category: Network Security
provider: Palo Alto Networks
deprecated: true
sectionorder:
- Connect
- Collect
commonfields:
  id: RedLock
  version: -1
configuration:
- defaultvalue: https://api.prismacloud.io/
  display: Server URL
  name: url
  required: true
  type: 0
  section: Connect
- display: Username
  name: credentials
  required: true
  type: 9
  section: Connect
- display: Customer name
  name: customer
  type: 0
  section: Connect
  advanced: true
  required: false
- display: Fetch incidents
  name: isFetch
  type: 8
  section: Collect
  required: false
- display: Incident type
  name: incidentType
  type: 13
  section: Connect
  required: false
- display: Fetch only incidents matching this rule name
  name: ruleName
  type: 0
  section: Collect
  advanced: true
  required: false
- display: Fetch only incidents matching this policy name
  name: policyName
  type: 0
  section: Collect
  advanced: true
  required: false
- display: Fetch only incidents with this severity
  name: policySeverity
  type: 0
  section: Collect
  advanced: true
  required: false
- defaultvalue: 7 days
  display: First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days, 3 months, 1 year)
  name: fetch_time
  type: 0
  section: Collect
  required: false
- display: Use system proxy settings
  name: proxy
  type: 8
  section: Connect
  advanced: true
  required: false
- display: Trust any certificate (not secure)
  name: unsecure
  type: 8
  section: Connect
  advanced: true
  required: false
description: Deprecated. Use the Prisma Cloud v2 integration instead.
display: Prisma Cloud (RedLock) (Deprecated)
name: RedLock
script:
  commands:
  - arguments:
    - description: The maximum number of records to return. '; limit search records to {}' is appended to every query where {} is the maximum number of records to return. If no value is provided, only 1 record is returned.
      name: limit
    - description: 'The RQL config query to run. Examples of RQL config queries can be found here: https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-rql-reference/rql-reference/config-query/config-query-examples.html. Note that ` limit search records to 1` is automatically appended to each query and a `;` may need to be added to the end of the rql input to make the entire query valid.  The limit parameter adjusts this to be a value other than 1.'
      name: rql
      required: true
    description: Returns the results of an RQL config query.
    name: redlock-get-rql-response
    outputs:
    - contextPath: Redlock.RQL.Query
      description: The RQL query that was run.
      type: String
    - contextPath: Redlock.RQL.Response.AccountId
      description: The cloud account ID.
      type: Date
    - contextPath: Redlock.RQL.Response.AccountName
      description: The cloud account name.
      type: String
    - contextPath: Redlock.RQL.Response.AllowDrillDown
      description: Flag to allow drill down.
      type: Boolean
    - contextPath: Redlock.RQL.Response.CloudType
      description: The cloud type.
      type: String
    - contextPath: Redlock.RQL.Response.Data
      description: The data object returned by the RQL response.
      type: Object
    - contextPath: Redlock.RQL.Response.Deleted
      description: Flag if deleted.
      type: Boolean
    - contextPath: Redlock.RQL.Response.HasAlert
      description: Flag to check if RQL response has alerts.
      type: Boolean
    - contextPath: Redlock.RQL.Response.HasExtFindingRiskFactors
      description: Flag if query returns external risk factors.
      type: Boolean
    - contextPath: Redlock.RQL.Response.HasExternalFinding
      description: Flag for external findings.
      type: Boolean
    - contextPath: Redlock.RQL.Response.HasExternalIntegration
      description: Flag for external integration.
      type: Boolean
    - contextPath: Redlock.RQL.Response.HasNetwork
      description: Flag for determining if network exists.
      type: Boolean
    - contextPath: Redlock.RQL.Response.Id
      description: The RQL response ID.
      type: String
    - contextPath: Redlock.RQL.Response.InsertTs
      description: The response time.
      type: Date
    - contextPath: Redlock.RQL.Response.Name
      description: The RQL response name.
      type: String
    - contextPath: Redlock.RQL.Response.RegionId
      description: The cloud region ID.
