Palo Alto Networks Prisma Cloud

Prisma Cloud by Palo Alto Networks

The Palo Alto Networks Prisma Cloud connector enables seamless integration with Swimlane Turbine, allowing for automated cloud security management and incident response.

Palo Alto Networks Prisma Cloud connector provides Swimlane Turbine users with the ability to integrate their security automation workflows with Prisma Cloud's comprehensive cloud security platform. This integration enables users to manage account groups, retrieve asset inventories, and handle alerts efficiently, thereby enhancing their cloud security posture and response capabilities. With this connector, security teams can automate critical tasks, gain better visibility into their cloud environments, and respond to threats with speed and precision.

Prerequisites

Before integrating Palo Alto Networks Prisma Cloud with Swimlane Turbine, ensure you have the following prerequisites:

Access key authentication with the following parameters:

URL: Endpoint URL for Prisma Cloud API access

Access Key ID: Unique identifier for API access

Secret Key: Confidential key for API authentication

Capabilities

This connector provides the following capabilities:

Account Groups

Account Group Info

Add Account Group

Delete Account Group

List Account Groups

List Account Group Names

List Account Group Names by Cloud Type

Update Account Group

Alert Rules

Get Alert Rule by ID

List Alert Rules V2

Alerts

Alert Info

Create On Demand Notification

Dismiss Alerts

Download Alert CSV

Download Alerts List JSON

Download Policy Alerts JSON

Get Alerts Count By Status

Get Alert CSV Job Status

Get Alerts List Job Status

Get Policy Alert Job Status

Get Alert Count by Policy Groups

Get Alert Evidence Graph

Get Alert Count of Policies

Is Dismissal Note Required ... and so on

Asset Inventory

Asset Inventory View

Create Asset Inventory Trend View V3

Delete Saved Asset Inventory Filter

Get Asset Inventory Trend View V3

Get Asset Inventory View V3

Get Saved Asset Inventory Filter

List Inventory Dashboard Filter Autocomplete Suggestions V2

List Inventory Filters V2

List Saved Asset Inventory Filters

Save Asset Inventory Filter

Update Saved Asset Inventory Filter

Command Center

List Top N assets

List Top Policies

List Top Vulnerabilities

List Total Alerts Based on the Severity

List Total Vulnerable Images and Hosts

Hosts

Get Host Scan Result

Get Cloud Identity Inventory Related Assets

Get Existing Least Privilege Access for an Asset

Get IAM Query V2

Get IAM Query

Get Least Privilege Access Metadata of a Resource

Get Least Privilege Access Metadata of an Asset

Get Least Privilege Access Suggestion Resource

Get New Least Privilege Access for a Resource

Get New Least Privilege Access for an Asset

Get Permission Accesses V3

Get Permission Accesses

Get Permissions Access Next Page

Get Permissions Next Page

Get Permissions Role or Policy Definition V2 ... and so on

Vulnerabilities Dashboard

Create Remediation Request

Get CVE Details by ID

Get CVE Overview V2

Get Prioritized Vulnerabilities V3

Get Remediation Status

Get Top Impacting Vulnerabilities V2

Get Vulnerabilities Burndown

Get Vulnerabilities by RQL

Get Vulnerability Impact by Stage

Get Vulnerability Overview V2

Get Vulnerable Assets by CVE

Get Vulnerable Assets by RQL

Asset Setup

To access Prisma access_key and secret_keyare required.

Alert Info

In the response object, field riskDetail is deprecated.

Get Resource

Possible values for input riskFactors as given below.

[
    CRITICAL_SEVERITY, HIGH_SEVERITY, MEDIUM_SEVERITY, HAS_FIX, REMOTE_EXECUTION, 
    DOS, RECENT_VULNERABILITY,EXPLOIT_EXISTS, ATTACK_COMPLEXITY_LOW, ATTACK_VECTOR_NETWORK,
    REACHABLE_FROM_THE_INTERNET, LISTENING_PORTS,CONTAINER_IS_RUNNING_AS_ROOT,
    NO_MANDATORY_SECURITY_PROFILE_APPLIED, RUNNING_AS_PRIVILEGED_CONTAINER, PACKAGE_IN_USE
]

Asset Inventory View

Possible values for input timeUnit as given below.

[minute, hour, day, week, month, year]

Possible values for input scan_status as given below.

[all, passed, failed]

The response includes an attribute groupedAggregates, whose content depends on the groupBy query parameter. The following table shows the attributes that groupedAggregates will include for the specified groupBy query parameter:

groupBy	groupedAggregates Includes
not specified	cloudTypeName
cloudType	cloudTypeName
cloud.account	accountName
cloud.region	regionName, cloudTypeName
cloud.service	serviceName, cloudTypeName
resource.type	resourceTypeName, cloudTypeName

If you want to specify groupBy multiple times, give comma-separated list of values by to group response items.

Example: cloud.type, cloud.account, cloud.region, cloud.service.

Note

The Asset URL for the "Get Host Scan Result" action is the Path to Console.

When using the Time Range field in actions, please to refer to the documentation for the various value formats.

API Documentation

Link for Regional URLs

Configurations

Prisma Cloud Asset

Authenticates using Access key ID and Secret key.

