category: Network Security provider: Palo Alto Networks commonfields: id: PaloAltoNetworks_PrismaCloudCompute version: -1 configuration: - name: isFetch display: Fetch incidents type: 8 section: Collect required: false - name: address display: |- Prisma Cloud Compute Console URL and Port required: true type: 0 additionalinfo: URL address and port of your Prisma Cloud Compute console. Copy the address from the alert profile created in Prisma Cloud Compute, for example https://example.net:1234 section: Connect - name: project display: Prisma Cloud Compute Project Name (if applicable) defaultvalue: type: 0 additionalinfo: Copy the project name from the alert profile created in Prisma Cloud Compute and paste in this field. section: Connect required: false - name: insecure display: Trust any certificate (not secure) type: 8 additionalinfo: Skips verification of the CA certificate (not recommended). section: Connect advanced: true required: false - name: proxy display: Use system proxy settings type: 8 additionalinfo: Runs the integration instance using the proxy server (HTTP or HTTPS) that you defined in the server configuration. section: Connect advanced: true required: false - name: credentials display: Username required: true defaultvalue: type: 9 additionalinfo: Prisma Cloud Compute login credentials. displaypassword: "" section: Connect - name: certificate display: Prisma Cloud Compute CA Certificate defaultvalue: type: 12 additionalinfo: CA Certificate used by Prisma Cloud Compute. Copy the certificate from the alert profile created in Prisma Cloud Compute. section: Connect required: false - name: incidentType display: Incident type type: 13 section: Connect required: false - display: Incidents Fetch Interval name: incidentFetchInterval defaultvalue: '1' required: false type: 19 section: Collect advanced: true - additionalinfo: Reliability of the source providing the intelligence data. defaultvalue: B - Usually reliable display: Source Reliability name: integration_reliability options: - A+ - 3rd party enrichment - A - Completely reliable - B - Usually reliable - C - Fairly reliable - D - Not usually reliable - E - Unreliable - F - Reliability cannot be judged type: 15 required: false section: Connect description: Use the Prisma Cloud Compute integration to fetch incidents from your Prisma Cloud Compute environment. display: Palo Alto Networks - Prisma Cloud Compute name: PaloAltoNetworks_PrismaCloudCompute script: dockerimage: demisto/python3:3.12.13.10116658 isfetch: true runonce: false script: "-" subtype: python3 type: python commands: - name: prisma-cloud-compute-profile-host-list description: Get information about the hosts and their profile events. This command supports asterisks which allows you to get host profiles by filtering its fields according to a specific substring. arguments: - name: hostname description: A comma-separated list of profile (hostname) IDs. For example, !prisma-cloud-compute-profile-host-list hostname="*149*,*257*". isArray: true defaultValue: "" - name: limit description: The maximum number of hosts and their profile events to return. Must be between 1-50. defaultValue: "15" - name: offset description: The offset by which to begin listing hosts and their profile events. defaultValue: "0" outputs: - contextPath: PrismaCloudCompute.ProfileHost._id description: The profile ID (hostname). type: String - contextPath: PrismaCloudCompute.ProfileHost.accountID description: The cloud account ID associated with the profile. type: String - contextPath: PrismaCloudCompute.ProfileHost.apps.listeningPorts.command description: The command that triggered the connection. type: String - contextPath: PrismaCloudCompute.ProfileHost.apps.listeningPorts.modified description: The timestamp of when the event occurred. type: Date - contextPath: PrismaCloudCompute.ProfileHost.apps.listeningPorts.port description: The listening port number. type: Number - contextPath: PrismaCloudCompute.ProfileHost.apps.listeningPorts.processPath description: The path to the process that uses the port. type: String - contextPath: PrismaCloudCompute.ProfileHost.apps.name description: The app name. type: String - contextPath: PrismaCloudCompute.ProfileHost.apps.outgoingPorts.command description: The command that triggered the connection. type: String - contextPath: PrismaCloudCompute.ProfileHost.apps.outgoingPorts.country description: The country ISO code for the given IP address. type: String - contextPath: PrismaCloudCompute.ProfileHost.apps.outgoingPorts.ip description: The IP address captured over this port. type: String - contextPath: PrismaCloudCompute.ProfileHost.apps.outgoingPorts.modified description: The timestamp of when the event occurred. type: Date - contextPath: PrismaCloudCompute.ProfileHost.apps.outgoingPorts.port description: The outgoing port number. type: Number - contextPath: PrismaCloudCompute.ProfileHost.apps.outgoingPorts.processPath description: The path to the process that uses the port. type: String - contextPath: PrismaCloudCompute.ProfileHost.apps.processes.command description: The executed command. type: String - contextPath: PrismaCloudCompute.ProfileHost.apps.processes.md5 description: The process binary MD5 sum. type: String - contextPath: PrismaCloudCompute.ProfileHost.apps.processes.modified description: Whether the process binary was modified after the container started. type: Boolean - contextPath: PrismaCloudCompute.ProfileHost.apps.processes.path description: The process binary path. type: String - contextPath: PrismaCloudCompute.ProfileHost.apps.processes.ppath description: The parent process path. type: String - contextPath: PrismaCloudCompute.ProfileHost.apps.processes.time description: The time in which the process was added. If the process was modified, time is the modification time. type: Date - contextPath: PrismaCloudCompute.ProfileHost.apps.processes.user description: The username of the user who started the process. type: String - contextPath: PrismaCloudCompute.ProfileHost.apps.startupProcess.command description: The executed command. type: String - contextPath: PrismaCloudCompute.ProfileHost.apps.startupProcess.md5 description: The process binary MD5 sum. type: String - contextPath: PrismaCloudCompute.ProfileHost.apps.startupProcess.modified description: Whether the process binary was modified after the container started. type: Boolean - contextPath: PrismaCloudCompute.ProfileHost.apps.startupProcess.path description: The process binary path. type: String - contextPath: PrismaCloudCompute.ProfileHost.apps.startupProcess.ppath description: The parent process path. type: String - contextPath: PrismaCloudCompute.ProfileHost.apps.startupProcess.time description: The time in which the process was added. If the process was modified, time is the modification time. type: Date - contextPath: PrismaCloudCompute.ProfileHost.apps.startupProcess.user description: The username of the user who started the process. type: String - contextPath: PrismaCloudCompute.ProfileHost.collections description: A list of collections to which this profile applies. type: String - contextPath: PrismaCloudCompute.ProfileHost.created description: The profile creation time. type: Date - contextPath: PrismaCloudCompute.ProfileHost.hash description: The uint32 hash associated with the profile. type: Number - contextPath: PrismaCloudCompute.ProfileHost.labels description: The labels associated with the profile. type: String - contextPath: PrismaCloudCompute.ProfileHost.sshEvents.command description: The executed command. type: String - contextPath: PrismaCloudCompute.ProfileHost.sshEvents.country description: The SSH client's country of origin. type: String - contextPath: PrismaCloudCompute.ProfileHost.sshEvents.ip description: The connection client IP address. type: String - contextPath: PrismaCloudCompute.ProfileHost.sshEvents.loginTime description: The SSH login time. type: Date - contextPath: PrismaCloudCompute.ProfileHost.sshEvents.md5 description: The process binary MD5 sum. type: String - contextPath: PrismaCloudCompute.ProfileHost.sshEvents.modified description: Whether the process binary was modified after the container started. type: Boolean - contextPath: PrismaCloudCompute.ProfileHost.sshEvents.path description: The process binary path. type: String - contextPath: PrismaCloudCompute.ProfileHost.sshEvents.ppath description: The parent process path. type: String - contextPath: PrismaCloudCompute.ProfileHost.sshEvents.time description: The time in which the process was added. If the process was modified, time is the modification time. type: Date - contextPath: PrismaCloudCompute.ProfileHost.sshEvents.user description: The username of the user who started the process. type: String - contextPath: PrismaCloudCompute.ProfileHost.time description: The last time this profile was modified. type: Date - contextPath: PrismaCloudCompute.ProfileHost.geoip.countries.code description: The country code of the computer that accessed the host. type: String - contextPath: PrismaCloudCompute.ProfileHost.geoip.countries.ip description: The IP address of the computer that accessed the host. type: String - contextPath: PrismaCloudCompute.ProfileHost.geoip.countries.modified description: The last time the IP address associated with this country accessed the host console. type: Date - contextPath: PrismaCloudCompute.ProfileHost.geoip.modified description: The last time any of the country IP addresses accessed the host console. type: Date - name: prisma-cloud-compute-profile-container-list description: Get information about the containers and their profile events. This command supports asterisks which allows you to get container profiles by filtering its fields according to a specific substring. arguments: - name: cluster description: A comma-separated list of runtime profile Kubernetes clusters. isArray: true defaultValue: "" - name: id description: A comma-separated list of runtime profile (hostname) IDs. For example, !prisma-cloud-compute-profile-container-list id="*256*,*148*". isArray: true defaultValue: "" - name: image description: A comma-separated list of runtime profile images. For example, !prisma-cloud-compute-profile-container-list image="*console*,*defender*". isArray: true defaultValue: "" - name: image_id description: A comma-separated list of runtime profile image IDs. For example, !prisma-cloud-compute-profile-container-list image_id="*123*,*456*". isArray: true defaultValue: "" - name: namespace description: A comma-separated list of runtime profile Kubernetes namespaces. For example, !prisma-cloud-compute-profile-container-list namespace="*namespace1*,*namespace2*". isArray: true defaultValue: "" - name: os description: A comma-separated list of service runtime profile operating systems. For example, !prisma-cloud-compute-profile-container-list os="*Red Hat*,*Windows*". isArray: true defaultValue: "" - name: state description: A comma-separated list of runtime profile states. For example, !prisma-cloud-compute-profile-container-list state=*active*. isArray: true defaultValue: "" - name: limit description: The maximum number of containers and their profile events. Must be between 1-50. defaultValue: "15" - name: offset description: The offset by which to begin listing containers and their profile events. defaultValue: "0" outputs: - contextPath: PrismaCloudCompute.ProfileContainer._id description: The profile ID. type: String - contextPath: PrismaCloudCompute.ProfileContainer.accountsIDs description: The cloud account IDs associated with the container runtime profile. type: String - contextPath: PrismaCloudCompute.ProfileContainer.archived description: Whether this profile is archived. type: Boolean - contextPath: PrismaCloudCompute.ProfileContainer.capabilities.ci description: Whether the container is allowed to write binaries to disk and run them based on static analysis. type: Boolean - contextPath: PrismaCloudCompute.ProfileContainer.capabilities.cloudMetadata description: Whether the given container can query cloud metadata API based on static analysis. type: Boolean - contextPath: PrismaCloudCompute.ProfileContainer.capabilities.dnsCache description: Whether the DNS services used by all the pods in the cluster were added to the profile based on static analysis. type: Boolean - contextPath: PrismaCloudCompute.ProfileContainer.capabilities.dynamicDNSQuery description: Whether capped behavioral DNS queries were added to the profile based on static analysis. type: Boolean - contextPath: PrismaCloudCompute.ProfileContainer.capabilities.dynamicFileCreation description: Whether capped behavioral file system paths were added to the profile based on static analysis. type: Boolean - contextPath: PrismaCloudCompute.ProfileContainer.capabilities.dynamicProcessCreation description: Whether capped behavioral processes were added to the profile based on static analysis. type: Boolean - contextPath: PrismaCloudCompute.ProfileContainer.capabilities.k8s description: Whether the given container can perform Kubernetes networking tasks (e.g., contact to API server). type: Boolean - contextPath: PrismaCloudCompute.ProfileContainer.capabilities.proxy description: Whether the container can listen on any port and perform multiple outbound connections. type: Boolean - contextPath: PrismaCloudCompute.ProfileContainer.capabilities.sshd description: Whether the container can run sshd processes. type: Boolean - contextPath: PrismaCloudCompute.ProfileContainer.capabilities.unpacker description: Whether the container is allowed to write shared libraries to disk. type: Boolean - contextPath: PrismaCloudCompute.ProfileContainer.cluster description: The provided cluster name. type: String - contextPath: PrismaCloudCompute.ProfileContainer.collections description: Collections to which this profile applies. type: String - contextPath: PrismaCloudCompute.ProfileContainer.created description: The profile creation time. type: Date - contextPath: PrismaCloudCompute.ProfileContainer.entrypoint description: The image entrypoint. type: String - contextPath: PrismaCloudCompute.ProfileContainer.events._id description: The history event entity. type: String - contextPath: PrismaCloudCompute.ProfileContainer.events.command description: The process that was executed. type: String - contextPath: PrismaCloudCompute.ProfileContainer.events.hostname description: The hostname on which the command was invoked. type: String - contextPath: PrismaCloudCompute.ProfileContainer.events.time description: The time of the event. type: Date - contextPath: PrismaCloudCompute.ProfileContainer.filesystem.behavioral.mount description: Whether the given folder is mounted. type: Boolean - contextPath: PrismaCloudCompute.ProfileContainer.filesystem.behavioral.path description: The file path. type: String - contextPath: PrismaCloudCompute.ProfileContainer.filesystem.behavioral.process description: The process that accessed the file. type: String - contextPath: PrismaCloudCompute.ProfileContainer.filesystem.behavioral.time description: The time in which the file was added. type: Date - contextPath: PrismaCloudCompute.ProfileContainer.filesystem.static.mount description: Whether the given folder is mounted. type: Boolean - contextPath: PrismaCloudCompute.ProfileContainer.filesystem.static.path description: The file path. type: String - contextPath: PrismaCloudCompute.ProfileContainer.filesystem.static.process description: The process that accessed the file. type: String - contextPath: PrismaCloudCompute.ProfileContainer.filesystem.static.time description: The time in which the file was added. type: Date - contextPath: PrismaCloudCompute.ProfileContainer.hash description: The uint32 hash associated with the profile. type: Number - contextPath: PrismaCloudCompute.ProfileContainer.hostNetwork description: Whether the instance shares the network namespace with the host. type: Boolean - contextPath: PrismaCloudCompute.ProfileContainer.hostPid description: Whether the instance shares the PID namespace with the host. type: Boolean - contextPath: PrismaCloudCompute.ProfileContainer.image description: The image the container runs with. type: String - contextPath: PrismaCloudCompute.ProfileContainer.imageID description: The profile's image ID. type: String - contextPath: PrismaCloudCompute.ProfileContainer.infra description: Whether this is an infrastructure container. type: Boolean - contextPath: PrismaCloudCompute.ProfileContainer.istio description: Whether it is an Istio-monitored profile. type: Boolean - contextPath: PrismaCloudCompute.ProfileContainer.k8s.clusterRoles.labels.key description: The key of the label. type: String - contextPath: PrismaCloudCompute.ProfileContainer.k8s.clusterRoles.labels.value description: The value of the label. type: String - contextPath: PrismaCloudCompute.ProfileContainer.k8s.clusterRoles.name description: The role name. type: String - contextPath: PrismaCloudCompute.ProfileContainer.k8s.clusterRoles.roleBinding description: The name of the role binding used for display. type: String - contextPath: PrismaCloudCompute.ProfileContainer.k8s.clusterRoles.rules description: The list of rules associated with the cluster role. type: String - contextPath: PrismaCloudCompute.ProfileContainer.k8s.roles.labels.key description: The key of the label. type: String - contextPath: PrismaCloudCompute.ProfileContainer.k8s.roles.labels.value description: The value of the label. type: String - contextPath: PrismaCloudCompute.ProfileContainer.k8s.roles.name description: The Kubernetes role name. type: String - contextPath: PrismaCloudCompute.ProfileContainer.k8s.roles.namespace description: The namespace associated with the role. type: String - contextPath: PrismaCloudCompute.ProfileContainer.k8s.roles.roleBinding description: The name of the role binding used for display. type: String - contextPath: PrismaCloudCompute.ProfileContainer.k8s.roles.rules description: The policy rules associated with the role. type: String - contextPath: PrismaCloudCompute.ProfileContainer.k8s.serviceAccount description: The service account used to access the Kubernetes API server. This field will be empty if the container is not running inside of a pod. type: String - contextPath: PrismaCloudCompute.ProfileContainer.label description: The profile's label. type: String - contextPath: PrismaCloudCompute.ProfileContainer.lastUpdate description: The last time this profile was modified. type: Date - contextPath: PrismaCloudCompute.ProfileContainer.learnedStartup description: Whether the startup events were learned. type: Boolean - contextPath: PrismaCloudCompute.ProfileContainer.namespace description: The Kubernetes deployment namespace. type: String - contextPath: PrismaCloudCompute.ProfileContainer.network.behavioral.dnsQueries.domainName description: The queried domain name. type: String - contextPath: PrismaCloudCompute.ProfileContainer.network.behavioral.dnsQueries.domainType description: The queried domain type. type: String - contextPath: PrismaCloudCompute.ProfileContainer.network.listeningPorts.app description: The name of the app. type: String - contextPath: PrismaCloudCompute.ProfileContainer.network.listeningPorts.portsData.all description: Whether this port data represents any arbitrary ports. type: Boolean - contextPath: PrismaCloudCompute.ProfileContainer.network.listeningPorts.portsData.ports.port description: The port number. type: Number - contextPath: PrismaCloudCompute.ProfileContainer.network.listeningPorts.portsData.ports.time description: The learning timestamp of this port. type: Date - contextPath: PrismaCloudCompute.ProfileContainer.network.outboundPorts.portsData.all description: Whether this port data represents any arbitrary ports. type: Boolean - contextPath: PrismaCloudCompute.ProfileContainer.network.outboundPorts.portsData.ports.port description: The port number. type: Number - contextPath: PrismaCloudCompute.ProfileContainer.network.static.listeningPorts.ports.time description: The learning timestamp of this port. type: Date - contextPath: PrismaCloudCompute.ProfileContainer.network.static.listeningPorts.app description: The name of the app. type: String - contextPath: PrismaCloudCompute.ProfileContainer.network.static.listeningPorts.portsData.all description: Whether this port data represents any arbitrary ports. type: Boolean - contextPath: PrismaCloudCompute.ProfileContainer.network.static.listeningPorts.portsData.ports.port description: The port number. type: Number - contextPath: PrismaCloudCompute.ProfileContainer.network.static.listeningPorts.portsData.ports.time description: The learning timestamp of this port. type: Date - contextPath: PrismaCloudCompute.ProfileContainer.os description: The profile image operating system. type: String - contextPath: PrismaCloudCompute.ProfileContainer.processes.behavioral.command description: The executed command. type: String - contextPath: PrismaCloudCompute.ProfileContainer.processes.behavioral.md5 description: The process binary MD5 sum. type: String - contextPath: PrismaCloudCompute.ProfileContainer.processes.behavioral.modified description: Whether the process binary was modified after the container started. type: Boolean - contextPath: PrismaCloudCompute.ProfileContainer.processes.behavioral.path description: The process binary path. type: String - contextPath: PrismaCloudCompute.ProfileContainer.processes.behavioral.ppath description: The parent process path. type: String - contextPath: PrismaCloudCompute.ProfileContainer.processes.behavioral.time description: The time in which the process was added. If the process was modified, time is the modification time. type: Date - contextPath: PrismaCloudCompute.ProfileContainer.processes.behavioral.user description: The username of the user who started the process. type: String - contextPath: PrismaCloudCompute.ProfileContainer.processes.static.command description: The executed command. type: String - contextPath: PrismaCloudCompute.ProfileContainer.processes.static.md5 description: The process binary MD5 sum. type: String - contextPath: PrismaCloudCompute.ProfileContainer.processes.static.modified description: Whether the process binary was modified after the container started. type: Boolean - contextPath: PrismaCloudCompute.ProfileContainer.processes.static.path description: The process binary path. type: String - contextPath: PrismaCloudCompute.ProfileContainer.processes.static.ppath description: The parent process path. type: String - contextPath: PrismaCloudCompute.ProfileContainer.processes.static.time description: The time in which the process was added. If the process was modified, time is the modification time. type: Date - contextPath: PrismaCloudCompute.ProfileContainer.processes.static.user description: The username of the user who started the process. type: String - contextPath: PrismaCloudCompute.ProfileContainer.relearningCause description: The reason a profile entered the learning mode after being activated. type: String - contextPath: PrismaCloudCompute.ProfileContainer.remainingLearningDurationSec description: The total time left that the system needs to finish learning this image. type: Number - contextPath: PrismaCloudCompute.ProfileContainer.state description: The current state of the profile. type: String - name: prisma-cloud-compute-profile-container-hosts-list description: Get the hosts where a specific container is running. arguments: - name: id description: Container profile ID. Can be retrieved from the "prisma-cloud-compute-profile-container-list" command. required: true defaultValue: "" - name: limit description: The maximum number of hosts to return. Must be between 1-50. defaultValue: "50" - name: offset description: The offset by which to begin listing hosts of the container. defaultValue: "0" outputs: - contextPath: PrismaCloudCompute.ProfileContainerHost.containerID description: The container ID. type: String - contextPath: PrismaCloudCompute.ProfileContainerHost.hostsIDs description: The list of hosts where this container is running. type: String - name: prisma-cloud-compute-profile-container-forensic-list description: Get runtime forensics data for a specific container on a specific. host. arguments: - name: id description: The container ID. Can be retrieved from the "prisma-cloud-compute-profile-container-list" command. required: true defaultValue: "" - name: collections description: The collections scoping the query. defaultValue: "" - name: hostname description: The hostname for which data should be fetched. Can be retrieved from the "prisma-cloud-compute-hosts-list" command. required: true defaultValue: "" - name: incident_id description: A comma-separated list of incident IDs if the request type is an incident. isArray: true defaultValue: "" - name: limit description: The maximum number of forensics data records to return. Must be between 1-50. defaultValue: "20" - name: offset description: The offset by which to begin listing records from. defaultValue: "0" outputs: - contextPath: PrismaCloudCompute.ContainerForensic.containerID description: The container ID. type: String - contextPath: PrismaCloudCompute.ContainerForensic.hostname description: The hostname. type: String - contextPath: PrismaCloudCompute.ContainerForensic.Forensics.allPorts description: Whether all listening ports are allowed. type: Boolean - contextPath: PrismaCloudCompute.ContainerForensic.Forensics.attack description: The event attack type. type: String - contextPath: PrismaCloudCompute.ContainerForensic.Forensics.category description: The incident category. type: String - contextPath: PrismaCloudCompute.ContainerForensic.Forensics.command description: The event command. type: String - contextPath: PrismaCloudCompute.ContainerForensic.Forensics.containerId description: The event container ID. type: String - contextPath: PrismaCloudCompute.ContainerForensic.Forensics.dstIP description: The destination IP address of the connection. type: String - contextPath: PrismaCloudCompute.ContainerForensic.Forensics.dstPort description: The destination port. type: String - contextPath: PrismaCloudCompute.ContainerForensic.Forensics.dstProfileID description: The profile ID of the connection destination. type: String - contextPath: PrismaCloudCompute.ContainerForensic.Forensics.effect description: The runtime audit effect. type: String - contextPath: PrismaCloudCompute.ContainerForensic.Forensics.listeningStartTime description: The port listening start time. type: Date - contextPath: PrismaCloudCompute.ContainerForensic.Forensics.message description: The runtime audit message. type: String - contextPath: PrismaCloudCompute.ContainerForensic.Forensics.networkCollectionType description: The type of the network collection method. type: String - contextPath: PrismaCloudCompute.ContainerForensic.Forensics.outbound description: Whether the port is outbound. type: Boolean - contextPath: PrismaCloudCompute.ContainerForensic.Forensics.path description: The event path. type: String - contextPath: PrismaCloudCompute.ContainerForensic.Forensics.pid description: The event process ID. type: Number - contextPath: PrismaCloudCompute.ContainerForensic.Forensics.port description: The listening port. type: Number - contextPath: PrismaCloudCompute.ContainerForensic.Forensics.ppid description: The event parent process ID. type: Number - contextPath: PrismaCloudCompute.ContainerForensic.Forensics.process description: The event process description. type: String - contextPath: PrismaCloudCompute.ContainerForensic.Forensics.srcIP description: The source IP address of the connection. type: String - contextPath: PrismaCloudCompute.ContainerForensic.Forensics.srcProfileID description: The profile ID of the connection source. type: String - contextPath: PrismaCloudCompute.ContainerForensic.Forensics.static description: Whether the event was added to the profile without behavioral indications. type: Boolean - contextPath: PrismaCloudCompute.ContainerForensic.Forensics.type description: The event type. type: String - contextPath: PrismaCloudCompute.ContainerForensic.Forensics.timestamp description: The event timestamp. type: Date - contextPath: PrismaCloudCompute.ContainerForensic.Forensics.user description: The event user. type: String - name: prisma-cloud-compute-host-forensic-list description: Get forensics on a specific host. arguments: - name: id description: The host ID. Can be retrieved from the "prisma-cloud-compute-hosts-list" command. required: true defaultValue: "" - name: collections description: A comma-separated list of collections. isArray: true defaultValue: "" - name: incident_id description: A comma-separated list of incident IDs in case the request type is an incident. isArray: true defaultValue: "" - name: limit description: The maximum number of forensics data records to return. Must be between 1-50. defaultValue: "20" - name: offset description: The offset by which to begin listing host forensics from. defaultValue: "0" outputs: - contextPath: PrismaCloudCompute.HostForensic.Forensics.app description: The application associated with the event. type: String - contextPath: PrismaCloudCompute.HostForensic.Forensics.attack description: The event attack type. type: String - contextPath: PrismaCloudCompute.HostForensic.Forensics.category description: The incident category. type: String - contextPath: PrismaCloudCompute.HostForensic.Forensics.command description: The event command. type: String - contextPath: PrismaCloudCompute.HostForensic.Forensics.country description: The country associated with the event. type: String - contextPath: PrismaCloudCompute.HostForensic.Forensics.effect description: The runtime audit effect. type: String - contextPath: PrismaCloudCompute.HostForensic.Forensics.interactive description: Whether the event is interactive. type: Boolean - contextPath: PrismaCloudCompute.HostForensic.Forensics.ip description: The IP