      type: String
    - contextPath: Redlock.RQL.Response.RegionName
      description: The cloud region name.
      type: String
    - contextPath: Redlock.RQL.Response.ResourceType
      description: The resource type.
      type: String
    - contextPath: Redlock.RQL.Response.Rrn
      description: The account RRN.
      type: String
    - contextPath: Redlock.RQL.Response.Service
      description: The RQL response service.
      type: String
    - contextPath: Redlock.RQL.Response.StateId
      description: The response state ID.
      type: String
  - arguments:
    - description: Start time for search in the following string format -  MM/DD/YYYY
      name: time-range-date-from
    - description: End time for search in the following format -  MM/DD/YYYY
      name: time-range-date-to
    - description: The amount of units to go back in time
      name: time-range-value
    - auto: PREDEFINED
      description: The search unit. login and epoch are only available if timeRangeValue is not provided.
      name: time-range-unit
      predefined:
      - hour
      - day
      - week
      - month
      - year
      - login
      - epoch
    - auto: PREDEFINED
      description: The policy name
      name: policy-name
      predefined:
      - IAM password policy does not have a symbol
      - IAM password policy does not expire in 90 days
      - IAM password policy does not have a lowercase character
      - IAM password policy does not have a minimum of 14 characters
      - IAM password policy allows password reuse
      - Default Security Group does not restrict all traffic
      - IAM password policy does not have password expiration period
      - IAM password policy does not exist
      - Access keys are not rotated for 90 days
      - Security Groups allow internet traffic from internet to RDP port (3389)
      - Internet connectivity via tcp over insecure port
      - IAM policy allow full administrative privileges
      - Primitive IAM roles should not be used
      - Internet exposed instances
      - IAM user has both Console access and Access Keys
      - S3 buckets are accessible to public
      - Access logging not enabled on all CloudTrail buckets
      - CloudTrail trail is not integrated with CloudWatch Log
      - Security Groups allow internet traffic to SSH port (22)
      - CloudTrail logs are not encrypted using Customer Master Keys (CMKs)
      - Excessive login failures
      - VPC endpoints were not used for consuming S3 storage from within the VPC
      - Access logging not enabled on S3 buckets
      - S3 buckets do not have server side encryption
      - Account hijacking attempts
      - Security groups allow internet traffic
      - VPC subnets should not allow automatic public IP assignment
      - VPC Flow Logs not enabled
      - MFA not enabled for IAM users
      - Inactive users for more than 30 days
    - description: The policy label
      name: policy-label
    - description: The number of alerts to return
      name: limit
    - description: The policy compliance standard
      name: policy-compliance-standard
    - description: The cloud account ID.
      name: cloud-account-id
    - description: The cloud account name.
      name: cloud-account
    - description: The cloud region name.
      name: cloud-region
    - description: The alert rule name.
      name: alert-rule-name
    - description: The resource ID
      name: resource-id
    - description: The resource name
      name: resource-name
    - description: The resource type
      name: resource-type
    - auto: PREDEFINED
      defaultValue: open
      description: The alert status
      name: alert-status
      predefined:
      - open
      - resolved
      - dismissed
    - description: The alert ID
      name: alert-id
    - auto: PREDEFINED
      description: The cloud type
      name: cloud-type
      predefined:
      - aws
      - azure
      - gcp
    - auto: PREDEFINED
      description: The risk grade
      name: risk-grade
      predefined:
      - A
      - B
      - C
      - F
    - auto: PREDEFINED
      description: The policy type
      name: policy-type
      predefined:
      - anomaly
      - audit_event
      - config
      - network
    - auto: PREDEFINED
      description: The policy severity
      name: policy-severity
      predefined:
      - high
      - medium
      - low
    description: Search alerts on the Prisma Cloud (RedLock) platform. If no time-range arguments are given, the search will filter only alerts from the last 7 days.
    name: redlock-search-alerts
    outputs:
    - contextPath: Redlock.Alert.ID
      description: The ID of the returned alert.