Configuration Parameters

Parameter	Description	Type	Required
url	A URL to the target host.	string	Required
access_key_id	Access key ID	string	Required
secret_key	Secret key	string	Required
customer_name	Customer Name	string	Optional
prisma_id	Unique Prisma Identifier	string	Optional
verify_ssl	Verify SSL certificate	boolean	Optional
http_proxy	A proxy to route requests through.	string	Optional

Actions

Account Group Info

Retrieve comprehensive details for a specific account group in Palo Alto Networks Prisma Cloud using the provided ID.

Endpoint

URL: /cloud/group/{{id}}

Method: GET

Input

Argument Name	Type	Required	Description
parameters.includeAccountInfo	boolean	Optional	Include cloud account information.
path_parameters.id	string	Required	Account Group ID.

Input Example

{"parameters":{"includeAccountInfo":false},"path_parameters":{"id":"59c8256b-835b-4868-9d3e-0c679a2cf421"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
id	string	Unique identifier
name	string	Name of the resource
description	string	Output field: description
lastModifiedBy	string	Output field: lastModifiedBy
lastModifiedTs	number	Output field: lastModifiedTs
accountIds	array	Unique identifier
accountIds.file_name	string	Unique identifier
accountIds.file	string	Unique identifier
nonOnboardedCloudAccountIds	array	Unique identifier
nonOnboardedCloudAccountIds.file_name	string	Unique identifier
nonOnboardedCloudAccountIds.file	string	Unique identifier
autoCreated	boolean	Output field: autoCreated
cloudAccountCount	number	Count value
childGroupIds	array	Unique identifier
childGroupIds.file_name	string	Unique identifier
childGroupIds.file	string	Unique identifier

Output Example

{"status_code":200,"response_headers":{"Date":"Mon, 15 Jul 2024 03:44:32 GMT","Content-Type":"application/json;charset=UTF-8","Transfer-Encoding":"chunked","Connection":"keep-alive","X-RateLimit-Remaining":"99","X-RateLimit-Requested-Tokens":"1","X-RateLimit-Burst-Capacity":"100","X-RateLimit-Replenish-Rate":"100","tracer-id":"99bbf424962ea9c77c99e2f38f646c99","X-Content-Type-Options":"nosniff","X-XSS-Protection":"0","Cache-Control":"no-cache, no-store, max-age=0, must-revalidate","Pragma":"no-c...

Add Account Group

Create a new account group in Palo Alto Networks Prisma Cloud using specified account IDs and group name.

Endpoint

URL: /cloud/group

Method: POST

Input

Argument Name	Type	Required	Description
accountIds	array	Optional	Cloud Account IDs.
cloudAccountInfos	array	Optional	Cloud account details of account associated with this account group.
cloudAccountInfos.accountId	string	Optional	Account ID
cloudAccountInfos.cloudType	string	Optional	Cloud Type.
cloudAccountInfos.lastModifiedBy	string	Optional	Last Modified By.
description	string	Optional	Description.
name	string	Optional	Name.

Input Example

{"json_body":{"accountIds":["workday-prod-svc","consumer-app-int"],"cloudAccountInfos":[{"accountId":"string","cloudType":"AWS","lastModifiedBy":"string"}],"description":"string","name":"BizFunc-BizTech - 642281869570"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
accountIds	array	Unique identifier
autoCreated	boolean	Output field: autoCreated
cloudAccountCount	number	Count value
cloudAccountInfos	array	Output field: cloudAccountInfos
cloudAccountInfos.accountId	string	Unique identifier
cloudAccountInfos.cloudType	string	Type of the resource
cloudAccountInfos.lastModifiedBy	string	Output field: cloudAccountInfos.lastModifiedBy
description	string	Output field: description
id	string	Unique identifier
lastModifiedBy	string	Output field: lastModifiedBy
lastModifiedTs	number	Output field: lastModifiedTs
name	string	Name of the resource

Output Example

{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"accountIds":["string"],"autoCreated":true,"cloudAccountCount":0,"cloudAccountInfos":[{}],"description":"string","id":"string","lastModifiedBy":"string","lastModifiedTs":0,"name":"string"}}

Alert Info

Retrieve detailed information about a specific alert by providing its ID in Palo Alto Networks Prisma Cloud.

Endpoint

URL: /alert/{{id}}

Method: GET

Input

Argument Name	Type	Required	Description
parameters.detailed	boolean	Optional	Return detailed alert data.
path_parameters.id	string	Required	Alert ID.

Input Example

{"parameters":{"detailed":true},"path_parameters":{"id":"P-411652775"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
id	string	Unique identifier
status	string	Status value
firstSeen	number	Output field: firstSeen
lastSeen	number	Output field: lastSeen
alertTime	number	Time value
lastUpdated	number	Output field: lastUpdated
saveSearchId	string	Unique identifier
metadata	object	Response data
metadata.saveSearchId	string	Response data
policy	object	Output field: policy
policy.policyId	string	Unique identifier
policy.name	string	Name of the resource
policy.policyType	string	Type of the resource
policy.systemDefault	boolean	Output field: policy.systemDefault
policy.description	string	Output field: policy.description
policy.severity	string	Output field: policy.severity
policy.complianceMetadata	array	Response data
policy.complianceMetadata.standardName	string	Response data
policy.complianceMetadata.standardDescription	string	Response data
policy.complianceMetadata.requirementId	string	Response data
policy.complianceMetadata.requirementName	string	Response data
policy.complianceMetadata.sectionId	string	Response data
policy.complianceMetadata.sectionDescription	string	Response data

Output Example

{"status_code":200,"response_headers":{"Date":"Mon, 15 Jul 2024 05:04:03 GMT","Content-Type":"application/json","Transfer-Encoding":"chunked","Connection":"keep-alive","X-RateLimit-Remaining":"9","X-RateLimit-Requested-Tokens":"1","X-RateLimit-Burst-Capacity":"10","X-RateLimit-Replenish-Rate":"6","Access-Control-Allow-Origin":"*","Access-Control-Allow-Headers":"x-redlock-request-id,x-redlock-auth,rl-json-rule,terraform-version,terraform-012...","Access-Control-Allow-Methods":"POST, PUT, GET, OPT...

