description: 'CredentialID is the id reference of the credential used.'
  type: String
- contextPath: PrismaCloudCompute.CloudDiscoveryAlert.provider
  description: 'Provider is the cloud provider for example: AWS, GCP.'
  type: String
- contextPath: PrismaCloudCompute.CloudDiscoveryAlert.serviceType
  description: 'ServiceType is the cloud service type for example: ECR, GCR.'
  type: String
- contextPath: PrismaCloudCompute.CloudDiscoveryAlert.region
  description: 'Region is the region that was scanned, for example: GCP - "us-east-1", Azure - "westus".'
  type: String
- contextPath: PrismaCloudCompute.CloudDiscoveryAlert.project
  description: 'Project is the GCP project that was scanned.'
  type: String
- contextPath: PrismaCloudCompute.CloudDiscoveryAlert.registry
  description: 'Registry is the Azure registry that was scanned, for example: testcloudscanregistry.azurecr.io'
  type: String
- contextPath: PrismaCloudCompute.CloudDiscoveryAlert.protected
  description: 'Protected is the number of protected entities (registries, functions, clusters).'
  type: Number
- contextPath: PrismaCloudCompute.CloudDiscoveryAlert.total
  description: 'Total is total number of entities found in cloud scan.'
  type: Number
- contextPath: PrismaCloudCompute.CloudDiscoveryAlert.err
  description: 'Err holds any error found during a scan.'
  type: String
- contextPath: PrismaCloudCompute.CloudDiscoveryAlert.entities.name
  description: 'Name is the name of the entity.'
  type: String
- contextPath: PrismaCloudCompute.CloudDiscoveryAlert.entities.protected
  description: 'Protected indicates if the entity is protected.'
  type: Number
- contextPath: PrismaCloudCompute.CloudDiscoveryAlert.entities.lastModified
  description: 'LastModified is the modification time of the function.'
  type: Date
- contextPath: PrismaCloudCompute.CloudDiscoveryAlert.entities.runtime
  description: 'Runtime is runtime environment for the function, e.g. nodejs.'
  type: String
- contextPath: PrismaCloudCompute.CloudDiscoveryAlert.entities.version
  description: 'Version is the version of the entity.'
  type: String
- contextPath: PrismaCloudCompute.CloudDiscoveryAlert.entities.arn
  description: 'The Amazon Resource Name (ARN) assigned to the entity.'
  type: String
- contextPath: PrismaCloudCompute.CloudDiscoveryAlert.entities.status
  description: 'Status is the current status of entity.'
  type: String
- contextPath: PrismaCloudCompute.CloudDiscoveryAlert.entities.runningTasksCount
  description: 'RunningTasksCount is the number of running tasks in ecs cluster.'
  type: Number
- contextPath: PrismaCloudCompute.CloudDiscoveryAlert.entities.activeServicesCount
  description: 'ActiveServicesCount is the number of active services in ecs cluster.'
  type: Number
- contextPath: PrismaCloudCompute.CloudDiscoveryAlert.entities.createdAt
  description: 'CreatedAt is the time when the entity was created.'
  type: Date
- contextPath: PrismaCloudCompute.CloudDiscoveryAlert.entities.nodesCount
  description: 'NodesCount is the number of nodes in the cluster (aks, gke).'
  type: Number
- contextPath: PrismaCloudCompute.CloudDiscoveryAlert.entities.resourceGroup
  description: 'ResourceGroup is the the azure resource group containing the entity.'
  type: String
- contextPath: PrismaCloudCompute.CloudDiscoveryAlert.entities.containerGroup
  description: 'ContainerGroup is the azure aci container group the container belongs to.'
  type: String
- contextPath: PrismaCloudCompute.CloudDiscoveryAlert.entities.image
  description: 'Image is the image of an aci container.'
  type: String
- contextPath: PrismaCloudCompute.CloudDiscoveryAlert.collections
  description: 'Collections are the matched result collections.'
  type: String
- contextPath: PrismaCloudCompute.CloudDiscoveryAlert.accountID
  description: 'AccountID is the cloud account ID.'
  type: Date
script: '-'
subtype: python3
timeout: '0'
type: python
dockerimage: demisto/python3:3.12.13.10116658
fromversion: 5.0.0
tests:
- No tests (auto formatted)