      type: string
    - contextPath: Redlock.Alert.Status
      description: The status of the returned alert.
      type: string
    - contextPath: Redlock.Alert.AlertTime
      description: The time of the returned alert.
      type: string
    - contextPath: Redlock.Alert.Policy.ID
      description: The policy ID of the returned alert.
      type: string
    - contextPath: Redlock.Alert.Policy.Name
      description: The policy name of the returned alert.
      type: string
    - contextPath: Redlock.Alert.Policy.Type
      description: The policy type of the returned alert.
      type: string
    - contextPath: Redlock.Alert.Policy.Severity
      description: The policy severity of the returned alert.
      type: string
    - contextPath: Redlock.Alert.Policy.Remediable
      description: Whether or not the policy is remediable.
      type: boolean
    - contextPath: Redlock.Alert.RiskDetail.Rating
      description: The risk rating of the returned alert.
      type: string
    - contextPath: Redlock.Alert.RiskDetail.Score
      description: The risk score of the returned alert.
      type: string
    - contextPath: Redlock.Metadata.CountOfAlerts
      description: The number of alerts found.
      type: number
  - arguments:
    - default: true
      description: The alert ID
      name: alert-id
      required: true
    - description: Start time for search in the following string format -  MM/DD/YYYY, Should be provided along with time-range-date-to. If not both are provided, the time range will be set to the last 7 days and this argument will be ignored.
      name: time-range-date-from
    - description: End time for search in the following format -  MM/DD/YYYY, Should be provided along with time-range-date-from. If not both are provided, the time range will be set to the last 7 days and this argument will be ignored.
      name: time-range-date-to
    - auto: PREDEFINED
      defaultValue: 'true'
      description: Allows for retrieving entire / trimmed alert model
      name: detailed
      predefined:
      - 'true'
      - 'false'
    - description: List of additional keys to return from the resource JSON, specified as a comma separated list (e.g. "key1,key2,key3").  To preview all available resource JSON data, run redlock-get-alert-details with the "raw-response=true" option.
      name: resource_keys
    description: Gets the details of an alert based on alert ID
    name: redlock-get-alert-details
    outputs:
    - contextPath: Redlock.Alert.ID
      description: The alert ID
      type: string
    - contextPath: Redlock.Alert.Status
      description: The alert status
      type: string
    - contextPath: Redlock.Alert.AlertTime
      description: The time of the alert
      type: date
    - contextPath: Redlock.Alert.AlertRules
      description: Names of the alert rules that triggered this alert.
      type: string
    - contextPath: Redlock.Alert.Policy.ID
      description: The policy ID
      type: string
    - contextPath: Redlock.Alert.Policy.Name
      description: The policy name
      type: string
    - contextPath: Redlock.Alert.Policy.Type
      description: The type of policy
      type: string
    - contextPath: Redlock.Alert.Policy.Severity
      description: The policy severity
      type: string
    - contextPath: Redlock.Alert.Policy.Remediable
      description: Whether or not the policy is remediable
      type: boolean
    - contextPath: Redlock.Alert.RiskDetail.Rating
      description: The risk rating
      type: string
    - contextPath: Redlock.Alert.RiskDetail.Score
      description: The risk score
      type: string
    - contextPath: Redlock.Alert.Resource.AccountID
      description: The cloud account ID where the resource resides
      type: string
    - contextPath: Redlock.Alert.Resource.ID
      description: The Resource ID of the cloud resource
      type: string
    - contextPath: Redlock.Alert.Resource.Name
      description: The Resource Name of the cloud resource
      type: string
    - contextPath: Redlock.Alert.Resource.Data
      description: Additional keys from Resource.Data. Only appears when resource_keys argument is specified.
      type: json
    - contextPath: Redlock.Alert.Resource.Account
      description: The cloud account name where the resource resides
      type: string
  - arguments:
    - description: Comma-separated list of string IDs to be dismissed.
      name: alert-id
    - description: The amount of time to snooze. Both snooze value and unit must be specified.
