id: Prisma Cloud Correlate Alerts v2
version: -1
contentitemexportablefields:
  contentitemfields: {}
name: Prisma Cloud Correlate Alerts v2
description: Search alerts in Prisma Cloud for a specific asset ID and, if present in Cortex XSOAR, link them.
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: f0892a91-8613-4cdb-8618-330e16f69af8
    type: start
    task:
      id: f0892a91-8613-4cdb-8618-330e16f69af8
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "109"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 970,
          "y": 5650
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "109":
    id: "109"
    taskid: cb8e4a34-210c-4701-84e7-004595c7e4b8
    type: title
    task:
      id: cb8e4a34-210c-4701-84e7-004595c7e4b8
      version: -1
      name: Prisma Cloud Alert Detection
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "169"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 970,
          "y": 5810
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "110":
    id: "110"
    taskid: a8c93e03-4367-44d4-88f4-1c778a392639
    type: condition
    task:
      id: a8c93e03-4367-44d4-88f4-1c778a392639
      version: -1
      name: Are assets in Prisma Cloud found?
      description: Check if Prisma Cloud assets are present.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "111"
      "yes":
      - "112"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.Prisma Cloud Attribution
            iscontext: true
    view: |-
      {
        "position": {
          "x": 680,
          "y": 6110
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "111":
    id: "111"
    taskid: 00a2c3af-78b7-4b01-885f-d5c2e01d6af9
    type: title
    task:
      id: 00a2c3af-78b7-4b01-885f-d5c2e01d6af9
      version: -1
      name: Done Prisma Cloud Alert Detection
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 970,
          "y": 7590
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "112":
    id: "112"
    taskid: 6dc73a58-59f7-4511-8884-1358d318e01f
    type: regular
    task:
      id: 6dc73a58-59f7-4511-8884-1358d318e01f
      version: -1
      name: Find Prisma Cloud Alerts for detected assets
      description: Search alerts on the Prisma Cloud platform. When no absolute time nor relative time arguments are provided, the search will show alerts from the last 7 days.
      script: PrismaCloud v2|||prisma-cloud-alert-search
      type: regular
      iscommand: true
      brand: PrismaCloud v2
    nexttasks:
      '#none#':
      - "113"
    scriptarguments:
      filters:
        complex:
          root: inputs.Prisma Cloud Attribution
          accessor: id
          transformers:
          - operator: concat
            args:
              prefix:
                value:
                  simple: resource.id=
              suffix: {}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 440,
          "y": 6295
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "113":
    id: "113"
    taskid: b6b02f01-2db2-4859-8756-3e7ad37c9072
    type: regular
    task:
      id: b6b02f01-2db2-4859-8756-3e7ad37c9072
      version: -1
      name: Print Prisma Cloud Alerts
      description: Convert an array to a nice table display, usually from the context.
      scriptName: ToTable
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "167"
    scriptarguments:
      columns: {}
      data:
        complex:
          root: PrismaCloud
          accessor: Alert
          transformers:
          - operator: SetIfEmpty
            args:
              applyIfEmpty:
                value:
                  simple: "true"
              defaultValue:
                value:
                  simple: '[]'
      title:
        simple: Prisma Cloud Alerts related to discovered assets
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 440,
          "y": 6490
        }
      }
    note: true
    evidencedata:
      description:
        simple: Prisma Cloud Alerts related to assets
      customfields: {}
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "114":
    id: "114"
    taskid: f8fef3ac-24cc-4da8-808c-f528da2e4018
    type: regular
    task:
      id: f8fef3ac-24cc-4da8-808c-f528da2e4018
      version: -1
      name: Find Prisma Cloud Incidents
      description: Searches Cortex XSOAR incidents.