address associated with the event. type: String - contextPath: PrismaCloudCompute.HostForensic.Forensics.listeningStartTime description: The listening port start time. type: Date - contextPath: PrismaCloudCompute.HostForensic.Forensics.message description: The runtime audit message. type: String - contextPath: PrismaCloudCompute.HostForensic.Forensics.path description: The event path. type: String - contextPath: PrismaCloudCompute.HostForensic.Forensics.pid description: The event process ID. type: Number - contextPath: PrismaCloudCompute.HostForensic.Forensics.port description: The listening port. type: Number - contextPath: PrismaCloudCompute.HostForensic.Forensics.ppath description: The event parent path. type: String - contextPath: PrismaCloudCompute.HostForensic.Forensics.ppid description: The event parent process ID. type: Number - contextPath: PrismaCloudCompute.HostForensic.Forensics.process description: The event process. type: String - contextPath: PrismaCloudCompute.HostForensic.Forensics.timestamp description: The event timestamp. type: Date - contextPath: PrismaCloudCompute.HostForensic.Forensics.type description: The event type. type: String - contextPath: PrismaCloudCompute.HostForensic.Forensics.user description: The event user. type: String - contextPath: PrismaCloudCompute.HostForensic.hostID description: The host ID that was analyzed. type: String - name: prisma-cloud-compute-console-version-info description: Get the console version. arguments: [] outputs: - contextPath: PrismaCloudCompute.Console.Version description: The console version. type: String - name: prisma-cloud-compute-custom-feeds-ip-list description: Get all the blacklisted IP addresses in the system. arguments: [] outputs: - contextPath: PrismaCloudCompute.CustomFeedIP.digest description: An internal digest of the custom IP feed. type: String - contextPath: PrismaCloudCompute.CustomFeedIP.feed description: The list of blacklisted custom IP addresses. type: String - contextPath: PrismaCloudCompute.CustomFeedIP.modified description: The last time the custom feed was modified. type: Date - name: prisma-cloud-compute-custom-feeds-ip-add description: Add a list of banned IP addresses to be blocked by the system. arguments: - name: ip description: A comma-separated list of custom IP addresses to add to the banned IPs list that will be blocked. For example ip=1.1.1.1,2.2.2.2. required: true isArray: true defaultValue: "" outputs: [] compliantpolicies: - IP Blockage - name: prisma-cloud-compute-custom-feeds-ip-remove description: Remove a list of IPs from the system's block list. arguments: - name: ip description: A comma-separated list of custom IP addresses to remove from the banned IPs list. For example ip=1.1.1.1,2.2.2.2. required: true isArray: true defaultValue: "" outputs: [] - name: prisma-cloud-compute-custom-feeds-malware-list description: List all custom uploaded md5 malwares. arguments: - name: limit description: The maximum number of records of custom md5 malwares to return. defaultValue: "50" outputs: - contextPath: PrismaCloudCompute.CustomFeedMalware.digest description: An internal digest of the feed. type: String - contextPath: PrismaCloudCompute.CustomFeedMalware.feed.md5 description: The MD5 sum of the feed. type: String - contextPath: PrismaCloudCompute.CustomFeedMalware.feed.modified description: The time the malware was added to the database. type: Date - contextPath: PrismaCloudCompute.CustomFeedMalware.feed.name description: The name of the malware feed. type: String - contextPath: PrismaCloudCompute.CustomFeedMalware.modified description: The last time the custom feed was modified. type: Date - name: prisma-cloud-compute-custom-feeds-malware-add description: Add custom MD5 malware hashes. arguments: - name: name description: The name that will be attached to the MD5 records. required: true defaultValue: "" - name: md5 description: A comma-separated list of MD5 hashes to be added. required: true isArray: true defaultValue: "" outputs: [] - name: cve description: Get information about the CVEs in the system. Will return a maximum of 50 records. It is possible to query for a partial CVE description such as cve-2020 or cve-2014 or by severity/distro/package. arguments: - name: cve_id description: Deprecated. Use the `cve` argument instead. isArray: true defaultValue: "" - name: cve description: A comma-separated list of CVEs, for example, cve=cve-2016-223,cve-2020-3546. isArray: true defaultValue: "" default: true outputs: - contextPath: CVE.ID description: "The ID of the CVE, for example: CVE-2015-1653." type: String - contextPath: CVE.CVSS description: "The CVSS of the CVE, for example: 10.0." type: String - contextPath: CVE.Modified description: The timestamp of when the CVE was last modified. type: Date - contextPath: CVE.Description description: A description of the CVE. type: String - contextPath: DBotScore.Indicator description: The indicator that was tested. type: String - contextPath: DBotScore.Score description: The actual score. type: Number - contextPath: DBotScore.Type description: The indicator type. type: String - contextPath: DBotScore.Vendor description: The vendor used to calculate the score. type: String - contextPath: DBotScore.Reliability type: String description: Reliability of the source providing the intelligence data. - name: prisma-cloud-compute-defenders-list description: Retrieve a list of defenders and their information. arguments: - name: cluster description: The cluster name by which to scope the query. defaultValue: "" - name: hostname description: Name of a specific defender to retrieve. defaultValue: "" - name: type description: Indicates the defender types to return (e.g., docker, dockerWindows, cri, etc.). defaultValue: "" - name: connected description: Indicates whether to return only connected defenders (true) or disconnected defenders (false). defaultValue: "" predefined: - "true" - "false" - name: limit description: The maximum number of defender records to return. defaultValue: "20" - name: offset description: The offset number by which to begin listing defenders and their information. defaultValue: "0" outputs: - contextPath: PrismaCloudCompute.DefenderDetails.category description: "The category of the defender type (host/container/serverless). Range of acceptable values: container, host, serverless, appEmbedded." type: String - contextPath: PrismaCloudCompute.DefenderDetails.certificateExpiration description: The client's certificate expiry time. type: Date - contextPath: PrismaCloudCompute.DefenderDetails.cloudMetadata description: The cloud provider metadata of the host. type: Unknown - contextPath: PrismaCloudCompute.DefenderDetails.cluster description: The provided cluster name. (Fallback is the internal IP address). type: String - contextPath: PrismaCloudCompute.DefenderDetails.clusterID description: The unique ID generated for each daemon set and used to group defenders by clusters. Note - Kubernetes does not provide a cluster name as part of its API. type: String - contextPath: PrismaCloudCompute.DefenderDetails.compatibleVersion description: Whether the defender has a compatible version for communication (e.g., request logs). type: Boolean - contextPath: PrismaCloudCompute.DefenderDetails.connected description: Whether the defender is connected. type: Boolean - contextPath: PrismaCloudCompute.DefenderDetails.features description: The features that are enabled in the defender such as listener type. type: Unknown - contextPath: PrismaCloudCompute.DefenderDetails.firewallProtection description: The firewall protection status of the app embedded defenders. type: Unknown - contextPath: PrismaCloudCompute.DefenderDetails.fqdn description: The fully qualified domain name used in audit alerts to identify specific hosts. type: String - contextPath: PrismaCloudCompute.DefenderDetails.hostname description: The defender hostname. type: String - contextPath: PrismaCloudCompute.DefenderDetails.lastModified description: The last time the defender connectivity was modified. type: Date - contextPath: PrismaCloudCompute.DefenderDetails.port description: The communication port between the defender and the console. type: Number - contextPath: PrismaCloudCompute.DefenderDetails.proxy description: The proxy options of the defender. type: Unknown - contextPath: PrismaCloudCompute.DefenderDetails.remoteLoggingSupported description: Whether the defender logs can be retrieved remotely. type: Boolean - contextPath: PrismaCloudCompute.DefenderDetails.remoteMgmtSupported description: Whether the defender can be remotely managed (upgrade, restart). type: Boolean - contextPath: PrismaCloudCompute.DefenderDetails.status description: The feature status of the defender. type: Unknown - contextPath: PrismaCloudCompute.DefenderDetails.systemInfo description: The system information of the defender host. type: Unknown - contextPath: PrismaCloudCompute.DefenderDetails.tasClusterID description: The ID used to identify the TAS cluster of the defender. Typically will be the cloud controller API address. type: String - contextPath: PrismaCloudCompute.DefenderDetails.type description: The type of the defender (registry scanner/kubernetes node/etc...). type: String - contextPath: PrismaCloudCompute.DefenderDetails.version description: The agent version. type: String - name: prisma-cloud-compute-collections-list description: Retrieves a list of all collections. arguments: - name: limit description: The maximum number of collections to return. defaultValue: "50" outputs: - contextPath: PrismaCloudCompute.Collection.accountIDs description: A list of the cloud account IDs. type: String - contextPath: PrismaCloudCompute.Collection.appIDs description: A list of application IDs. type: String - contextPath: PrismaCloudCompute.Collection.clusters description: A list of Kubernetes cluster names. type: String - contextPath: PrismaCloudCompute.Collection.codeRepos description: A list of remote code repositories. type: String - contextPath: PrismaCloudCompute.Collection.color description: A color code associated with the collection. type: String - contextPath: PrismaCloudCompute.Collection.containers description: A list of containers that are associated with this collection. type: String - contextPath: PrismaCloudCompute.Collection.description description: A free-text description of the collection. type: String - contextPath: PrismaCloudCompute.Collection.functions description: A list of functions that are associated with this collection. type: String - contextPath: PrismaCloudCompute.Collection.hosts description: A list of hosts that are associated with this collection. type: String - contextPath: PrismaCloudCompute.Collection.images description: A list of images that are associated with this collection. type: String - contextPath: PrismaCloudCompute.Collection.labels description: A list of labels that are associated with this collection. type: String - contextPath: PrismaCloudCompute.Collection.modified description: The timestamp of when the collection was last modified. type: Date - contextPath: PrismaCloudCompute.Collection.name description: A unique name associated with the collection. type: String - contextPath: PrismaCloudCompute.Collection.namespaces description: The Kubernetes namespaces. type: String - contextPath: PrismaCloudCompute.Collection.owner description: The collection owner (the last user who modified the collection). type: String - contextPath: PrismaCloudCompute.Collection.system description: Whether this collection was created by the system or by the user. type: Boolean - name: prisma-cloud-compute-container-namespace-list description: Get the containers namespaces names. arguments: - name: cluster description: A comma-separated list of cluster names to filter the results by. isArray: true defaultValue: "" - name: collections description: A comma-separated list of collections to filter the results by. Can be retrieved from the "prisma-cloud-compute-collections-list" command. isArray: true defaultValue: "" - name: limit description: The maximum number of namespace name records to return. defaultValue: "50" outputs: - contextPath: PrismaCloudCompute.RadarContainerNamespace description: The names of the container namespaces. type: String - name: prisma-cloud-compute-images-scan-list description: Get images scan report. The report includes vulnerabilities, compliance issues, binaries, etc. arguments: - name: clusters description: A comma-separated list of cluster names to filter the results by. isArray: true defaultValue: "" - name: compact description: Whether only minimal image data is to be returned (i.e., skip vulnerabilities, compliance, and extended image metadata). defaultValue: "true" predefined: - "true" - "false" - name: fields description: A comma-separated list of fields to return. Possible values are labels, repo, registry, clusters, hosts, tag. isArray: true defaultValue: "" - name: hostname description: A comma-separated list of hostnames to filter the results by. Can be retrieved from the "prisma-cloud-compute-profile-host-list" command. isArray: true defaultValue: "" - name: id description: A comma-separated list of image IDs to filter the results by. Run !prisma-cloud-compute-images-scan-list without any arguments to get image IDs. isArray: true defaultValue: "" - name: name description: A comma-separated list of image names to filter the results by. isArray: true defaultValue: "" - name: registry description: A comma-separated list of image registries to filter the results by. isArray: true defaultValue: "" - name: repository description: A comma-separated list of image repositories to filter the results by. isArray: true defaultValue: "" - name: compliance_ids description: A comma-separated list of compliance IDs to filter the results by. isArray: true - name: limit_record description: The maximum number of scan image records to return. defaultValue: "10" - name: limit_stats description: The maximum number of compliance/vulnerability records to return. defaultValue: "10" - name: offset description: The offset by which to begin listing image scan results. defaultValue: "0" - name: all_results description: Whether to retrieve all results. The "limit_record" and "limit_stats" arguments will be ignored. Might slow down the command run time. defaultValue: "false" predefined: - "true" - "false" outputs: - contextPath: PrismaCloudCompute.ReportsImagesScan._id description: Image identifier (image ID or repo:tag). type: String - contextPath: PrismaCloudCompute.ReportsImagesScan.allCompliance description: Data regarding passed compliance checks. type: Unknown - contextPath: PrismaCloudCompute.ReportsImagesScan.appEmbedded description: Whether this image was scanned by an app-embedded defender. type: Boolean - contextPath: PrismaCloudCompute.ReportsImagesScan.applications description: Products in the image. type: Unknown - contextPath: PrismaCloudCompute.ReportsImagesScan.baseImage