      name: snooze-value
    - auto: PREDEFINED
      description: The time unit for if snoozing alert.  Both snooze value and unit must be specified if snoozing.
      name: snooze-unit
      predefined:
      - hour
      - day
      - week
      - month
      - year
      - epoch
    - description: Reason for dismissal.
      name: dismissal-note
      required: true
    - description: Start time for search in the following string format -  MM/DD/YYYY
      name: time-range-date-from
    - description: End time for search in the following format -  MM/DD/YYYY
      name: time-range-date-to
    - description: The amount of units to go back in time
      name: time-range-value
    - auto: PREDEFINED
      description: The search unit
      name: time-range-unit
      predefined:
      - hour
      - day
      - week
      - month
      - year
      - login
      - epoch
    - auto: PREDEFINED
      description: The policy name
      name: policy-name
      predefined:
      - IAM password policy does not have a symbol
      - IAM password policy does not expire in 90 days
      - IAM password policy does not have a lowercase character
      - IAM password policy does not have a minimum of 14 characters
      - IAM password policy allows password reuse
      - Default Security Group does not restrict all traffic
      - IAM password policy does not have password expiration period
      - IAM password policy does not exist
      - Access keys are not rotated for 90 days
      - Security Groups allow internet traffic from internet to RDP port (3389)
      - Internet connectivity via tcp over insecure port
      - IAM policy allow full administrative privileges
      - Primitive IAM roles should not be used
      - Internet exposed instances
      - IAM user has both Console access and Access Keys
      - S3 buckets are accessible to public
      - Access logging not enabled on all CloudTrail buckets
      - CloudTrail trail is not integrated with CloudWatch Log
      - Security Groups allow internet traffic to SSH port (22)
      - CloudTrail logs are not encrypted using Customer Master Keys (CMKs)
      - Excessive login failures
      - VPC endpoints were not used for consuming S3 storage from within the VPC
      - Access logging not enabled on S3 buckets
      - S3 buckets do not have server side encryption
      - Account hijacking attempts
      - Security groups allow internet traffic
      - VPC subnets should not allow automatic public IP assignment
      - VPC Flow Logs not enabled
      - MFA not enabled for IAM users
      - Inactive users for more than 30 days
    - description: The policy label
      name: policy-label
    - description: The policy compliance standard
      name: policy-compliance-standard
    - description: The cloud account
      name: cloud-account
    - description: The cloud region
      name: cloud-region
    - description: The alert rule name
      name: alert-rule-name
    - description: The resource ID
      name: resource-id
    - description: The resource name
      name: resource-name
    - description: The resource type
      name: resource-type
    - auto: PREDEFINED
      description: The alert status
      name: alert-status
      predefined:
      - open
      - resolved
      - dismissed
    - auto: PREDEFINED
      description: The cloud type
      name: cloud-type
      predefined:
      - aws
      - azure
      - gcp
    - auto: PREDEFINED
      description: The risk grade
      name: risk-grade
      predefined:
      - A
      - B
      - C
      - F
    - auto: PREDEFINED
      description: The policy type
      name: policy-type
      predefined:
      - anomaly
      - audit_event
      - config
      - network
    - auto: PREDEFINED
      description: The policy severity
      name: policy-severity
      predefined:
      - high
      - medium
      - low
    - description: Comma-separated string of policy IDs.
      name: policy-id
    description: Dismiss the alerts matching the given filter. Must provide either policy IDs or alert IDs.