Asset Inventory View

Retrieve compliance status for assets in Palo Alto Networks Prisma Cloud using specified filters.

Endpoint

URL: /v3/inventory

Method: POST

Input

Argument Name	Type	Required	Description
headers	object	Optional	HTTP headers for the request
headers.Content-Type	string	Optional	HTTP headers for the request
headers.Accept	string	Optional	HTTP headers for the request
detailed	boolean	Optional	Detailed.
fields	array	Optional	Array of specific fields to return.
filters	array	Optional	Parameter for Asset Inventory View
filters.name	string	Required	Filter Name.
filters.operator	string	Optional	Operator.
filters.value	string	Optional	Value.
groupBy	array	Optional	Comma-separated list of values by group response items. Valid values are cloud.type, cloud.account, cloud.region, cloud.service, and/or resource.type. Default is cloud.type.
limit	number	Optional	Maximum number of items to return.
offset	number	Optional	The number of items to skip before selecting items to return.
pageToken	string	Optional	Setting this pagination Token to the nextPageToken from a response object returns the next page of data.
sortBy	array	Optional	Array of sort properties. Append :asc or :desc to the key to sort by ascending or descending order respectively.

Input Example

{"json_body":{"detailed":true,"fields":["yter"],"filters":[{"name":"dwe","operator":"tag:yaml.org,2002:value =","value":"ewr"}],"groupBy":["cloud.type"],"limit":10000,"offset":0,"pageToken":"","sortBy":[""]},"headers":{"Content-Type":"application/json","Accept":"application/json"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
timestamp	number	Output field: timestamp
requestedTimestamp	number	Output field: requestedTimestamp
summary	object	Output field: summary
summary.timestamp	number	Output field: summary.timestamp
summary.failedResources	number	Output field: summary.failedResources
summary.passedResources	number	Output field: summary.passedResources
summary.totalResources	number	Output field: summary.totalResources
summary.highSeverityFailedResources	number	Output field: summary.highSeverityFailedResources
summary.mediumSeverityFailedResources	number	Output field: summary.mediumSeverityFailedResources
summary.lowSeverityFailedResources	number	Output field: summary.lowSeverityFailedResources
summary.criticalSeverityFailedResources	number	Output field: summary.criticalSeverityFailedResources
summary.informationalSeverityFailedResources	number	Output field: summary.informationalSeverityFailedResources
summary.criticalVulnerabilityFailedResources	number	Output field: summary.criticalVulnerabilityFailedResources
summary.highVulnerabilityFailedResources	number	Output field: summary.highVulnerabilityFailedResources
summary.mediumVulnerabilityFailedResources	number	Output field: summary.mediumVulnerabilityFailedResources
summary.lowVulnerabilityFailedResources	number	Output field: summary.lowVulnerabilityFailedResources
summary.totalVulnerabilityFailedResources	number	Output field: summary.totalVulnerabilityFailedResources
groupedAggregates	array	Output field: groupedAggregates
groupedAggregates.cloudTypeName	string	Name of the resource
groupedAggregates.failedResources	number	Output field: groupedAggregates.failedResources
groupedAggregates.passedResources	number	Output field: groupedAggregates.passedResources
groupedAggregates.totalResources	number	Output field: groupedAggregates.totalResources
groupedAggregates.highSeverityFailedResources	number	Output field: groupedAggregates.highSeverityFailedResources

Output Example

{"status_code":200,"response_headers":{"Date":"Wed, 12 Jun 2024 10:00:18 GMT","Content-Type":"application/json","Transfer-Encoding":"chunked","Connection":"keep-alive","Access-Control-Allow-Origin":"*","Access-Control-Allow-Headers":"x-redlock-request-id,x-redlock-auth,rl-json-rule,terraform-version,terraform-012...","Access-Control-Allow-Methods":"POST, PUT, GET, OPTIONS, DELETE, PATCH","Access-Control-Expose-Headers":"x-redlock-auth,x-redlock-request-id,x-redlock-status, x-redlock-fileName,Con...

Create Asset Inventory Trend View V3

Generates a trend view of asset inventory pass/fail statistics in Palo Alto Networks Prisma Cloud, requiring a JSON body input.