description: The base name of the image. Used when filtering the vulnerabilities by base images. type: String - contextPath: PrismaCloudCompute.ReportsImagesScan.binaries description: Binaries in the image. type: Unknown - contextPath: PrismaCloudCompute.ReportsImagesScan.cloudMetadata description: The metadata for an instance running in a cloud provider (AWS/GCP/Azure). type: Unknown - contextPath: PrismaCloudCompute.ReportsImagesScan.clusters description: Cluster names. type: String - contextPath: PrismaCloudCompute.ReportsImagesScan.collections description: Collections to which this result applies. type: String - contextPath: PrismaCloudCompute.ReportsImagesScan.complianceDistribution description: The number of vulnerabilities per type. type: Unknown - contextPath: PrismaCloudCompute.ReportsImagesScan.complianceIssues description: Number of compliance issues. type: Unknown - contextPath: PrismaCloudCompute.ReportsImagesScan.complianceRiskScore description: Compliance risk score for the image. type: Number - contextPath: PrismaCloudCompute.ReportsImagesScan.creationTime description: Date/time when the image was created. type: Date - contextPath: PrismaCloudCompute.ReportsImagesScan.distro description: Full name of the distribution. type: String - contextPath: PrismaCloudCompute.ReportsImagesScan.ecsClusterName description: Elastic Container Service (ECS) cluster name. type: String - contextPath: PrismaCloudCompute.ReportsImagesScan.err description: Description of an error that occurred during the image health scan. type: String - contextPath: PrismaCloudCompute.ReportsImagesScan.externalLabels description: Kubernetes external labels of all containers running this image. type: Unknown - contextPath: PrismaCloudCompute.ReportsImagesScan.files description: Files in the container. type: Unknown - contextPath: PrismaCloudCompute.ReportsImagesScan.firewallProtection description: The status of the Web-Application and API Security (WAAS) protection. type: Unknown - contextPath: PrismaCloudCompute.ReportsImagesScan.firstScanTime description: Date/time when this image was first scanned (preserved during version updates). type: Date - contextPath: PrismaCloudCompute.ReportsImagesScan.history description: Docker image history. type: Unknown - contextPath: PrismaCloudCompute.ReportsImagesScan.hostDevices description: Map from host network device name to IP address. type: String - contextPath: PrismaCloudCompute.ReportsImagesScan.hostname description: Name of the host that was scanned. type: String - contextPath: PrismaCloudCompute.ReportsImagesScan.hosts description: A fast index for image scan results metadata per host. type: Unknown - contextPath: PrismaCloudCompute.ReportsImagesScan.id description: Image ID. type: String - contextPath: PrismaCloudCompute.ReportsImagesScan.image description: A container image. type: Unknown - contextPath: PrismaCloudCompute.ReportsImagesScan.installedProducts description: Data regarding products running in the environment. type: Unknown - contextPath: PrismaCloudCompute.ReportsImagesScan.instances description: Details about each occurrence of the image (tag + host). type: Unknown - contextPath: PrismaCloudCompute.ReportsImagesScan.k8sClusterAddr description: Endpoint of the Kubernetes API server. type: String - contextPath: PrismaCloudCompute.ReportsImagesScan.labels description: Image labels. type: String - contextPath: PrismaCloudCompute.ReportsImagesScan.layers description: Image's filesystem layers. Each layer is a SHA256 digest of the filesystem diff. type: String - contextPath: PrismaCloudCompute.ReportsImagesScan.missingDistroVulnCoverage description: Whether the image operating system is covered in the IS (true) or not (false). type: Boolean - contextPath: PrismaCloudCompute.ReportsImagesScan.namespaces description: Kubernetes namespaces of all the containers running this image. type: String - contextPath: PrismaCloudCompute.ReportsImagesScan.osDistro description: Name of the operating system distribution. type: String - contextPath: PrismaCloudCompute.ReportsImagesScan.osDistroRelease description: Operating system distribution release. type: String - contextPath: PrismaCloudCompute.ReportsImagesScan.osDistroVersion description: Operating system distribution version. type: String - contextPath: PrismaCloudCompute.ReportsImagesScan.packageManager description: Whether the package manager is installed for the operating system. type: Boolean - contextPath: PrismaCloudCompute.ReportsImagesScan.packages description: Packages that exist in the image. type: Unknown - contextPath: PrismaCloudCompute.ReportsImagesScan.registryNamespace description: IBM cloud namespace to which the image belongs. type: String - contextPath: PrismaCloudCompute.ReportsImagesScan.repoDigests description: Digests of the image. Used for content trust (notary). Has one digest per tag. type: String - contextPath: PrismaCloudCompute.ReportsImagesScan.repoTag description: An image repository and its associated tag or registry digest. type: Unknown - contextPath: PrismaCloudCompute.ReportsImagesScan.rhelRepos description: The (RPM) repositories IDs from which the packages in this image were installed. Used for matching vulnerabilities by Red Hat CPEs. type: String - contextPath: PrismaCloudCompute.ReportsImagesScan.riskFactors description: The mapping of the existence of vulnerability risk factors. type: Unknown - contextPath: PrismaCloudCompute.ReportsImagesScan.scanID description: Scan ID. type: String - contextPath: PrismaCloudCompute.ReportsImagesScan.scanTime description: Date/time of the last scan of the image. type: Date - contextPath: PrismaCloudCompute.ReportsImagesScan.scanVersion description: Defender version that published the image. type: String - contextPath: PrismaCloudCompute.ReportsImagesScan.startupBinaries description: Binaries that are expected to run when the container is created from this image. type: Unknown - contextPath: PrismaCloudCompute.ReportsImagesScan.tags description: Tags associated with the given image. type: Unknown - contextPath: PrismaCloudCompute.ReportsImagesScan.topLayer description: SHA256 of the image's last layer that is the last element of the Layers field. type: String - contextPath: PrismaCloudCompute.ReportsImagesScan.trustResult description: An aggregated image trust result. type: Unknown - contextPath: PrismaCloudCompute.ReportsImagesScan.trustStatus description: The trust status for an image. type: String - contextPath: PrismaCloudCompute.ReportsImagesScan.twistlockImage description: Whether the image is a Twistlock image (true) or not (false). type: Boolean - contextPath: PrismaCloudCompute.ReportsImagesScan.type description: The scanning type performed. type: Unknown - contextPath: PrismaCloudCompute.ReportsImagesScan.vulnerabilities description: CVE vulnerabilities of the image. type: Unknown - contextPath: PrismaCloudCompute.ReportsImagesScan.vulnerabilitiesCount description: Total number of vulnerabilities. type: Number - contextPath: PrismaCloudCompute.ReportsImagesScan.vulnerabilityDistribution description: The number of vulnerabilities per type. type: Unknown - contextPath: PrismaCloudCompute.ReportsImagesScan.vulnerabilityRiskScore description: Image's CVE risk score. type: Number - contextPath: PrismaCloudCompute.ReportsImagesScan.wildFireUsage description: The Wildfire usage stats. The period for the usage varies with the context. type: Unknown - contextPath: PrismaCloudCompute.ReportsImagesScan.complianceIssuesCount description: Number of compliance issues. type: Number - name: prisma-cloud-compute-hosts-scan-list description: Get hosts scan report. The report includes vulnerabilities, compliance issues, binaries, etc. arguments: - name: clusters description: A comma-separated list of cluster names to filter the results by. isArray: true defaultValue: "" - name: compact description: Whether only minimal image data is to be returned (i.e., skip vulnerabilities, compliance, and extended image metadata). defaultValue: "true" predefined: - "true" - "false" - name: distro description: A comma-separated list of operating system distros to filter the results by. isArray: true defaultValue: "" - name: fields description: A comma-separated list of fields to return. Possible values are labels, repo, registry, clusters, hosts, tag. isArray: true defaultValue: "" - name: hostname description: A comma-separated list of hostnames to filter the results by. Can be retrieved from the "prisma-cloud-compute-profile-host-list" command. isArray: true defaultValue: "" - name: provider description: A comma-separated list of cloud providers to filter the results by. isArray: true defaultValue: "" - name: compliance_ids description: A comma-separated list of compliance IDs to filter the results by. isArray: true - name: limit_record description: The maximum number of scan host records to return. defaultValue: "10" - name: limit_stats description: The maximum number of compliance/vulnerability records to return. defaultValue: "10" - name: offset description: The offset by which to begin listing host scan results. defaultValue: "0" - name: all_results description: Whether to retrieve all results. The "limit_record" and "limit_stats" arguments will be ignored. Might slow down the command run time. defaultValue: "false" predefined: - "true" - "false" outputs: - contextPath: PrismaCloudCompute.ReportHostScan._id description: The host identifier (host ID or hostname). type: String - contextPath: PrismaCloudCompute.ReportHostScan.allCompliance description: The data regarding passed compliance checks. type: Unknown - contextPath: PrismaCloudCompute.ReportHostScan.appEmbedded description: Whether this image was scanned by an app-embedded defender. type: Boolean - contextPath: PrismaCloudCompute.ReportHostScan.applications description: Products in the image. type: Unknown - contextPath: PrismaCloudCompute.ReportHostScan.binaries description: Binaries in the image. type: Unknown - contextPath: PrismaCloudCompute.ReportHostScan.cloudMetadata description: The metadata for an instance running in a cloud provider (AWS/GCP/Azure). type: Unknown - contextPath: PrismaCloudCompute.ReportHostScan.clusters description: Cluster names. type: String - contextPath: PrismaCloudCompute.ReportHostScan.collections description: Collections to which this result applies. type: String - contextPath: PrismaCloudCompute.ReportHostScan.complianceDistribution description: The number of vulnerabilities per type. type: Unknown - contextPath: PrismaCloudCompute.ReportHostScan.complianceIssues description: Number of compliance issues. type: Unknown - contextPath: PrismaCloudCompute.ReportHostScan.complianceRiskScore description: Compliance risk score for the image. type: Number - contextPath: PrismaCloudCompute.ReportHostScan.creationTime description: Date/time when the image was created. type: Date - contextPath: PrismaCloudCompute.ReportHostScan.distro description: Full name of the distribution. type: String - contextPath: PrismaCloudCompute.ReportHostScan.ecsClusterName description: Elastic Container Service (ECS) cluster name. type: String - contextPath: PrismaCloudCompute.ReportHostScan.err description: Description of an error that occurred during image health scan. type: String - contextPath: PrismaCloudCompute.ReportHostScan.externalLabels description: Kubernetes external labels of all containers running this image. type: Unknown - contextPath: PrismaCloudCompute.ReportHostScan.firewallProtection description: The status of the Web-Application and API Security (WAAS) protection. type: Unknown - contextPath: PrismaCloudCompute.ReportHostScan.firstScanTime description: Date/time when this image was first scanned (preserved during version updates). type: Date - contextPath: PrismaCloudCompute.ReportHostScan.history description: Docker image history. type: Unknown - contextPath: PrismaCloudCompute.ReportHostScan.hostDevices description: Map from host network device name to IP address. type: String - contextPath: PrismaCloudCompute.ReportHostScan.hostname description: Name of the host that was scanned. type: String - contextPath: PrismaCloudCompute.ReportHostScan.hosts description: A fast index for image scan results metadata per host. type: Unknown - contextPath: PrismaCloudCompute.ReportHostScan.image description: A container image. type: Unknown - contextPath: PrismaCloudCompute.ReportHostScan.installedProducts description: Data regarding products running in the environment. type: Unknown - contextPath: PrismaCloudCompute.ReportHostScan.instances description: Details about each occurrence of the image (tag + host). type: Unknown - contextPath: PrismaCloudCompute.ReportHostScan.k8sClusterAddr description: Endpoint of the Kubernetes API server. type: String - contextPath: PrismaCloudCompute.ReportHostScan.namespaces description: Kubernetes namespaces of all the containers running this image. type: String - contextPath: PrismaCloudCompute.ReportHostScan.osDistro description: Name of the operating system distribution. type: String - contextPath: PrismaCloudCompute.ReportHostScan.osDistroRelease description: Operating system distribution release. type: String - contextPath: PrismaCloudCompute.ReportHostScan.osDistroVersion description: Operating system distribution version. type: String - contextPath: PrismaCloudCompute.ReportHostScan.packageManager description: Whether the package manager is installed for the operating system. type: Boolean - contextPath: PrismaCloudCompute.ReportHostScan.packages description: The packages that exist in the image. type: Unknown - contextPath: PrismaCloudCompute.ReportHostScan.repoDigests description: Digests of the image. Used for content trust (notary). Has one digest per tag. type: String - contextPath: PrismaCloudCompute.ReportHostScan.repoTag description: An image repository and its associated tag or registry digest. type: Unknown - contextPath: PrismaCloudCompute.ReportHostScan.riskFactors description: Maps of the existence of vulnerability risk factors. type: Unknown - contextPath: PrismaCloudCompute.ReportHostScan.scanID description: Scan ID. type: String - contextPath: PrismaCloudCompute.ReportHostScan.scanTime description: Date/time of the last scan of the image. type: Date - contextPath: PrismaCloudCompute.ReportHostScan.scanVersion description: Defender version that published the image. type: String - contextPath: PrismaCloudCompute.ReportHostScan.startupBinaries description: Binaries that are expected to run when the container is created from this image. type: Unknown - contextPath: PrismaCloudCompute.ReportHostScan.tags description: Tags associated with the given image. type: Unknown - contextPath: PrismaCloudCompute.ReportHostScan.topLayer description: SHA256 of the image's last layer that is the last element of the Layers field. type: String - contextPath: PrismaCloudCompute.ReportHostScan.trustStatus description: The trust status for