    execution: true
    name: redlock-dismiss-alerts
    outputs:
    - contextPath: Redlock.DismissedAlert.ID
      description: The IDs of the dismissed alerts
      type: string
  - arguments:
    - description: The IDs of alerts to reopen
      name: alert-id
    - description: Start time for search in the following string format -  MM/DD/YYYY
      name: time-range-date-from
    - description: End time for search in the following format -  MM/DD/YYYY
      name: time-range-date-to
    - description: The amount of units to go back in time
      name: time-range-value
    - auto: PREDEFINED
      description: The search unit
      name: time-range-unit
      predefined:
      - hour
      - day
      - week
      - month
      - year
      - login
      - epoch
    - auto: PREDEFINED
      description: The policy name
      name: policy-name
      predefined:
      - IAM password policy does not have a symbol
      - IAM password policy does not expire in 90 days
      - IAM password policy does not have a lowercase character
      - IAM password policy does not have a minimum of 14 characters
      - IAM password policy allows password reuse
      - Default Security Group does not restrict all traffic
      - IAM password policy does not have password expiration period
      - IAM password policy does not exist
      - Access keys are not rotated for 90 days
      - Security Groups allow internet traffic from internet to RDP port (3389)
      - Internet connectivity via tcp over insecure port
      - IAM policy allow full administrative privileges
      - Primitive IAM roles should not be used
      - Internet exposed instances
      - IAM user has both Console access and Access Keys
      - S3 buckets are accessible to public
      - Access logging not enabled on all CloudTrail buckets
      - CloudTrail trail is not integrated with CloudWatch Log
      - Security Groups allow internet traffic to SSH port (22)
      - CloudTrail logs are not encrypted using Customer Master Keys (CMKs)
      - Excessive login failures
      - VPC endpoints were not used for consuming S3 storage from within the VPC
      - Access logging not enabled on S3 buckets
      - S3 buckets do not have server side encryption
      - Account hijacking attempts
      - Security groups allow internet traffic
      - VPC subnets should not allow automatic public IP assignment
      - VPC Flow Logs not enabled
      - MFA not enabled for IAM users
      - Inactive users for more than 30 days
    - description: The policy label
      name: policy-label
    - description: The policy compliance standard
      name: policy-compliance-standard
    - description: The cloud account
      name: cloud-account
    - description: The cloud region
      name: cloud-region
    - description: The alert rule name
      name: alert-rule-name
    - description: The resource ID
      name: resource-id
    - description: The resource name
      name: resource-name
    - description: The resource type
      name: resource-type
    - auto: PREDEFINED
      description: The alert status
      name: alert-status
      predefined:
      - open
      - resolved
      - dismissed
    - auto: PREDEFINED
      description: The cloud type
      name: cloud-type
      predefined:
      - aws
      - azure
      - gcp
    - auto: PREDEFINED
      description: The risk grade
      name: risk-grade
      predefined:
      - A
      - B
      - C
      - F
    - auto: PREDEFINED
      description: The policy type
      name: policy-type
      predefined:
      - anomaly
      - audit_event
      - config
      - network
    - auto: PREDEFINED
      description: The policy severity
      name: policy-severity
      predefined:
      - high
      - medium
      - low
    description: Re-open the alerts matching the given filter.  Must provide either policy IDs or alert IDs.
    execution: true
    name: redlock-reopen-alerts
    outputs:
    - contextPath: Redlock.ReopenedAlert.ID
      description: IDs of the re-opened alerts
      type: string
  - description: List the acceptable filters and values for alerts
    name: redlock-list-alert-filters
  - arguments:
    - description: The alert ID for which to get remediation details.
      name: alert-id
    description: Gets remediation details for the given alert.
    name: redlock-get-remediation-details
    outputs:
    - contextPath: Redlock.Alert.Remediation.Description
      description: Description of CLI remediation instructions.
      type: string
    - contextPath: Redlock.Alert.ID
      description: The ID of the alert to which the remediation details apply.
      type: string
    - contextPath: Redlock.Alert.Remediation.CLI
      description: The exact CLI command string.
      type: string
  - arguments:
    - description: Start time for the search, in the following string format -  MM/DD/YYYY
      name: time-range-date-from
    - description: End time for the search, in the following format -  MM/DD/YYYY
      name: time-range-date-to
    - description: The number of time range value units for the search. For example, 3 days, 5 weeks, etc.
      name: time-range-value
    - auto: PREDEFINED
      description: |-
        The search unit. Possible values are: "hour", "week", "month", "year", "login", or "epoch". The "login" and "epoch" options are only available if timeRangeValue
        is not provided.