      scriptName: SearchIncidentsV2
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "170"
    scriptarguments:
      details: {}
      fromclosedate: {}
      fromdate: {}
      fromduedate: {}
      id: {}
      level: {}
      name: {}
      notstatus: {}
      owner: {}
      page: {}
      query:
        complex:
          root: PrismaCloud.Alert
          accessor: id
          transformers:
          - operator: concat
            args:
              prefix:
                value:
                  simple: 'prismacloudid:'
              suffix: {}
      reason: {}
      size: {}
      sort: {}
      status: {}
      toclosedate: {}
      todate: {}
      toduedate: {}
      type:
        simple: Prisma Cloud
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -380,
          "y": 7030
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "115":
    id: "115"
    taskid: d4bbc5e9-ca03-4c23-8d1c-6db397ff37b0
    type: regular
    task:
      id: d4bbc5e9-ca03-4c23-8d1c-6db397ff37b0
      version: -1
      name: Link Incidents
      description: commands.local.cmd.linkIncidents
      script: Builtin|||linkIncidents
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "111"
    scriptarguments:
      action:
        simple: link
      incidentId: {}
      linkedIncidentIDs:
        complex:
          root: foundIncidents
          accessor: id
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -700,
          "y": 7400
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "167":
    id: "167"
    taskid: 9fe334d8-188b-4bf0-83a1-2d82effa470e
    type: condition
    task:
      id: 9fe334d8-188b-4bf0-83a1-2d82effa470e
      version: -1
      name: Prisma Cloud Alerts found?
      description: Check if Prisma Cloud alerts were found.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "111"
      "yes":
      - "168"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: PrismaCloud
                accessor: Alert
            iscontext: true
    view: |-
      {
        "position": {
          "x": 440,
          "y": 6670
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "168":
    id: "168"
    taskid: d2dfa186-ed78-4ed7-8d06-63ca91c91c0b
    type: condition
    task:
      id: d2dfa186-ed78-4ed7-8d06-63ca91c91c0b
      version: -1
      name: Are we linking found Prisma Cloud Incidents?
      description: Check if we should link Prisma Cloud incidents to the current incident.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "111"
      "yes":
      - "114"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: foundIncidents
            iscontext: true
      - - operator: isEqualString
          left:
            value:
              complex:
                root: inputs.Link Incidents
            iscontext: true
          right:
            value:
              simple: "True"
          ignorecase: true
    view: |-
      {
        "position": {
          "x": 80,
          "y": 6840
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "169":
    id: "169"
    taskid: e44f2a90-27f4-4584-8548-e285eac679a5
    type: condition
    task:
      id: e44f2a90-27f4-4584-8548-e285eac679a5
      version: -1
      name: Is Prisma Cloud enabled?
      description: Check if the Prisma Cloud integration is enabled.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "111"
      "yes":
      - "110"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: modules
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.brand
                      iscontext: true
                    right:
                      value:
                        simple: PrismaCloud v2
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.state
                      iscontext: true
                    right:
                      value:
                        simple: active
            iscontext: true
    view: |-
      {
        "position": {
          "x": 970,
          "y": 5940
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "170":
    id: "170"
    taskid: ff612a87-2f7a-4742-8630-ef241e51577e
    type: condition
    task:
      id: ff612a87-2f7a-4742-8630-ef241e51577e
      version: -1
      name: Did we find any related Prisma Cloud incidents to link?
      description: Check if any linkable incidents are found in Cortex XSOAR.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "111"
      "yes":
      - "115"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: foundIncidents
                accessor: id
            iscontext: true
    view: |-
      {
        "position": {
          "x": -380,
          "y": 7190
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
system: true
view: |-
  {
    "linkLabelsPosition": {
      "167_111_#default#": 0.17,
      "168_111_#default#": 0.19,
      "169_111_#default#": 0.17
    },
    "paper": {
      "dimensions": {
        "height": 2005,
        "width": 2050,
        "x": -700,
        "y": 5650
      }
    }
  }
inputs:
- key: Prisma Cloud Attribution
  value:
    complex:
      root: PrismaCloud
      accessor: Attribution
  required: false
  description: Attribution information from Prisma Cloud.
  playbookInputQuery:
- key: Link Incidents
  value:
    simple: "True"
  required: false
  description: Link found Prisma Cloud incidents to current one?
  playbookInputQuery:
outputs:
- contextPath: foundIncidents
  description: Found Prisma Cloud Incidents
  type: unknown
- contextPath: PrismaCloud.Alert
  description: Prisma Cloud Alert
  type: unknown
tests:
- No tests
fromversion: 6.5.0