an image. type: String - contextPath: PrismaCloudCompute.ReportHostScan.type description: The scanning type performed. type: Unknown - contextPath: PrismaCloudCompute.ReportHostScan.vulnerabilities description: CVE vulnerabilities of the host. type: Unknown - contextPath: PrismaCloudCompute.ReportHostScan.vulnerabilitiesCount description: Total number of vulnerabilities. type: Number - contextPath: PrismaCloudCompute.ReportHostScan.vulnerabilityDistribution description: The number of vulnerabilities per type. type: Unknown - contextPath: PrismaCloudCompute.ReportHostScan.vulnerabilityRiskScore description: Image's CVE risk score. type: Number - contextPath: PrismaCloudCompute.ReportHostScan.wildFireUsage description: The Wildfire usage stats. The period for the usage varies with the context. type: Unknown - contextPath: PrismaCloudCompute.ReportHostScan.complianceIssuesCount description: Number of compliance issues. type: Unknown - name: prisma-cloud-compute-vulnerabilities-impacted-resources-list description: Get the list of Prisma Cloud Compute vulnerabilities resources. arguments: - name: cve description: A comma-separated list of CVE IDs that can be used as a pivot for the impacted resource search. For example cve=CVE-2018-14600,CVE-2021-31535. isArray: true defaultValue: "" - name: limit description: The maximum number of records of impacted hosts/images to return. defaultValue: "50" - name: offset description: The offset by which to begin listing impacted hosts/images records. defaultValue: "0" - name: resourceType description: ResourceType is the single resource type to return vulnerability data for. auto: PREDEFINED predefined: - 'container' - 'image' - 'host' - 'function' - 'codeRepo' - 'registryImage' outputs: - contextPath: PrismaCloudCompute.VulnerabilitiesImpactedResource._id description: Id is the CVE ID (index for the impacted resources). type: String - contextPath: PrismaCloudCompute.VulnerabilitiesImpactedResource.codeRepos description: CodeRepos is a list of impacted code repositories. type: Array - contextPath: PrismaCloudCompute.VulnerabilitiesImpactedResource.codeReposCount description: CodeReposCount is the total impacted code repositories count. type: integer - contextPath: PrismaCloudCompute.VulnerabilitiesImpactedResource.functions description: Functions is a map between function id to its details. type: Array - contextPath: PrismaCloudCompute.VulnerabilitiesImpactedResource.functionsCount description: FunctionsCount is the total impacted functions count. type: integer - contextPath: PrismaCloudCompute.VulnerabilitiesImpactedResource.hosts description: Hosts is the list of impacted hosts. type: Array - contextPath: PrismaCloudCompute.VulnerabilitiesImpactedResource.hostsCount description: HostsCount is the total impacted hosts count. type: integer - contextPath: PrismaCloudCompute.VulnerabilitiesImpactedResource.images description: Images is the list of impacted hosts. type: Array - contextPath: PrismaCloudCompute.VulnerabilitiesImpactedResource.imagesCount description: ImagesCount is the total impacted images count. type: integer - contextPath: PrismaCloudCompute.VulnerabilitiesImpactedResource.registryImages description: RegistryImages is a list of impacted registry images. type: Array - contextPath: PrismaCloudCompute.VulnerabilitiesImpactedResource.registryImagesCount description: RegistryImagesCount is the total impacted registry images count. type: integer - name: prisma-cloud-compute-get-waas-policies arguments: [] description: "Get the Waas Container Policies from Defend >> WAAS >> Containers." outputs: - contextPath: PrismaCloudCompute.Policies.Name description: The Policy Name. type: String - contextPath: PrismaCloudCompute.Policies.WaasPolicy.ATP description: The WaaS policy state for Advanced Threat Protection. type: String - contextPath: PrismaCloudCompute.Policies.WaasPolicy.AttackToolsAndVulnScanners description: The WaaS policy state for Attack Tools and Vulnerability Scanners. type: String - contextPath: PrismaCloudCompute.Policies.WaasPolicy.CodeInjection description: The WaaS policy state for Code Injection. type: String - contextPath: PrismaCloudCompute.Policies.WaasPolicy.CrossSiteScriptingXSS description: The WaaS policy state for Cross Site Scripting. type: String - contextPath: PrismaCloudCompute.Policies.WaasPolicy.DetectInformationLeakage description: The WaaS policy state for Detected Information Leakage. type: String - contextPath: PrismaCloudCompute.Policies.WaasPolicy.LocalFileInclusion description: The WaaS policy state for Local File Inclusion. type: String - contextPath: PrismaCloudCompute.Policies.WaasPolicy.MalformedHTTPRequest description: The WaaS policy state for Malformed HTTP Requests. type: String - contextPath: PrismaCloudCompute.Policies.WaasPolicy.OSCommandInjetion description: The WaaS policy state for OS Command injection. type: String - contextPath: PrismaCloudCompute.Policies.WaasPolicy.SQLInjection description: The WaaS policy state for SQL injection. type: String - contextPath: PrismaCloudCompute.Policies.WaasPolicy.Shellshock description: The WaaS policy state for Shellshock. type: String - name: prisma-cloud-compute-update-waas-policies arguments: - name: policy required: true description: The complete policy object. Can be obtained from prisma-cloud-compute-get-waas-policies raw-response=true extend-context=PCC=. command. - name: attack_type required: true auto: PREDEFINED predefined: - sqli - xss - cmdi - codeInjection - lfi - attackTools - shellshock - malformedReq - advancedProtectionEffect - intelGathering description: The specific policy to update. - name: action required: true auto: PREDEFINED predefined: - ban - prevent - alert - allow - disable - reCAPTCHA description: The new policy action for the attack type. - name: rule_name required: true description: The rule name for the WaaS policy settings. description: Update the Waas Policy for containers. - name: prisma-cloud-compute-get-audit-firewall-container-alerts arguments: - name: ImageName required: true description: The image name to get the alerts for. - name: FromDays description: The Number of days back to look. - name: audit_type required: true description: The type of audit alert to retrieve. - name: limit description: The limit of the number of alerts to return. description: Get the audits for the firewall container policies. outputs: [] - arguments: - description: The project to get the alert profiles for. name: project description: Get the available alert alert profiles from a specific project. name: prisma-cloud-compute-get-alert-profiles outputs: - contextPath: PrismaCloudCompute.AlertProfiles.Cortex.Application description: The alert profile application. type: String - contextPath: PrismaCloudCompute.AlertProfiles.Cortex.CredentialId description: The credential ID. type: String - contextPath: PrismaCloudCompute.AlertProfiles.Cortex.Enabled description: Whether the alert profile is enabled. type: Boolean - contextPath: PrismaCloudCompute.AlertProfiles.Cortex.Url description: The alert profile URL. type: String - contextPath: PrismaCloudCompute.AlertProfiles.Email.CredentialId description: The alert profile credential ID. type: String - contextPath: PrismaCloudCompute.AlertProfiles.Email.Enabled description: The email setting for the alert profile. type: Boolean - contextPath: PrismaCloudCompute.AlertProfiles.Email.From description: The from setting for the email profile. type: String - contextPath: PrismaCloudCompute.AlertProfiles.Email.Port description: The email alert profile port. type: Number - contextPath: PrismaCloudCompute.AlertProfiles.Email.SmtpAddress description: The SMTP address. type: String - contextPath: PrismaCloudCompute.AlertProfiles.Email.Ssl description: The email alert profile SSL. type: Boolean - contextPath: PrismaCloudCompute.AlertProfiles.GcpPubsub.CredentialId description: The credential ID. type: String - contextPath: PrismaCloudCompute.AlertProfiles.GcpPubsub.Enabled description: Whether the GCP Pub Sub is enabled. type: Boolean - contextPath: PrismaCloudCompute.AlertProfiles.GcpPubsub.Topic description: The GCP Pub Sub topic. type: String - contextPath: PrismaCloudCompute.AlertProfiles.Jira.BaseUrl description: The Jira base URL. type: String - contextPath: PrismaCloudCompute.AlertProfiles.Jira.CaCert description: The Jira CA Cert. type: String - contextPath: PrismaCloudCompute.AlertProfiles.Jira.CredentialId description: The Jira credential ID. type: String - contextPath: PrismaCloudCompute.AlertProfiles.Jira.Enabled description: Jira alert profile status. type: Boolean - contextPath: PrismaCloudCompute.AlertProfiles.Jira.IssueType description: The Jira issue type. type: String - contextPath: PrismaCloudCompute.AlertProfiles.Jira.Priority description: The Jira priority. type: String - contextPath: PrismaCloudCompute.AlertProfiles.LastError description: The last error. type: String - contextPath: PrismaCloudCompute.AlertProfiles.Modified description: The modified time. type: Date - contextPath: PrismaCloudCompute.AlertProfiles.Name description: The alert profile name. type: String - contextPath: PrismaCloudCompute.AlertProfiles.Owner description: The alert profile owner. type: String - contextPath: PrismaCloudCompute.AlertProfiles.Pagerduty.RoutingKey.Encrypted description: The PagerDuty routing key encryption status. type: String - contextPath: PrismaCloudCompute.AlertProfiles.Pagerduty.Severity description: The PagerDuty severity. type: String - contextPath: PrismaCloudCompute.AlertProfiles.Pagerduty.Summary description: The PagerDuty summary. type: String - contextPath: PrismaCloudCompute.AlertProfiles.Policy.Admission.AllRules description: The policy all rules. type: Boolean - contextPath: PrismaCloudCompute.AlertProfiles.Policy.Admission.Enabled description: Whether the admission is enabled. type: Boolean - contextPath: PrismaCloudCompute.AlertProfiles.Policy.AgentlessAppFirewall.AllRules description: The agentless app firewall rules. type: Boolean - contextPath: PrismaCloudCompute.AlertProfiles.Policy.AgentlessAppFirewall.Enabled description: Whether the agentless app firewall is enabled. type: Boolean - contextPath: PrismaCloudCompute.AlertProfiles.Policy.AppEmbeddedAppFirewall.AllRules description: App embedded firewall rules. type: Boolean - contextPath: PrismaCloudCompute.AlertProfiles.Policy.AppEmbeddedAppFirewall.Enabled description: Whether the app embedded firewall is enabled. type: Boolean - contextPath: PrismaCloudCompute.AlertProfiles.Policy.AppEmbeddedRuntime.AllRules description: App embedded runtime rules. type: Boolean - contextPath: PrismaCloudCompute.AlertProfiles.Policy.AppEmbeddedRuntime.Enabled description: Whether the app embedded runtime is enabled. type: Boolean - contextPath: PrismaCloudCompute.AlertProfiles.Policy.CloudDiscovery.AllRules description: The cloud discovery rules. type: Boolean - contextPath: PrismaCloudCompute.AlertProfiles.Policy.CloudDiscovery.Enabled description: Whether the cloud discovery is enabled. type: Boolean - contextPath: PrismaCloudCompute.AlertProfiles.Policy.CodeRepoVulnerability.AllRules description: The code repo vulnerability rules. type: Boolean - contextPath: PrismaCloudCompute.AlertProfiles.Policy.CodeRepoVulnerability.Enabled description: Whether the code repo vulnerability is enabled. type: Boolean - contextPath: PrismaCloudCompute.AlertProfiles.Policy.ContainerAppFirewall.AllRules description: The container app firewall rules. type: Boolean - contextPath: PrismaCloudCompute.AlertProfiles.Policy.ContainerAppFirewall.Enabled description: Whether the container app firewall is enabled. type: Boolean - contextPath: PrismaCloudCompute.AlertProfiles.Policy.ContainerCompliance.AllRules description: The container compliance rules. type: Boolean - contextPath: PrismaCloudCompute.AlertProfiles.Policy.ContainerCompliance.Enabled description: Whether the container compliance is enabled. type: Boolean - contextPath: PrismaCloudCompute.AlertProfiles.Policy.ContainerComplianceScan.AllRules description: The container compliance scan rules. type: Boolean - contextPath: PrismaCloudCompute.AlertProfiles.Policy.ContainerComplianceScan.Enabled description: Whether the container compliance scan is enabled. type: Boolean - contextPath: PrismaCloudCompute.AlertProfiles.Policy.ContainerRuntime.AllRules description: The container runtime rules. type: Boolean - contextPath: PrismaCloudCompute.AlertProfiles.Policy.ContainerRuntime.Enabled description: Whether the container runtime is enabled. type: Boolean - contextPath: PrismaCloudCompute.AlertProfiles.Policy.ContainerVulnerability.AllRules description: The container vulnerability rules. type: Boolean - contextPath: PrismaCloudCompute.AlertProfiles.Policy.ContainerVulnerability.Enabled description: Whether the container vulnerability is enabled. type: Boolean - contextPath: PrismaCloudCompute.AlertProfiles.Policy.Defender.AllRules description: The Defender policy rules. type: Boolean - contextPath: PrismaCloudCompute.AlertProfiles.Policy.Defender.Enabled description: Whether the Defender policy is enabled. type: Boolean - contextPath: PrismaCloudCompute.AlertProfiles.Policy.Docker.AllRules description: The Docker rules. type: Boolean - contextPath: PrismaCloudCompute.AlertProfiles.Policy.Docker.Enabled description: Whether the Docker rules are enabled. type: Boolean - contextPath: PrismaCloudCompute.AlertProfiles.Policy.HostAppFirewall.AllRules description: The app host firewall rules. type: Boolean - contextPath: PrismaCloudCompute.AlertProfiles.Policy.HostAppFirewall.Enabled description: Whether the host app firewall is enabled. type: Boolean - contextPath: PrismaCloudCompute.AlertProfiles.Policy.HostCompliance.AllRules description: The host compliance rules. type: Boolean - contextPath: PrismaCloudCompute.AlertProfiles.Policy.HostCompliance.Enabled description: Whether the host compliance is enabled. type: Boolean - contextPath: PrismaCloudCompute.AlertProfiles.Policy.HostComplianceScan.AllRules description: The host compliance scan rules. type: Boolean - contextPath: PrismaCloudCompute.AlertProfiles.Policy.HostComplianceScan.Enabled description: Whether the host compliance scan is enabled. type: Boolean - contextPath: PrismaCloudCompute.AlertProfiles.Policy.HostRuntime.AllRules description: The host runtime rules. type: Boolean - contextPath: PrismaCloudCompute.AlertProfiles.Policy.HostRuntime.Enabled description: Whether the host runtime rules are enabled. type: Boolean - contextPath: PrismaCloudCompute.AlertProfiles.Policy.HostVulnerability.AllRules description: The host vulnerability rules. type: Boolean - contextPath: PrismaCloudCompute.AlertProfiles.Policy.HostVulnerability.Enabled description: Whether the host vulnerability rule is enabled. type: Boolean - contextPath: PrismaCloudCompute.AlertProfiles.Policy.Incident.AllRules description: The policy incident rules. type: Boolean - contextPath: PrismaCloudCompute.AlertProfiles.Policy.Incident.Enabled description: Whether the policy incident is enabled. type: Boolean - contextPath: PrismaCloudCompute.AlertProfiles.Policy.KubernetesAudit.AllRules description: The K8S rules. type: Boolean - contextPath: PrismaCloudCompute.AlertProfiles.Policy.KubernetesAudit.Enabled description: Whether K8S is enabled. type: Boolean - contextPath: PrismaCloudCompute.AlertProfiles.Policy.NetworkFirewall.AllRules description: The network firewall rules. type: Boolean - contextPath: PrismaCloudCompute.AlertProfiles.Policy.NetworkFirewall.Enabled description: Whether the network firewall rule is enabled. type: Boolean - contextPath: PrismaCloudCompute.AlertProfiles.Policy.RegistryVulnerability.AllRules description: The registry vulnerability rules. type: Boolean - contextPath: PrismaCloudCompute.AlertProfiles.Policy.RegistryVulnerability.Enabled description: Whether the registry vulnerability rule is enabled. type: Boolean - contextPath: PrismaCloudCompute.AlertProfiles.Policy.ServerlessAppFirewall.AllRules description: The servervless app firewall rules. type: Boolean - contextPath: PrismaCloudCompute.AlertProfiles.Policy.ServerlessAppFirewall.Enabled description: Whether the serverless app firewall rule is enabled. type: Boolean - contextPath: PrismaCloudCompute.AlertProfiles.Policy.ServerlessRuntime.AllRules description: The serverless runtime rules. type: Boolean - contextPath: PrismaCloudCompute.AlertProfiles.Policy.ServerlessRuntime.Enabled description: Whether the serverless runtime rule is enabled. type: Boolean - contextPath: PrismaCloudCompute.AlertProfiles.Policy.VmCompliance.AllRules description: The VM compliance rules. type: Boolean - contextPath: PrismaCloudCompute.AlertProfiles.Policy.VmCompliance.Enabled description: Whether the VM compliance rule is enabled. type: Boolean - contextPath: PrismaCloudCompute.AlertProfiles.Policy.VmVulnerability.AllRules description: The VM vulnerability rules. type: Boolean - contextPath: PrismaCloudCompute.AlertProfiles.Policy.VmVulnerability.Enabled description: Whether the VM vulnerability rules are enabled. type: Boolean - contextPath: PrismaCloudCompute.AlertProfiles.Policy.WaasHealth.AllRules description: The WAAS health rules. type: Boolean - contextPath: PrismaCloudCompute.AlertProfiles.Policy.WaasHealth.Enabled description: Whether the WAAS health rules are enabled. type: Boolean - contextPath: PrismaCloudCompute.AlertProfiles.PreviousName description: The alert profile previous name. type: String - contextPath: PrismaCloudCompute.AlertProfiles.SecurityAdvisor.CredentialID description: The security advisor credential ID. type: String - contextPath: PrismaCloudCompute.AlertProfiles.SecurityAdvisor.Enabled description: Whether the security advisor is enabled. type: Boolean - contextPath: PrismaCloudCompute.AlertProfiles.SecurityAdvisor.FindingsURL description: The security advisor findings URL. type: String - contextPath: PrismaCloudCompute.AlertProfiles.SecurityAdvisor.ProviderId description: The security advisor provider ID. type: String - contextPath: PrismaCloudCompute.AlertProfiles.SecurityAdvisor.TokenURL description: The security advisor token URL. type: String - contextPath: PrismaCloudCompute.AlertProfiles.SecurityCenter.CredentialId description: The security center crendential ID. type: String - contextPath: PrismaCloudCompute.AlertProfiles.SecurityCenter.Enabled description: Whether the security center is enabled. type: Boolean - contextPath: PrismaCloudCompute.AlertProfiles.SecurityCenter.SourceID description: The security center source ID. type: String - contextPath: PrismaCloudCompute.AlertProfiles.SecurityHub.AccountID description: The security hub account ID. type: String - contextPath: PrismaCloudCompute.AlertProfiles.SecurityHub.CredentialId description: The security hub credential ID. type: String - contextPath: PrismaCloudCompute.AlertProfiles.SecurityHub.Enabled description: Whether the security hub is enabled. type: Boolean - contextPath: PrismaCloudCompute.AlertProfiles.SecurityHub.Region description: The security hub region. type: String - contextPath: PrismaCloudCompute.AlertProfiles.ServiceNow.Application description: The ServiceNow application. type: String - contextPath: PrismaCloudCompute.AlertProfiles.ServiceNow.Assignee description: The ServiceNow assignee. type: String - contextPath: PrismaCloudCompute.AlertProfiles.ServiceNow.CredentialID description: The ServiceNow credential ID. type: String - contextPath: PrismaCloudCompute.AlertProfiles.ServiceNow.Project description: The ServiceNow project. type: String - contextPath: PrismaCloudCompute.AlertProfiles.Slack.Enabled description: Whether the Slack alert profile is enabled. type: Boolean - contextPath: PrismaCloudCompute.AlertProfiles.Slack.WebhookUrl description: The Slack URL. type: String - contextPath: PrismaCloudCompute.AlertProfiles.Splunk.AuthToken.Encrypted description: The Splunk auth token. type: String - contextPath: PrismaCloudCompute.AlertProfiles.Splunk.SourceType description: The Splunk source type. type: String - contextPath: PrismaCloudCompute.AlertProfiles.Splunk.Url description: The Splunk URL. type: String - contextPath: PrismaCloudCompute.AlertProfiles.VulnerabilityImmediateAlertsEnabled description: Whether the vulnerability alert is enabled. type: Boolean - contextPath: PrismaCloudCompute.AlertProfiles.Webhook.CredentialId description: The webhook credential ID. type: String - contextPath: PrismaCloudCompute.AlertProfiles.Webhook.Url description: The webhook URL. type: String - contextPath: PrismaCloudCompute.AlertProfiles._Id description: The alert profile ID. type: String - arguments: - description: The Defender hostname. name: hostname description: Get the Defender settings. name: prisma-cloud-compute-get-settings-defender outputs: - contextPath: PrismaCloudCompute.DefenderSettings.AdmissionControlEnabled description: The admission control setting. type: Boolean - contextPath: PrismaCloudCompute.DefenderSettings.AdmissionControlWebhookSuffix description: The webhook suffix. type: String - contextPath: PrismaCloudCompute.DefenderSettings.AppEmbeddedFileSystemTracingEnabled description: The file tracing setting. type: Boolean - contextPath: PrismaCloudCompute.DefenderSettings.AutomaticUpgrade description: The automatic upgrade setting. type: Boolean - contextPath: PrismaCloudCompute.DefenderSettings.DisconnectPeriodDays description: The disconnect period in days. type: Number - contextPath: PrismaCloudCompute.DefenderSettings.HostCustomComplianceEnabled description: The custom compliance setting. type: Boolean - contextPath: PrismaCloudCompute.DefenderSettings.ListeningPort description: The defender listening port. type: Number - arguments: - description: The Defender hostname. Can be retrieved from the "prisma-cloud-compute-defenders-list" command. name: hostname - description: The number of log lines to fetch. name: lines defaultValue: 10 description: Download the Defender logs. name: prisma-cloud-compute-logs-defender outputs: - contextPath: PrismaCloudCompute.Defenders.Hostname description: The hostname the log was retrieved from. type: String - contextPath: PrismaCloudCompute.Defenders.Logs.Level description: The log level. type: String - contextPath: PrismaCloudCompute.Defenders.Logs.Log description: The log message. type: String - contextPath: PrismaCloudCompute.Defenders.Logs.Time description: The time of the log. type: Date - arguments: - description: The Defender hostname. Can be retrieved from the "prisma-cloud-compute-defenders-list" command. name: hostname - description: The number of log lines to fetch. name: lines defaultValue: 100 description: Download a zip of all Defender logs. name: prisma-cloud-compute-logs-defender-download outputs: - contextPath: InfoFile.Name description: The file name. type: String - contextPath: InfoFile.EntryID description: The File entry ID. type: String - contextPath: InfoFile.Size description: The file size. type: Number - contextPath: InfoFile.Type description: The file type. type: String - contextPath: InfoFile.Info description: Basic information of the file. type: String - contextPath: InfoFile.Extension description: File extension. type: String - arguments: - description: The project to retrieve the backups from. name: project description: Returns the available backups. name: prisma-cloud-compute-get-backups outputs: - contextPath: PrismaCloudCompute.Backups.Id description: The ID of the backup. type: String - contextPath: PrismaCloudCompute.Backups.Name description: The name of the backup. type: String - contextPath: PrismaCloudCompute.Backups.Release description: The release of the backup. type: String - contextPath: PrismaCloudCompute.Backups.Time description: The time of the backup. type: Date - description: Get runtime file integrity audit events. name: prisma-cloud-compute-get-file-integrity-events arguments: - name: hostname description: Hostname for which to get runtime file integrity audit events. Either event_id or hostname is required. - name: event_id description: Event ID of runtime file integrity audit event for which to get details. Either event_id or hostname is required. - name: limit description: Limit on number of events to return. Only relevant if filtering by hostname. defaultValue: "10" - description: 'Minimum timestamp for event search. Format: YYYY-mm-ddTHH:MM:SSZ.' name: from_date - description: 'Maximum timestamp for event search. Format: YYYY-mm-ddTHH:MM:SSZ.' name: to_date - description: Search term to search events for. name: search_term - auto: PREDEFINED defaultValue: desc description: Whether to sort by ascending or descending time. name: sort predefined: - asc - desc outputs: - contextPath: PrismaCloudCompute.FileIntegrity.Path description: The absolute path of the event. type: string - contextPath: PrismaCloudCompute.FileIntegrity.RuleName description: The name of the applied rule for auditing file integrity rules. type: string - contextPath: PrismaCloudCompute.FileIntegrity.AccountID description: The cloud account ID. type: string - contextPath: PrismaCloudCompute.FileIntegrity.User description: The user that initiated the event. type: string - contextPath: PrismaCloudCompute.FileIntegrity.Time description: The time of the event. type: date - contextPath: PrismaCloudCompute.FileIntegrity.Hostname description: The hostname on which the event was found. type: string - contextPath: PrismaCloudCompute.FileIntegrity.EventType description: 'Represents the type of the file integrity event. Possible values: [metadata,read,write].' type: string - contextPath: PrismaCloudCompute.FileIntegrity.Collections description: Collections to which this event applies. - contextPath: PrismaCloudCompute.FileIntegrity.Fqdn description: The current fully qualified domain name used in audit alerts. type: string - contextPath: PrismaCloudCompute.FileIntegrity.FileType description: Represents the file type. type: number - contextPath: PrismaCloudCompute.FileIntegrity.ProcessName description: The name of the process that initiated the event. type: string - contextPath: PrismaCloudCompute.FileIntegrity.Cluster description: The cluster on which the event was found. type: string - contextPath: PrismaCloudCompute.FileIntegrity._Id description: The activity's unique identifier. type: string - contextPath: PrismaCloudCompute.FileIntegrity.Description description: A human readable description of the action performed on the path. type: string - description: Use this command to unstuck the fetch stream in case it's getting duplicated incidents. name: prisma-cloud-compute-unstuck-fetch-stream - name: prisma-cloud-compute-ci-scan-results-list description: Retrieves all scan reports for images scanned by the Jenkins plugin or twistcli. Maps to Monitor > Vulnerabilities > Images > CI in the Console UI. The default will retrieve only the passed scans. arguments: - name: account_ids description: A comma-separated list of cloud account IDs to filter the result by. isArray: true - name: resource_ids description: A comma-separated list of resource IDs to scope the query by. isArray: true - name: region description: A comma-separated list of regions to scope the query by. isArray: true - name: scan_id description: Scan ID used in the image layers fetch. - name: image_id description: Image ID of scanned image. - name: job_name description: A comma-separated list of Jenkins job names. isArray: true - name: search description: Retrieves the result for a search term. isArray: true - name: pass description: Indicates whether to filter on passed scans (true) or not (false). defaultValue: "true" predefined: - "true" - "false" - name: scan_time_to description: Filters results by end datetime. Based on scan time. - name: scan_time_from description: Filters results by start datetime. Based on scan time. - name: limit description: The maximum number of CI scan results to return. Must be between 1-50. defaultValue: "50" - name: offset description: The offset by which to begin listing CI scan results. defaultValue: "0" - name: all_results description: Whether to retrieve all results. The "limit" argument will be ignored. Might slow down the command run time. Using this argument may return a lot of results and is not recommended to be used often. defaultValue: "false" predefined: - "true" - "false" - name: verbose description: Whether to retrieve all fields of each scan result. When used with the "all_results" argument, it may return a lot of results in a file. defaultValue: "false" predefined: - "true" - "false" outputs: - contextPath: PrismaCloudCompute.CIScan._id description: The scan ID. type: String - contextPath: PrismaCloudCompute.CIScan.time description: The scan time. type: String - contextPath: PrismaCloudCompute.CIScan.pass description: Whether the scan passed. type: Boolean - contextPath: PrismaCloudCompute.CIScan.vulnFailureSummary description: Vulnerability scan failure summary. type: String - contextPath: PrismaCloudCompute.CIScan.version description: The scan version. type: String - contextPath: PrismaCloudCompute.CIScan.entityInfo._id description: The scanned entity ID. type: String - contextPath: PrismaCloudCompute.CIScan.entityInfo.type description: The scanned entity type. type: String - contextPath: PrismaCloudCompute.CIScan.entityInfo.hostname description: The scanned entity hostname. type: String - contextPath: PrismaCloudCompute.CIScan.entityInfo.scanTime description: The entity scan time. type: String - contextPath: PrismaCloudCompute.CIScan.entityInfo.binaries description: Binaries in the scanned entity. type: Unknown - contextPath: PrismaCloudCompute.CIScan.entityInfo.Secrets description: Secrets found in the scanned entity. type: Unknown - contextPath: PrismaCloudCompute.CIScan.entityInfo.startupBinaries description: Startup binaries in the scanned entity. type: Unknown - contextPath: PrismaCloudCompute.CIScan.entityInfo.osDistro description: The OS