      name: time-range-unit
      predefined:
      - hour
      - day
      - week
      - month
      - year
      - login
      - epoch
    - description: Query to run in Prisma Cloud config API using RQL language.
      name: query
      required: true
    - defaultValue: '100'
      description: Maximum number of entries to return.
      name: limit
    description: Search configuration inventory on the Prisma Cloud (RedLock) platform using RQL language.
    name: redlock-search-config
    outputs:
    - contextPath: Redlock.Asset.accountId
      description: Cloud Account ID
      type: Date
    - contextPath: Redlock.Asset.accountName
      description: Cloud Account Name
      type: String
    - contextPath: Redlock.Asset.allowDrillDown
      description: Flag to allow drill down.
      type: Boolean
    - contextPath: Redlock.Asset.cloudType
      description: Cloud Type
      type: String
    - contextPath: Redlock.Asset.deleted
      description: Asset was deleted?
      type: Boolean
    - contextPath: Redlock.Asset.hasAlert
      description: Asset has Prisma Cloud alert?
      type: Boolean
    - contextPath: Redlock.Asset.hasExtFindingRiskFactors
      description: Has External Finding Risk Factors?
      type: Boolean
    - contextPath: Redlock.Asset.hasExternalFinding
      description: Has External Finding?
      type: Boolean
    - contextPath: Redlock.Asset.hasExternalIntegration
      description: Has External Integration?
      type: Boolean
    - contextPath: Redlock.Asset.hasNetwork
      description: Has Network?
      type: Boolean
    - contextPath: Redlock.Asset.id
      description: Redlock Asset ID
      type: String
    - contextPath: Redlock.Asset.data
      description: Redlock Asset specific data
      type: Unknown
    - contextPath: Redlock.Asset.insertTs
      description: Insert Ts
      type: Date
    - contextPath: Redlock.Asset.name
      description: Asset Name
      type: String
    - contextPath: Redlock.Asset.regionId
      description: Cloud Region ID
      type: String
    - contextPath: Redlock.Asset.regionName
      description: Cloud Region Name
      type: String
    - contextPath: Redlock.Asset.resourceType
      description: Cloud Resource type
      type: String
    - contextPath: Redlock.Asset.rrn
      description: Cloud RRN
      type: String
    - contextPath: Redlock.Asset.service
      description: Cloud service
      type: String
    - contextPath: Redlock.Asset.stateId
      description: State ID
      type: String
  - arguments:
    - description: Start time for the search, in the following format -  MM/DD/YYYY.
      name: time-range-date-from
    - description: End time for the search, in the following format -  MM/DD/YYYY.
      name: time-range-date-to
    - description: The number of time range value units for the search. For example, 3 days, 5 weeks, etc.
      name: time-range-value
    - auto: PREDEFINED
      description: |-
        The search unit. Possible values are: "hour", "week", "month", "year", "login", or "epoch". The "login" and "epoch" options are only available if timeRangeValue
        is not provided.
      name: time-range-unit
      predefined:
      - hour
      - day
      - week
      - month
      - year
      - login
      - epoch
    - description: Query to run in Prisma Cloud search API using RQL language.
      name: query
      required: true
    - defaultValue: '100'
      description: Maximum number of entries to return.
      name: limit
    description: Search events on the Prisma Cloud (RedLock) platform using RQL language.
    name: redlock-search-event
    outputs:
    - contextPath: Redlock.Event
      description: Cloud audit events.
      type: Unknown
  - arguments:
    - description: Start time for the search, in the following format -  MM/DD/YYYY.
      name: time-range-date-from
    - description: End time for the search, in the following format -  MM/DD/YYYY.
      name: time-range-date-to
    - description: The number of time range value units for the search. For example, 3 days, 5 weeks, etc.
      name: time-range-value
    - auto: PREDEFINED
      description: |-
        The search unit. Possible values are: "hour", "week", "month", "year", "login", or "epoch". The "login" and "epoch" options are only available if timeRangeValue
        is not provided.