Endpoint

URL: v3/inventory/trend

Method: POST

Input

Argument Name	Type	Required	Description
detailed	boolean	Optional	Detailed.
fields	array	Optional	Array of specific fields to return.
groupBy	array	Optional	For asset or data inventory only. Group returned items by cloud.type, cloud.service, cloud.region, cloud.account, and/or resource.type.
filters	array	Optional	Filtering parameters.
filters.name	string	Optional	Name.
filters.value	string	Optional	Value.
filters.operator	string	Optional	Operator.
limit	number	Optional	Maximum number of items to return. When data is paginated, maximum number of items per page.The maximum cannot exceed 10,000.
offset	number	Optional	The number of items to skip before selecting items to return.
pageToken	string	Optional	Setting this pagination Token to the nextPageToken from a response object returns the next page of data.
sortBy	array	Optional	Array of sort properties. Append :asc or :desc to the key to sort by ascending or descending order respectively. Example sort properties are id:asc and timestamp:desc.

Input Example

{"json_body":{"detailed":true,"fields":["cloud.region"],"groupBy":["cloud.region,cloud.service"],"filters":[{"name":"cloud.region","value":"DynamoDB","operator":"="}],"limit":10,"offset":0,"pageToken":"vda3456fsERTE2345342","sortBy":["cloud.region"]}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase

Output Example

{"status_code":200,"response_headers":{"Date":"Mon, 08 Jul 2024 09:07:42 GMT","Content-Type":"application/json","Transfer-Encoding":"chunked","Connection":"keep-alive","Access-Control-Allow-Origin":"*","Access-Control-Allow-Headers":"x-redlock-request-id,x-redlock-auth,rl-json-rule,terraform-version,terraform-012...","Access-Control-Allow-Methods":"POST, PUT, GET, OPTIONS, DELETE, PATCH","Access-Control-Expose-Headers":"x-redlock-auth,x-redlock-request-id,x-redlock-status, x-redlock-fileName,Con...

Create On Demand Email Notification

Generates an on-demand email notification for a specified alert in Palo Alto Networks Prisma Cloud using alertId and notification configuration.

Endpoint

URL: /alerts/api/v1/notification/ondemand

Method: POST

Input

Argument Name	Type	Required	Description
alertId	string	Optional	Id of the alert for which Notification needs to be sent.
onDemandNotificationConfig	object	Optional	Parameter for Create On Demand Email Notification
onDemandNotificationConfig.id	string	Optional	Id of the alert for which Notification needs to be sent.
onDemandNotificationConfig.clientId	string	Optional	Id to identify the category of request. For Jira, Email, Slack, it can be CS.
onDemandNotificationConfig.generatorType	string	Optional	For ad-hoc notification, its value should be REALTIME.
onDemandNotificationConfig.integrationType	string	Required	Can be either Jira, Email or Slack.
onDemandNotificationConfig.templateId	string	Optional	Jira template Id.
onDemandNotificationConfig.recipients	array	Required	List of Integration id for jira or email for email or channel for slack etc.
onDemandNotificationConfig.recipients.0	string	Optional	Parameter for Create On Demand Email Notification
onDemandNotificationConfig.recipients.1	string	Optional	Parameter for Create On Demand Email Notification
onDemandNotificationConfig.recipients.2	string	Optional	Parameter for Create On Demand Email Notification
translation	object	Optional	Parameter for Create On Demand Email Notification
translation.body	string	Required	Message Body. Applicable for email and slack.
translation.details	object	Required	Its a map of key-value pair.
translation.details.property name*	string	Optional	Name of the resource
translation.attachments	array	Optional	This field contains the list of paths to the S3 file from where the attachment needs to be fetched.
translation.attachments.0	string	Optional	Parameter for Create On Demand Email Notification
translation.attachments.1	string	Optional	Parameter for Create On Demand Email Notification

Input Example

{"json_body":{"alertId":"string","onDemandNotificationConfig":{"id":"string","clientId":"string","generatorType":"string","integrationType":"string","templateId":"string","recipients":[["email1","email2","email3"]]},"translation":{"body":"string","details":{"property name*":"string"},"attachments":[["attachmentUrl1","attachmentUrl2"]]}}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
success	number	Whether the operation was successful
failed	number	Output field: failed
successfulEvents	array	Whether the operation was successful
successfulEvents.recipient	object	Whether the operation was successful
successfulEvents.recipient.generatorType	string	Type of the resource
successfulEvents.recipient.integrationType	string	Type of the resource
successfulEvents.recipient.id	string	Unique identifier
successfulEvents.customerId	number	Unique identifier
successfulEvents.clientId	string	Unique identifier
successfulEvents.id	string	Unique identifier
successfulEvents.notificationId	string	Unique identifier
failedEvents	object	Output field: failedEvents

Output Example

{"status_code":201,"response_headers":{},"reason":"OK","json_body":{"success":1,"failed":0,"successfulEvents":[{}],"failedEvents":{}}}

Create On Demand Jira Notification

Generates a Jira notification for a specified alert using the provided alertId and onDemandNotificationConfig.