distribution. type: String - contextPath: PrismaCloudCompute.CIScan.entityInfo.osDistroVersion description: The OS distribution version. type: String - contextPath: PrismaCloudCompute.CIScan.entityInfo.osDistroRelease description: The OS distribution release. type: String - contextPath: PrismaCloudCompute.CIScan.entityInfo.distro description: The distribution. type: String - contextPath: PrismaCloudCompute.CIScan.entityInfo.packages description: Packages in the scanned entity. type: Unknown - contextPath: PrismaCloudCompute.CIScan.entityInfo.files description: Files in the scanned entity. type: Unknown - contextPath: PrismaCloudCompute.CIScan.entityInfo.packageManager description: The package manager. type: Boolean - contextPath: PrismaCloudCompute.CIScan.entityInfo.applications description: Applications in the scanned entity. type: Unknown - contextPath: PrismaCloudCompute.CIScan.entityInfo.isARM64 description: Whether the scanned entity is ARM64. type: Boolean - contextPath: PrismaCloudCompute.CIScan.entityInfo.packageCorrelationDone description: Whether package correlation was done. type: Boolean - contextPath: PrismaCloudCompute.CIScan.entityInfo.redHatNonRPMImage description: Whether it is a RedHat non-RPM image. type: Boolean - contextPath: PrismaCloudCompute.CIScan.entityInfo.foundSecrets description: Whether secrets were found. type: Unknown - contextPath: PrismaCloudCompute.CIScan.entityInfo.secretScanMetrics description: Secret scan metrics. type: Unknown - contextPath: PrismaCloudCompute.CIScan.entityInfo.image description: The scanned image. type: Unknown - contextPath: PrismaCloudCompute.CIScan.entityInfo.history description: The image history. type: Unknown - contextPath: PrismaCloudCompute.CIScan.entityInfo.id description: The entity ID. type: String - contextPath: PrismaCloudCompute.CIScan.entityInfo.complianceIssues description: Compliance issues found. type: Unknown - contextPath: PrismaCloudCompute.CIScan.entityInfo.allCompliance description: All compliance data. type: Unknown - contextPath: PrismaCloudCompute.CIScan.entityInfo.vulnerabilities description: Vulnerabilities found. type: Unknown - contextPath: PrismaCloudCompute.CIScan.entityInfo.repoTag description: Repository tag. type: Unknown - contextPath: PrismaCloudCompute.CIScan.entityInfo.tags description: Image tags. type: Unknown - contextPath: PrismaCloudCompute.CIScan.entityInfo.repoDigests description: Repository digests. type: Unknown - contextPath: PrismaCloudCompute.CIScan.entityInfo.creationTime description: Image creation time. type: String - contextPath: PrismaCloudCompute.CIScan.entityInfo.pushTime description: Image push time. type: String - contextPath: PrismaCloudCompute.CIScan.entityInfo.vulnerabilitiesCount description: Number of vulnerabilities found. type: Number - contextPath: PrismaCloudCompute.CIScan.entityInfo.complianceIssuesCount description: Number of compliance issues found. type: Number - contextPath: PrismaCloudCompute.CIScan.entityInfo.vulnerabilityDistribution description: Vulnerability distribution data. type: Unknown - contextPath: PrismaCloudCompute.CIScan.entityInfo.complianceDistribution description: Compliance distribution data. type: Unknown - contextPath: PrismaCloudCompute.CIScan.entityInfo.vulnerabilityRiskScore description: Vulnerability risk score. type: Number - contextPath: PrismaCloudCompute.CIScan.entityInfo.complianceRiskScore description: Compliance risk score. type: Number - contextPath: PrismaCloudCompute.CIScan.entityInfo.layers description: Image layers data. type: Unknown - contextPath: PrismaCloudCompute.CIScan.entityInfo.topLayer description: Top image layer data. type: String - contextPath: PrismaCloudCompute.CIScan.entityInfo.riskFactors description: Risk factors data. type: Unknown - contextPath: PrismaCloudCompute.CIScan.entityInfo.labels description: Image labels. type: Unknown - contextPath: PrismaCloudCompute.CIScan.entityInfo.installedProducts description: Installed products data. type: Unknown - contextPath: PrismaCloudCompute.CIScan.entityInfo.scanVersion description: The scan version. type: String - contextPath: PrismaCloudCompute.CIScan.entityInfo.scanBuildDate description: The scan build date. type: String - contextPath: PrismaCloudCompute.CIScan.entityInfo.firstScanTime description: First scan time. type: String - contextPath: PrismaCloudCompute.CIScan.entityInfo.cloudMetadata description: Cloud metadata. type: Unknown - contextPath: PrismaCloudCompute.CIScan.entityInfo.instances description: Instance data. type: Unknown - contextPath: PrismaCloudCompute.CIScan.entityInfo.hosts description: Host data. type: Unknown - contextPath: PrismaCloudCompute.CIScan.entityInfo.err description: Error data. type: String - contextPath: PrismaCloudCompute.CIScan.entityInfo.collections description: Collection data. type: Unknown - contextPath: PrismaCloudCompute.CIScan.entityInfo.scanID description: The scan ID. type: Number - contextPath: PrismaCloudCompute.CIScan.entityInfo.trustStatus description: Trust status data. type: String - contextPath: PrismaCloudCompute.CIScan.entityInfo.firewallProtection description: Firewall protection data. type: Unknown - contextPath: PrismaCloudCompute.CIScan.entityInfo.appEmbedded description: Whether app is embedded. type: Boolean - contextPath: PrismaCloudCompute.CIScan.entityInfo.wildFireUsage description: WildFire usage data. type: Unknown - contextPath: PrismaCloudCompute.CIScan.entityInfo.agentless description: Whether it is an agentless scan. type: Boolean - contextPath: PrismaCloudCompute.CIScan.entityInfo.malwareAnalyzedTime description: Malware analyzed time. type: String - name: prisma-cloud-compute-trusted-images-list description: Returns the trusted registries, repositories, and images. Maps to the image table in Defend > Compliance > Trusted Images in the Console UI. outputs: - contextPath: PrismaCloudCompute.TrustedImage.policy.enabled description: Whether the trusted image policy is enabled. type: Boolean - contextPath: PrismaCloudCompute.TrustedImage.policy._id description: The ID of the trusted image policy. type: String - contextPath: PrismaCloudCompute.TrustedImage.policy.rules.name description: The name of the trusted image rule. type: String - contextPath: PrismaCloudCompute.TrustedImage.policy.rules.allowedGroups description: The allowed groups for the trusted image rule. type: Unknown - contextPath: PrismaCloudCompute.TrustedImage.policy.rules.effect description: The effect of the trusted image rule. type: String - contextPath: PrismaCloudCompute.TrustedImage.policy.rules.modified description: The last modified timestamp for the trusted image rule. type: Date - contextPath: PrismaCloudCompute.TrustedImage.policy.rules.previousName description: The previous name of the trusted image rule. type: String - contextPath: PrismaCloudCompute.TrustedImage.policy.rules.owner description: The owner of the trusted image rule. type: String - contextPath: PrismaCloudCompute.TrustedImage.policy.rules.disabled description: Whether the trusted image rule is disabled. type: Boolean - contextPath: PrismaCloudCompute.TrustedImage.policy.rules.collections description: The collections for the trusted image rule. type: Unknown - contextPath: PrismaCloudCompute.TrustedImage.groups.modified description: The last modified timestamp for the trusted image group. type: Date - contextPath: PrismaCloudCompute.TrustedImage.groups.owner description: The owner of the trusted image group. type: String - contextPath: PrismaCloudCompute.TrustedImage.groups.name description: The name of the trusted image group. type: String - contextPath: PrismaCloudCompute.TrustedImage.groups.previousName description: The previous name of the trusted image group. type: String - contextPath: PrismaCloudCompute.TrustedImage.groups._id description: The ID of the trusted image group. type: String - contextPath: PrismaCloudCompute.TrustedImage.groups.images description: The images in the trusted image group. type: Unknown - name: prisma-cloud-compute-trusted-images-update description: Updates a trusted image to the system. Specify trusted images using either the image name or layers properties. This is a potentially harmful command which overwrites the existing list, so use with caution. We recommend that is only be used in a playbook by a script that uses it. execution: true arguments: - name: images_list_json description: JSON containing the list of trusted images to update. In order to view the structure, use ***prisma-cloud-compute-trusted-images-list*** to retrieve the current state of the list. required: true - name: prisma-cloud-compute-container-scan-results-list description: Retrieves container scan reports. Maps to Monitor > Compliance > Containers in the Console UI. arguments: - name: collections description: A comma-separated list of collection names that you have defined in Prisma Cloud Compute. isArray: true - name: account_ids description: A comma-separated list of cloud account IDs. isArray: true - name: clusters description: A comma-separated list of clusters to filter by. isArray: true - name: namespaces description: A comma-separated list of namespaces to filter by. isArray: true - name: resource_ids description: A comma-separated list of resource IDs to scope the query by. isArray: true - name: region description: A comma-separated list of regions to scope the query by. isArray: true - name: container_ids description: A comma-separated list of container IDs to retrieve details for. isArray: true - name: profile_id description: A comma-separated list of runtime profile IDs to filter by. isArray: true - name: image_name description: A comma-separated list of image names to filter by. isArray: true - name: image_id description: A comma-separated list of image IDs to filter by. isArray: true - name: hostname description: A comma-separated list of hostnames to filter by. isArray: true - name: compliance_ids description: A comma-separated list of compliance IDs to filter by. isArray: true - name: agentless description: Whether to filter by agentless scans. predefined: - "true" - "false" - name: search description: Term to search for. - name: limit description: The maximum number of container scan reports to return. Must be between 1-50. defaultValue: "50" - name: offset description: The offset by which to begin listing container scan reports. defaultValue: "0" - auto: PREDEFINED name: all_results description: Whether to retrieve all results. The "limit" argument will be ignored. Using this argument may return a lot of results and might slow down the command run time. Therefore, it is not recommended to be used often. defaultValue: "false" predefined: - "true" - "false" outputs: - contextPath: PrismaCloudCompute.ContainersScanResults._id description: The container scan ID. type: String - contextPath: PrismaCloudCompute.ContainersScanResults.hostname description: The container hostname. type: String - contextPath: PrismaCloudCompute.ContainersScanResults.scanTime description: The container scan time. type: Date - contextPath: PrismaCloudCompute.ContainersScanResults.collections description: The collections the container belongs to. type: Unknown - contextPath: PrismaCloudCompute.ContainersScanResults.firewallProtection description: Firewall protection data. type: Unknown - contextPath: PrismaCloudCompute.ContainersScanResults.csa description: Container security assessment data. type: Boolean - contextPath: PrismaCloudCompute.ContainersScanResults.info.name description: The container name. type: String - contextPath: PrismaCloudCompute.ContainersScanResults.info.profileID description: The profile ID. type: String - contextPath: PrismaCloudCompute.ContainersScanResults.info.infra description: Whether the container is infrastructure. type: Boolean - contextPath: PrismaCloudCompute.ContainersScanResults.info.id description: The container ID. type: String - contextPath: PrismaCloudCompute.ContainersScanResults.info.ImageID description: The container image ID. type: String - contextPath: PrismaCloudCompute.ContainersScanResults.info.image description: The container image. type: String - contextPath: PrismaCloudCompute.ContainersScanResults.info.imageName description: The container image name. type: String - contextPath: PrismaCloudCompute.ContainersScanResults.info.app description: The container application name. type: String - contextPath: PrismaCloudCompute.ContainersScanResults.info.namespace description: The container namespace. type: String - contextPath: PrismaCloudCompute.ContainersScanResults.info.cluster description: The container cluster name. type: String - contextPath: PrismaCloudCompute.ContainersScanResults.info.clusterType description: The container cluster type. type: String - contextPath: PrismaCloudCompute.ContainersScanResults.info.externalLabels description: Container external labels. type: Unknown - contextPath: PrismaCloudCompute.ContainersScanResults.info.complianceIssues description: Compliance issues found. type: Unknown - contextPath: PrismaCloudCompute.ContainersScanResults.info.allCompliance description: All compliance data. type: Unknown - contextPath: PrismaCloudCompute.ContainersScanResults.info.complianceIssuesCount description: Number of compliance issues. type: Number - contextPath: PrismaCloudCompute.ContainersScanResults.info.complianceRiskScore description: Compliance risk score. type: Number - contextPath: PrismaCloudCompute.ContainersScanResults.info.complianceDistribution description: Compliance issue distribution. type: Unknown - contextPath: PrismaCloudCompute.ContainersScanResults.info.processes description: Container processes data. type: Unknown - contextPath: PrismaCloudCompute.ContainersScanResults.info.network description: Network data. type: Unknown - contextPath: PrismaCloudCompute.ContainersScanResults.info.labels description: Container labels. type: Unknown - contextPath: PrismaCloudCompute.ContainersScanResults.info.installedProducts description: Installed products data. type: Unknown - contextPath: PrismaCloudCompute.ContainersScanResults.info.cloudMetadata description: Cloud metadata. type: Unknown - contextPath: PrismaCloudCompute.ContainersScanResults.info.startTime description: Container start time. type: Date - name: prisma-cloud-compute-hosts-list description: Returns minimal information that includes hostname, distro, distro-release, collections, clusters, and agentless about all deployed hosts. arguments: - name: collections description: A comma-separated list of collection names that you have defined in Prisma Cloud Compute. isArray: true - name: account_ids description: A comma-separated list of cloud account IDs. isArray: true - name: clusters description: A comma-separated list of clusters to filter by. isArray: true - name: resource_ids description: A comma-separated list of resource IDs to scope the query by. isArray: true - name: region description: A comma-separated list of regions to