      name: time-range-unit
      predefined:
      - hour
      - day
      - week
      - month
      - year
      - login
      - epoch
    - description: Query to run in Prisma Cloud search API using RQL language.
      name: query
      required: true
    - auto: PREDEFINED
      description: The cloud in which the network should be searched.
      name: cloud-type
      predefined:
      - aws
      - azure
      - gcp
      - alibaba_cloud
      - oci
    description: Search networks on the Prisma Cloud (RedLock) platform using RQL language.
    name: redlock-search-network
    outputs:
    - contextPath: Redlock.Network.Node
      description: Cloud network node.
      type: Unknown
    - contextPath: Redlock.Network.Connection
      description: Cloud network connection.
      type: Unknown
  - arguments:
    - auto: PREDEFINED
      defaultValue: scanId
      description: Group by which to aggregate scan results.
      name: group_by
      predefined:
      - scanId
      - ' assetType'
      - assetName
      - resourceList
    - defaultValue: '25'
      description: Pagination size.
      name: page_size
    - defaultValue: '1'
      description: Pagination number.
      name: page_number
    - description: Sorting parameters. The sort order is ascending unless the field is prefixed with minus (-), in which case it is descending.
      name: sort
    - auto: PREDEFINED
      defaultValue: relative
      description: Time filter type.
      name: filter_type
      predefined:
      - to_now
      - absolute
      - relative
    - defaultValue: '1'
      description: Number of time units.
      name: filter_time_amount
    - auto: PREDEFINED
      defaultValue: day
      description: The time unit for retrieving the list of IaC scans.
      name: to_now_time_unit
      predefined:
      - epoch
      - login
      - year
    - description: 'Start time, for example: 11/01/2021 10:10:10.'
      name: filter_start_time
    - description: End time in Unix time (the number of seconds that have elapsed since the Unix epoch) for the absolute time type.
      name: filter_end_time
    - description: Asset type to search with.
      name: filter_asset_type
    - description: Asset name to search with.
      name: filter_asset_name
    - description: 'User to filter with, example: ayman@example.domain'
      name: filter_user
    - auto: PREDEFINED
      description: 'Status to filter with, example: passed'
      name: filter_status
      predefined:
      - passed
      - failed
      - processing
      - errored
      - failed_n_merged
      - failed_n_deployed
    - auto: PREDEFINED
      defaultValue: login
      description: Relative Time unit
      name: relative_time_unit
      predefined:
      - hour
      - day
      - week
      - month
      - year
    deprecated: true
    description: Returns a list of IaC scans that meet the given conditions.
    name: redlock-list-scans
    outputs:
    - contextPath: Redlock.Scans.deployed
      description: Scan deployed attribute.
      type: Boolean
    - contextPath: Redlock.Scans.fail
      description: Scan fail attribute.
      type: Number
    - contextPath: Redlock.Scans.failureCriteria
      description: Scan failure criteria attribute.
      type: String
    - contextPath: Redlock.Scans.matchedPoliciesSummary.high
      description: Scan matched policies summary attribute.
      type: Number
    - contextPath: Redlock.Scans.matchedPoliciesSummary.low
      description: Scan matched low policies summary attribute.
      type: Number
    - contextPath: Redlock.Scans.matchedPoliciesSummary.medium
      description: Scan matched medium policies summary attribute.
      type: Number
    - contextPath: Redlock.Scans.merged
      description: Scan merged attribute.
      type: Boolean
    - contextPath: Redlock.Scans.name
      description: Scan name attribute.
      type: String
    - contextPath: Redlock.Scans.pass
      description: Scan pass attribute.
      type: Number
    - contextPath: Redlock.Scans.scanAttributes.appliedAlertRules
      description: Scan applied alert rules attribute.
      type: String
    - contextPath: Redlock.Scans.scanAttributes.branch
      description: Scan Scan branch attribute.
      type: String
    - contextPath: Redlock.Scans.scanAttributes.org
      description: Scan org attribute.