Endpoint

URL: /alerts/api/v1/notification/ondemand

Method: POST

Input

Argument Name	Type	Required	Description
alertId	string	Optional	Id of the alert for which Notification needs to be sent.
onDemandNotificationConfig	object	Optional	Parameter for Create On Demand Jira Notification
onDemandNotificationConfig.id	string	Optional	Id of the alert for which Notification needs to be sent.
onDemandNotificationConfig.clientId	string	Optional	Id to identify the category of request. For Jira, Email, Slack, it can be CS.
onDemandNotificationConfig.generatorType	string	Optional	For ad-hoc notification, its value should be REALTIME.
onDemandNotificationConfig.integrationType	string	Required	Can be either Jira, Email or Slack.
onDemandNotificationConfig.templateId	string	Required	Jira template Id.
onDemandNotificationConfig.recipients	array	Required	List of Integration id for jira or email for email or channel for slack etc.
onDemandNotificationConfig.recipients.0	string	Optional	Parameter for Create On Demand Jira Notification
onDemandNotificationConfig.recipients.1	string	Optional	Parameter for Create On Demand Jira Notification
onDemandNotificationConfig.recipients.2	string	Optional	Parameter for Create On Demand Jira Notification
translation	object	Optional	Parameter for Create On Demand Jira Notification
translation.body	string	Optional	Message Body. Applicable for email and slack.
translation.details	object	Optional	Its a map of key-value pair.
translation.details.property name*	string	Optional	Name of the resource
translation.attachments	array	Optional	This field contains the list of paths to the S3 file from where the attachment needs to be fetched.
translation.attachments.0	string	Optional	Parameter for Create On Demand Jira Notification
translation.attachments.1	string	Optional	Parameter for Create On Demand Jira Notification

Input Example

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
success	number	Whether the operation was successful
failed	number	Output field: failed
successfulEvents	array	Whether the operation was successful
successfulEvents.recipient	object	Whether the operation was successful
successfulEvents.recipient.generatorType	string	Type of the resource
successfulEvents.recipient.integrationType	string	Type of the resource
successfulEvents.recipient.id	string	Unique identifier
successfulEvents.customerId	number	Unique identifier
successfulEvents.clientId	string	Unique identifier
successfulEvents.metaData	object	Response data
successfulEvents.metaData.jiraKey	string	Response data
successfulEvents.notificationId	string	Unique identifier
failedEvents	object	Output field: failedEvents

Output Example

{"status_code":201,"response_headers":{},"reason":"OK","json_body":{"success":1,"failed":0,"successfulEvents":[{}],"failedEvents":{}}}

Create On Demand Slack Notification

Create an on-demand Slack notification for a specific alert in Palo Alto Networks Prisma Cloud using alertId and notification configuration.

Endpoint

URL: /alerts/api/v1/notification/ondemand

Method: POST

Input

Argument Name	Type	Required	Description
alertId	string	Optional	Id of the alert for which Notification needs to be sent.
onDemandNotificationConfig	object	Optional	Parameter for Create On Demand Slack Notification
onDemandNotificationConfig.id	string	Optional	Id of the alert for which Notification needs to be sent.
onDemandNotificationConfig.clientId	string	Optional	Id to identify the category of request. For Jira, Email, Slack, it can be CS.
onDemandNotificationConfig.generatorType	string	Optional	For ad-hoc notification, its value should be REALTIME.
onDemandNotificationConfig.integrationType	string	Required	Can be either Jira, Email or Slack.
onDemandNotificationConfig.templateId	string	Optional	Jira template Id.
onDemandNotificationConfig.recipients	array	Required	List of Integration id for jira or email for email or channel for slack etc.
onDemandNotificationConfig.recipients.0	string	Optional	Parameter for Create On Demand Slack Notification
onDemandNotificationConfig.recipients.1	string	Optional	Parameter for Create On Demand Slack Notification
onDemandNotificationConfig.recipients.2	string	Optional	Parameter for Create On Demand Slack Notification
translation	object	Optional	Parameter for Create On Demand Slack Notification
translation.body	string	Required	Message Body. Applicable for email and slack.
translation.details	object	Required	Its a map of key-value pair.
translation.details.property name*	string	Optional	Name of the resource
translation.attachments	array	Optional	This field contains the list of paths to the S3 file from where the attachment needs to be fetched.
translation.attachments.0	string	Optional	Parameter for Create On Demand Slack Notification
translation.attachments.1	string	Optional	Parameter for Create On Demand Slack Notification

Input Example

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
success	number	Whether the operation was successful
failed	number	Output field: failed
successfulEvents	array	Whether the operation was successful
successfulEvents.recipient	object	Whether the operation was successful
successfulEvents.recipient.generatorType	string	Type of the resource
successfulEvents.recipient.integrationType	string	Type of the resource
successfulEvents.recipient.id	string	Unique identifier
successfulEvents.customerId	number	Unique identifier
successfulEvents.clientId	string	Unique identifier
successfulEvents.id	string	Unique identifier
successfulEvents.notificationId	string	Unique identifier
failedEvents	object	Output field: failedEvents

Output Example

{"status_code":201,"response_headers":{},"reason":"OK","json_body":{"success":1,"failed":0,"successfulEvents":[{}],"failedEvents":{}}}

Create Remediation Request

Initiate remediation for assets in Palo Alto Networks Prisma Cloud by creating tasks, Jira tickets, merge requests, or suppressing vulnerabilities.

Endpoint

URL: uve/api/v1/remediation/vuln-create-remediation

Method: POST

Input

Argument Name	Type	Required	Description
headers	object	Optional	HTTP headers for the request
headers.template-id	string	Optional	JIRA ID. Required only for createTask remediation action.
headers.assignee	string	Optional	JIRA assignee. Required only for createTask remediation action.
cveId	string	Optional	CVE ID of the vulnerability.
prismaId	string	Optional	Prisma ID of the customer.
remediationAction	string	Optional	Create a JIRA/task, create a PR, or suppress the vulnerability.
assetType	string	Optional	Asset type. Required only for group level remediation.
assetId	array	Optional	Asset IDs. Required only for asset level remediation.
assetId.assetType	string	Optional	Asset type.
assetId.assetId	string	Optional	UAI ID of the asset.