scope the query by. isArray: true - name: hostname description: A comma-separated list of hostnames to filter by. isArray: true - name: compliance_ids description: A comma-separated list of compliance IDs to filter by. isArray: true - name: agentless description: Whether to filter by agentless scans. predefined: - "true" - "false" - name: search description: Term to search for. - name: limit description: The maximum number of container scan reports to return. Must be between 1-50. defaultValue: "50" - name: offset description: The offset by which to begin listing container scan reports. defaultValue: "0" outputs: - contextPath: PrismaCloudCompute.Hosts._id description: The host ID. type: String - contextPath: PrismaCloudCompute.Hosts.type description: The host type. type: String - contextPath: PrismaCloudCompute.Hosts.hostname description: The host hostname. type: String - contextPath: PrismaCloudCompute.Hosts.scanTime description: The host scan time. type: Date - contextPath: PrismaCloudCompute.Hosts.Secrets description: Secrets found on the host. type: Unknown - contextPath: PrismaCloudCompute.Hosts.osDistro description: The OS distribution. type: String - contextPath: PrismaCloudCompute.Hosts.osDistroVersion description: The OS distribution version. type: String - contextPath: PrismaCloudCompute.Hosts.osDistroRelease description: The OS distribution release. type: String - contextPath: PrismaCloudCompute.Hosts.distro description: The host distribution. type: String - contextPath: PrismaCloudCompute.Hosts.foundSecrets description: Whether secrets were found. type: Boolean - contextPath: PrismaCloudCompute.Hosts.vulnerabilitiesCount description: Number of vulnerabilities found. type: Number - contextPath: PrismaCloudCompute.Hosts.complianceIssuesCount description: Number of compliance issues found. type: Number - contextPath: PrismaCloudCompute.Hosts.vulnerabilityRiskScore description: The host's vulnerability risk score. type: Number - contextPath: PrismaCloudCompute.Hosts.complianceRiskScore description: The host's compliance risk score. type: Number - contextPath: PrismaCloudCompute.Hosts.riskFactors description: Risk factors for the host. type: Unknown - contextPath: PrismaCloudCompute.Hosts.collections description: The collections the host belongs to. type: Unknown - contextPath: PrismaCloudCompute.Hosts.agentless description: Whether the host was scanned agentlessly. type: Boolean - name: prisma-cloud-compute-runtime-container-audit-events-list description: Retrieves all container audit events when a runtime sensor such as process, network, file system, or system call detects an activity that deviates from the predictive model. arguments: - name: collections description: A comma-separated list of collection names that you have defined in Prisma Cloud Compute. isArray: true - name: account_ids description: A comma-separated list of cloud account IDs. isArray: true - name: clusters description: A comma-separated list of cluster names. isArray: true - name: namespaces description: A comma-separated list of namespace names. isArray: true - name: resource_ids description: A comma-separated list of resource IDs. isArray: true - name: region description: A comma-separated list of cloud region names. isArray: true - name: audit_id description: A comma-separated list of audit event IDs. isArray: true - name: profile_id description: A comma-separated list of runtime profile IDs. isArray: true - name: image_name description: A comma-separated list of image names. isArray: true - name: container description: A comma-separated list of container names. isArray: true - name: container_id description: A comma-separated list of container IDs. isArray: true - name: type description: A comma-separated list of audit event types. isArray: true - name: effect description: A comma-separated list of audit event effects. isArray: true - name: user description: A comma-separated list of users. isArray: true - name: os description: A comma-separated list of operating systems. isArray: true - name: app description: A comma-separated list of applications. isArray: true - name: hostname description: A comma-separated list of hostnames. isArray: true - name: search description: Term to search for. - name: limit description: The maximum number of container scan reports to return. Must be between 1-50. defaultValue: "50" - name: offset description: The offset by which to begin listing container scan reports. defaultValue: "0" outputs: - contextPath: PrismaCloudCompute.RuntimeContainerAuditEvents.os description: The operating system of the container. type: String - contextPath: PrismaCloudCompute.RuntimeContainerAuditEvents._id description: The audit event ID. type: String - contextPath: PrismaCloudCompute.RuntimeContainerAuditEvents.time description: The audit event time. type: Date - contextPath: PrismaCloudCompute.RuntimeContainerAuditEvents.hostname description: The hostname. type: String - contextPath: PrismaCloudCompute.RuntimeContainerAuditEvents.fqdn description: The audited event container's fully qualified domain name. type: String - contextPath: PrismaCloudCompute.RuntimeContainerAuditEvents.user description: The audited event user. type: String - contextPath: PrismaCloudCompute.RuntimeContainerAuditEvents.type description: The audit event type. type: String - contextPath: PrismaCloudCompute.RuntimeContainerAuditEvents.containerId description: The container ID. type: String - contextPath: PrismaCloudCompute.RuntimeContainerAuditEvents.containerName description: The container name. type: String - contextPath: PrismaCloudCompute.RuntimeContainerAuditEvents.imageName description: The image name. type: String - contextPath: PrismaCloudCompute.RuntimeContainerAuditEvents.imageId description: The image ID. type: String - contextPath: PrismaCloudCompute.RuntimeContainerAuditEvents.namespace description: The namespace. type: String - contextPath: PrismaCloudCompute.RuntimeContainerAuditEvents.effect description: The audit event effect. type: String - contextPath: PrismaCloudCompute.RuntimeContainerAuditEvents.ruleName description: The rule name. type: String - contextPath: PrismaCloudCompute.RuntimeContainerAuditEvents.msg description: The audit event message. type: String - contextPath: PrismaCloudCompute.RuntimeContainerAuditEvents.profileId description: The profile ID. type: String - contextPath: PrismaCloudCompute.RuntimeContainerAuditEvents.pid description: The process ID. type: Number - contextPath: PrismaCloudCompute.RuntimeContainerAuditEvents.processPath description: The process path. type: String - contextPath: PrismaCloudCompute.RuntimeContainerAuditEvents.collections description: The collections. type: Unknown - contextPath: PrismaCloudCompute.RuntimeContainerAuditEvents.attackType description: The attack type. type: String - contextPath: PrismaCloudCompute.RuntimeContainerAuditEvents.count description: The count of audit events. type: Number - contextPath: PrismaCloudCompute.RuntimeContainerAuditEvents.container description: Whether the audit event was from a container. type: Boolean - contextPath: PrismaCloudCompute.RuntimeContainerAuditEvents.severity description: The severity of the audit event. type: String - contextPath: PrismaCloudCompute.RuntimeContainerAuditEvents.region description: The region of the container. type: String - contextPath: PrismaCloudCompute.RuntimeContainerAuditEvents.accountID description: The account ID of the container. type: String - contextPath: PrismaCloudCompute.RuntimeContainerAuditEvents.cluster description: The cluster of the container. type: String - contextPath: PrismaCloudCompute.RuntimeContainerAuditEvents.filepath description: The file path of the audit event. type: String - contextPath: PrismaCloudCompute.RuntimeContainerAuditEvents.md5 description: The MD5 hash of the file. type: String - contextPath: PrismaCloudCompute.RuntimeContainerAuditEvents.command description: The command of the audit event. type: String - contextPath: PrismaCloudCompute.RuntimeContainerAuditEvents.provider description: The provider of the container. type: String - name: prisma-cloud-compute-archive-audit-incident description: Acknowledges an incident and moves it to an archived state. arguments: - name: incident_id description: Incident ID. isArray: false required: true - auto: PREDEFINED name: action description: Action for the command. archive - incident will be archived, unarchive - incident will be unarchived. predefined: - "archive" - "unarchive" defaultValue: "archive" - name: prisma-cloud-compute-runtime-host-audit-events-list description: Retrieves the runtime host audit events. arguments: - name: clusters description: A comma-separated list of cluster names. isArray: true - name: namespaces description: A comma-separated list of namespace names. isArray: true - name: audit_id description: A comma-separated list of audit event IDs. isArray: true - name: profile_id description: A comma-separated list of runtime profile IDs. isArray: true - name: image_name description: A comma-separated list of image names. isArray: true - name: container description: A comma-separated list of container names. isArray: true - name: container_id description: A comma-separated list of container IDs. isArray: true - name: type description: A comma-separated list of audit event types. isArray: true - name: effect description: A comma-separated list of audit event effects. isArray: true - name: user description: A comma-separated list of users. isArray: true - name: os description: A comma-separated list of operating systems. isArray: true - name: app description: A comma-separated list of applications. isArray: true - name: hostname description: A comma-separated list of hostnames. isArray: true - name: time description: Time is used to filter by audit time, format '%Y-%m-%dT%H:%M:%S.%SZ'. - name: attack_type description: AttackTypes is used to filter by runtime audit attack type. - name: limit description: The maximum number of container scan reports to return. Must be between 1-50. defaultValue: "50" - name: offset description: The offset by which to begin listing container scan reports. defaultValue: "0" - auto: PREDEFINED name: all_results description: Whether to retrieve all results. The "limit" argument will be ignored. Using this argument may return a lot of results and might slow down the command run time. Therefore, it is not recommended to be used often. defaultValue: "false" predefined: - "true" - "false" outputs: - contextPath: PrismaCloudCompute.RuntimeHostAuditEvents._id description: The audit event ID. type: String - contextPath: PrismaCloudCompute.RuntimeHostAuditEvents.accountID description: The account ID of the container. type: String - contextPath: PrismaCloudCompute.RuntimeHostAuditEvents.app description: The app. type: String - contextPath: PrismaCloudCompute.RuntimeHostAuditEvents.attackType description: The attack type. type: String - contextPath: PrismaCloudCompute.RuntimeHostAuditEvents.attackTechniques description: Attack technique of the event. type: Unknown - contextPath: PrismaCloudCompute.RuntimeHostAuditEvents.collections description: The collections. type: Unknown - contextPath: PrismaCloudCompute.RuntimeHostAuditEvents.command description: The command of the audit event. type: String - contextPath: PrismaCloudCompute.RuntimeHostAuditEvents.count description: The count of audit events. type: Number - contextPath: PrismaCloudCompute.RuntimeHostAuditEvents.effect description: The audit event effect. type: String - contextPath: PrismaCloudCompute.RuntimeHostAuditEvents.filepath description: The file path of the audit event. type: String - contextPath: PrismaCloudCompute.RuntimeHostAuditEvents.fqdn description: The fully qualified domain name used in the audit event. type: String - contextPath: PrismaCloudCompute.RuntimeHostAuditEvents.events.hostname description: The hostname on which the command was invoked. type: String - contextPath: PrismaCloudCompute.RuntimeHostAuditEvents.md5 description: The MD5 hash of the file. type: String - contextPath: PrismaCloudCompute.RuntimeHostAuditEvents.msg description: The audit event message. type: String - contextPath: PrismaCloudCompute.RuntimeHostAuditEvents.pid description: The process ID. type: Number - contextPath: PrismaCloudCompute.RuntimeHostAuditEvents.processPath description: The process path. type: String - contextPath: PrismaCloudCompute.RuntimeHostAuditEvents.profileId description: The profile ID. type: String - contextPath: PrismaCloudCompute.RuntimeHostAuditEvents.provider description: The provider of the container. type: String - contextPath: PrismaCloudCompute.RuntimeHostAuditEvents.region description: The region of the container. type: String - contextPath: PrismaCloudCompute.RuntimeHostAuditEvents.resourceID description: The resource ID of the event. type: String - contextPath: PrismaCloudCompute.RuntimeHostAuditEvents.ruleName description: The rule name. type: String - contextPath: PrismaCloudCompute.RuntimeHostAuditEvents.severity description: The severity of the audit event. type: String - contextPath: PrismaCloudCompute.RuntimeHostAuditEvents.time description: The audit event time. type: Date - contextPath: PrismaCloudCompute.RuntimeHostAuditEvents.type description: The audit event type. type: String - contextPath: PrismaCloudCompute.RuntimeHostAuditEvents.user description: The audited event user. type: String - name: prisma-cloud-compute-runtime-container-policy-list description: Retrieves the runtime policy for containers protected by Defender. A policy consists of ordered rules. arguments: - auto: PREDEFINED name: all_results description: Whether to retrieve all results. The "limit" argument will be ignored. Using this argument may return a lot of results and might slow down the command run time. Therefore, it is not recommended to be used often. defaultValue: "false" predefined: - "true" - "false" - name: limit description: The maximum number of container scan reports to return. Must be between 1-50. defaultValue: "50" - name: offset description: The offset by which to begin listing container scan reports. defaultValue: "0" outputs: - contextPath: PrismaCloudCompute.Policies.RuntimeContainerPolicy.name description: The audit event time. type: Date - contextPath: PrismaCloudCompute.Policies.RuntimeContainerPolicy.owner description: The audit event type. type: String - contextPath: PrismaCloudCompute.Policies.RuntimeContainerPolicy.modified description: The audited event modified time. type: Date - name: prisma-cloud-compute-custom-feeds-malware-remove arguments: - description: The MD5 value to be removed from Prisma. name: md5 required: true description: Remove custom MD5 malware hashes. tests: - PaloAltoNetworks_PrismaCloudCompute-Test fromversion: 5.0.0 defaultmapperin: PaloAltoNetworks_PrismaCloudCompute-mapper defaultclassifier: PaloAltoNetworks_PrismaCloudCompute sectionorder: - Connect - Collect