      type: String
    - contextPath: Redlock.Scans.scanAttributes.pullRequestId
      description: Scan PR ID attribute.
      type: String
    - contextPath: Redlock.Scans.scanAttributes.repository
      description: Scan repository attribute.
      type: String
    - contextPath: Redlock.Scans.scanAttributes.resourcesScanned
      description: Scan resources scanned attribute.
      type: String
    - contextPath: Redlock.Scans.scanAttributes.templateType
      description: Scan template type attribute.
      type: String
    - contextPath: Redlock.Scans.scanAttributes.triggeredOn
      description: Scan triggered on attribute.
      type: String
    - contextPath: Redlock.Scans.scanAttributes.userId
      description: Scan user id attribute.
      type: String
    - contextPath: Redlock.Scans.scanTime
      description: Scan scan time attribute.
      type: Date
    - contextPath: Redlock.Scans.status
      description: Scan status attribute.
      type: String
    - contextPath: Redlock.Scans.tags.name
      description: Scan tags name attribute.
      type: String
    - contextPath: Redlock.Scans.tags.value
      description: Scan tags value attribute.
      type: String
    - contextPath: Redlock.Scans.type
      description: Scan type attribute.
      type: String
    - contextPath: Redlock.Scans.user
      description: Scan user attribute.
      type: List
    - contextPath: Redlock.Scans.id
      description: Scan id.
      type: String
    - contextPath: Redlock.Scans.links.self
      description: Scan links.
      type: String
    - contextPath: Redlock.Scans.relationships.scanResult.links.related
      description: Scan relationships scan result links .
      type: String
  - arguments:
    - description: The scan ID. The scan ID can be retrieved by the redlock-list-scans command.
      name: scan_id
      required: true
    deprecated: true
    description: Returns the status of the asynchronous IaC scan job that has the specified scan ID.
    name: redlock-get-scan-status
    outputs:
    - contextPath: Redlock.Scans.id
      description: Scan ID
      type: String
    - contextPath: Redlock.Scans.status
      description: Scan status
      type: String
  - arguments:
    - description: The scan ID. Scan Id can be retrieved by the redlock-list-scans command.
      name: scan_id
      required: true
    deprecated: true
    description: Returns scan result details for the completed scan that has the specified scan ID
    name: redlock-get-scan-results
    outputs:
    - contextPath: Redlock.Scans.id
      description: Scan ID
      type: String
    - contextPath: Redlock.Scans.results.attributes.blameList.file
      description: Scan results blame list file
      type: String
    - contextPath: Redlock.Scans.results.attributes.blameList.locations.line
      description: Scan results blame list locations line
      type: Number
    - contextPath: Redlock.Scans.results.attributes.blameList.locations.path
      description: Scan results blame list locations path
      type: String
    - contextPath: Redlock.Scans.results.attributes.desc
      description: Scan results description
      type: String
    - contextPath: Redlock.Scans.results.attributes.docUrl
      description: Scan results doc URL
      type: String
    - contextPath: Redlock.Scans.results.attributes.files
      description: Scan results files
      type: String
    - contextPath: Redlock.Scans.results.attributes.name
      description: Scan results name
      type: String
    - contextPath: Redlock.Scans.results.attributes.policyId
      description: Scan results policy ID
      type: String
    - contextPath: Redlock.Scans.results.attributes.rule
      description: Scan results rule
      type: String
    - contextPath: Redlock.Scans.results.attributes.severity
      description: Scan results severity
      type: String
    - contextPath: Redlock.Scans.results.attributes.systemDefault
      description: Scan results system default
      type: Boolean
    - contextPath: Redlock.Scans.results.id
      description: Scan results ID
      type: String
  dockerimage: demisto/python3:3.10.10.49934
  isfetch: true
  runonce: false
  script: '-'
  subtype: python3
  type: python
tests:
- RedLockTest
defaultmapperin: RedLock-mapper
defaultclassifier: RedLock
fromversion: 5.0.0