Input Example

{"json_body":{"cveId":"CVE-2021-44228","prismaId":"807152287759069184","remediationAction":"createTask","assetType":"iac","assetId":[{"assetType":"iac","assetId":"807152287759069184"}]},"headers":{"template-id":"b17d66dd-2f8c-46f0-be1a-b3e21ba7990c","assignee":"Test"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
message	string	Response message
details	string	Output field: details
timeStamp	number	Output field: timeStamp
request_id	string	Unique identifier

Output Example

{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"message":"ACCEPTED","details":"test","timeStamp":1701778720128,"request_id":"b17d66dd-2f8c-46f0-be1a-b3e21ba7990c"}}

Delete Account Group

Removes a specified account group from Palo Alto Networks Prisma Cloud using the unique ID provided.

Endpoint

URL: /cloud/group/{{id}}

Method: DELETE

Input

Argument Name	Type	Required	Description
path_parameters.id	string	Required	Account Group ID.

Input Example

{"path_parameters":{"id":"59c8256b-835b-4868-9d3e-0c679a2cf421"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase

Output Example

{"status_code":200,"response_headers":{},"reason":"OK","json_body":{}}

Delete Saved Asset Inventory Filter

Deletes a specified saved asset inventory filter in Palo Alto Networks Prisma Cloud using the unique ID provided.

Endpoint

URL: filter/inventory/{{id}}

Method: DELETE

Input

Argument Name	Type	Required	Description
path_parameters.id	string	Required	Asset Inventory ID.

Input Example

{"path_parameters":{"id":"AWS_ALL_DynamoDB"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase

Output Example

{"status_code":200,"response_headers":{},"reason":"OK","json_body":{}}

Dismiss Alerts

Dismiss or snooze alerts on the Prisma Cloud platform based on specified filters and optional time range.

Endpoint

URL: /alert/dismiss

Method: POST

Input

Argument Name	Type	Required	Description
alerts	array	Optional	Alert IDs.
dismissalNote	string	Optional	Reason for dismissal.
dismissalTimeRange	object	Optional	Parameter for Dismiss Alerts
dismissalTimeRange.type	string	Required	Type of the resource
dismissalTimeRange.relativeTimeType	string	Optional	Direction in which to count time.
dismissalTimeRange.value	object	Required	Model for RelativeTimeDuration.
dismissalTimeRange.value.amount	number	Optional	Number of time units.
dismissalTimeRange.value.unit	string	Optional	Time unit.
filter	object	Optional	Model for Filter.
filter.detailed	boolean	Optional	Detailed.
filter.fields	array	Optional	Array of specific fields to return.
filter.filters	array	Optional	Filtering parameters.
filter.filters.name	string	Optional	Name.
filter.filters.operator	string	Optional	Operator.
filter.filters.value	string	Optional	Value.
filter.groupBy	array	Optional	For asset or data inventory only.
filter.limit	number	Optional	Maximum number of items to return.
filter.offset	number	Optional	The number of items to skip before selecting items to return.
filter.pageToken	string	Optional	Setting this pagination Token to the nextPageToken from a response object returns the next page of data.
filter.sortBy	array	Optional	Array of sort properties.
filter.timeRange	object	Required	Parameter for Dismiss Alerts
filter.timeRange.relativeTimeType	string	Optional	Direction in which to count time.
filter.timeRange.type	string	Optional	Type of the resource
filter.timeRange.value	object	Required	Model for RelativeTimeDuration.
filter.timeRange.value.amount	number	Optional	Number of time units.

Input Example

{"json_body":{"alerts":["P-411652775"],"dismissalNote":"string","dismissalTimeRange":{"type":"relative","relativeTimeType":"BACKWARD","value":{"amount":0,"unit":"minute"}},"filter":{"detailed":true,"fields":["string"],"filters":[{"name":"string","operator":"=","value":"string"}],"groupBy":["cloud.type"],"limit":0,"offset":0,"pageToken":"string","sortBy":["id:asc","timestamp:desc"],"timeRange":{"relativeTimeType":"BACKWARD","type":"relative","value":{"amount":0,"unit":"minute"}}},"policies":["string"]}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase

Output Example

{"status_code":200,"response_headers":{},"reason":"OK","json_body":{}}

Download Alert CSV

Downloads a CSV file containing the alert list generated by Prisma Cloud for a given job ID.

Endpoint

URL: /alert/csv/{{id}}/download

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.id	string	Required	Job ID.

Input Example

{"path_parameters":{"id":"937771fea1964b3ab1c768dc62ef6789"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
file	object	Attachment
file.file	string	Output field: file.file
file.file_name	string	Name of the resource

Output Example

{"status_code":200,"response_headers":{},"reason":"OK","json_body":{}}

Download Alerts List JSON

Downloads a JSON-formatted list of alerts for a given job ID from Palo Alto Networks Prisma Cloud.

Endpoint

URL: /alert/jobs/{{id}}/download

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.id	string	Required	Job ID.

Input Example

{"path_parameters":{"id":"e09b247a62af4e0aafd4bf4c4b12fec7"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
file	object	Attachment
file.file	string	Output field: file.file
file.file_name	string	Name of the resource

Output Example

{"status_code":200,"response_headers":{},"reason":"OK","json_body":{}}

Download Policy Alerts JSON

Downloads policy alerts in JSON format from Palo Alto Networks Prisma Cloud using a specific job ID.

Endpoint

URL: /alert/policy/jobs/{{id}}/download

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.id	string	Required	Job ID.

Input Example

{"path_parameters":{"id":"b70ac365a19446a59da964785d03142d"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
file	object	Attachment
file.file	string	Output field: file.file
file.file_name	string	Name of the resource

Output Example

{"status_code":200,"response_headers":{"Date":"Thu, 11 Jul 2024 05:54:19 GMT","Content-Type":"application/json;charset=utf-8","Content-Length":"22","Connection":"keep-alive","Access-Control-Allow-Origin":"*","Access-Control-Allow-Headers":"x-redlock-request-id,x-redlock-auth,rl-json-rule,terraform-version,terraform-012...","Access-Control-Allow-Methods":"POST, PUT, GET, OPTIONS, DELETE, PATCH","Access-Control-Expose-Headers":"x-redlock-auth,x-redlock-request-id,x-redlock-status, x-redlock-fileNa...

Get Alert Count by Policy Groups

Retrieve the count of alerts for policy groups in Palo Alto Networks Prisma Cloud within a specified time range.

Endpoint

URL: /alert/v1/aggregate

Method: POST

Input

Argument Name	Type	Required	Description
filters	array	Optional	Filter parameters.
filters.name	string	Optional	Name of the resource
filters.value	string	Optional	Value for the parameter
filters.operator	string	Optional	Parameter for Get Alert Count by Policy Groups
sortBy	array	Optional	Array of sort properties.
groupBy	string	Optional	Group by field.
size	number	Optional	Maximum number of items to return per page when data is paginated. The value cannot exceed 500.
nextPageToken	string	Optional	The nextPageToken value from the previous response object, which is used to get the next page of data.
timeRange	object	Optional	Parameter for Get Alert Count by Policy Groups
timeRange.Time type	string	Optional	Time type.
timeRange.Time value	object	Optional	Value for the parameter
timeRange.Field for range	string	Optional	Field for range.
timeRange.type	string	Required	Type of the resource
timeRange.value	object	Optional	Value for the parameter
timeRange.value.startTime	number	Optional	Value for the parameter
timeRange.value.endTime	number	Optional	Value for the parameter

Input Example

{"json_body":{"filters":[{"name":"string","value":"string","operator":"string"}],"sortBy":["string"],"groupBy":"policy.type","size":0,"nextPageToken":"string","timeRange":{"Time type":"to_now,absolute,relative,from_now","Time value":{},"Field for range":"lastStatusChangeTs","type":"string","value":{"startTime":0,"endTime":0}}}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
groups	array	Output field: groups
groups.group	string	Output field: groups.group
groups.totalAlerts	number	Output field: groups.totalAlerts
groups.totalPolicies	number	Output field: groups.totalPolicies
groups.criticalAlertCount	number	Count value
groups.highAlertCount	number	Count value
groups.mediumAlertCount	number	Count value
groups.lowAlertCount	number	Count value
groups.informationalAlertCount	number	Count value
groups.buildPolicyCount	number	Count value
groups.runPolicyCount	number	Count value
groups.findingTypes	array	Type of the resource
groups.cloudTypes	array	Type of the resource
groups.policyIds	array	Unique identifier
groupBy	string	Output field: groupBy
countDetails	object	Output field: countDetails
countDetails.totalAlerts	number	Output field: countDetails.totalAlerts
countDetails.totalPolicies	number	Output field: countDetails.totalPolicies
nextPageToken	string	Output field: nextPageToken

Output Example

{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"groups":[{}],"groupBy":"string","countDetails":{"totalAlerts":100,"totalPolicies":30},"nextPageToken":"string"}}

Get Alert Count of Policies

Retrieve a count of alerts per policy from Palo Alto Networks Prisma Cloud within a specified time range.

Endpoint

URL: /alert/v1/policy

Method: POST

Input

Argument Name	Type	Required	Description
filters	array	Optional	Filter parameters.
filters.name	string	Optional	Name of the resource
filters.value	string	Optional	Value for the parameter
filters.operator	string	Optional	Parameter for Get Alert Count of Policies
sortBy	array	Optional	Array of sort properties.
groupBy	string	Optional	Group by field.
size	number	Optional	Maximum number of items to return per page when data is paginated. The value cannot exceed 500.
nextPageToken	string	Optional	The nextPageToken value from the previous response object, which is used to get the next page of data.
timeRange	object	Optional	Parameter for Get Alert Count of Policies
timeRange.Time type	string	Optional	Time type.
timeRange.Time value	object	Optional	Value for the parameter
timeRange.Field for range	string	Optional	Field for range.
timeRange.type	string	Required	Type of the resource
timeRange.value	object	Optional	Value for the parameter
timeRange.value.startTime	number	Optional	Value for the parameter
timeRange.value.endTime	number	Optional	Value for the parameter

Input Example

{"json_body":{"filters":[{"name":"string","value":"string","operator":"string"}],"sortBy":["id:asc"],"groupBy":"policy.type","size":50,"nextPageToken":"string","timeRange":{"Time type":"to_now","Time value":{},"Field for range":"lastStatusChangeTs","type":"string","value":{"startTime":0,"endTime":0}}}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
policies	array	Output field: policies
policies.alertCount	number	Count value
policies.policyId	string	Unique identifier
policies.policyName	string	Name of the resource
policies.policyType	string	Type of the resource
policies.severity	string	Output field: policies.severity
policies.policyLabels	array	Output field: policies.policyLabels
policies.complianceMetadata	array	Response data
policies.complianceMetadata.standardName	string	Response data
policies.complianceMetadata.standardDescription	string	Response data
policies.complianceMetadata.requirementId	string	Response data
policies.complianceMetadata.requirementName	string	Response data
policies.complianceMetadata.requirementDescription	string	Response data
policies.complianceMetadata.sectionId	string	Response data
policies.complianceMetadata.sectionDescription	string	Response data
policies.complianceMetadata.policyId	string	Response data
policies.complianceMetadata.complianceId	string	Response data
policies.complianceMetadata.sectionLabel	string	Response data
policies.complianceMetadata.sectionViewOrder	number	Response data
policies.complianceMetadata.requirementViewOrder	number	Response data
policies.complianceMetadata.systemDefault	boolean	Response data
policies.complianceMetadata.policyName	string	Response data
policies.complianceMetadata.customAssigned	boolean	Response data

Output Example

{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"policies":[{}],"countDetails":{"totalAlerts":100,"totalPolicies":30},"nextPageToken":"string"}}

Get Alert CSV Job Status

Retrieve the current status of a CSV generation job for alerts in Palo Alto Networks Prisma Cloud using the specified job ID.

Endpoint

URL: /alert/csv/{{id}}/status

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.id	string	Required	Parameters for the Get Alert CSV Job Status action

Input Example

{"path_parameters":{"id":"937771fea1964b3ab1c768dc62ef6789"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
id	string	Unique identifier
customerId	number	Unique identifier
status	string	Status value
createdBy	string	Output field: createdBy
createdOn	number	Output field: createdOn
lastModified	number	Output field: lastModified
statusUri	string	Status value

Output Example

{"status_code":200,"response_headers":{"Date":"Thu, 11 Jul 2024 05:22:33 GMT","Content-Type":"application/json;charset=utf-8","Transfer-Encoding":"chunked","Connection":"keep-alive","Access-Control-Allow-Origin":"*","Access-Control-Allow-Headers":"x-redlock-request-id,x-redlock-auth,rl-json-rule,terraform-version,terraform-012...","Access-Control-Allow-Methods":"POST, PUT, GET, OPTIONS, DELETE, PATCH","Access-Control-Expose-Headers":"x-redlock-auth,x-redlock-request-id,x-redlock-status, x-redloc...

Get Alert Evidence Graph

Retrieve the alert evidence graph in JSON format for a specific alert ID from Palo Alto Networks Prisma Cloud.

Endpoint

URL: /alert/v1/{{id}}/graph

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.id	string	Required	The alert id of the evidence graph.

Input Example

{"path_parameters":{"id":"b70ac365a19446a59da964785d03142d"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
graphs	array	Output field: graphs
graphs.graph	object	Output field: graphs.graph
graphs.graph.nodes	object	Output field: graphs.graph.nodes
graphs.graph.edges	array	Output field: graphs.graph.edges
graphs.graph.edges.id	string	Unique identifier
graphs.graph.edges.source	string	Output field: graphs.graph.edges.source
graphs.graph.edges.target	string	Output field: graphs.graph.edges.target
graphs.graph.edges.metadata	object	Response data
graphs.graph.edges.metadata.severity	string	Response data
nextPageToken	string	Output field: nextPageToken

Output Example

{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"graphs":[{}],"nextPageToken":"string"}}

Get Alert Rule by ID

Retrieve details for a specific alert rule in Palo Alto Networks Prisma Cloud using the provided ID.

Endpoint

URL: /alert/rule/{{id}}

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.id	string	Required	Alert rule ID.

Input Example

{"path_parameters":{"id":"01bf3f5b-3f5f-483b-8015-7be30cf280a6"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
policyScanConfigId	string	Unique identifier
name	string	Name of the resource
description	string	Output field: description
enabled	boolean	Output field: enabled
scanAll	boolean	Output field: scanAll
policies	array	Output field: policies
policyLabels	array	Output field: policyLabels
policyLabels.file_name	string	Name of the resource
policyLabels.file	string	Output field: policyLabels.file
excludedPolicies	array	Output field: excludedPolicies
excludedPolicies.file_name	string	Name of the resource
excludedPolicies.file	string	Output field: excludedPolicies.file
target	object	Output field: target
target.accountGroups	array	Output field: target.accountGroups
target.excludedAccounts	array	Output field: target.excludedAccounts
target.excludedAccounts.file_name	string	Name of the resource
target.excludedAccounts.file	string	Output field: target.excludedAccounts.file
target.regions	array	Output field: target.regions
target.regions.file_name	string	Name of the resource
target.regions.file	string	Output field: target.regions.file
target.tags	array	Output field: target.tags
target.tags.file_name	string	Name of the resource
target.tags.file	string	Output field: target.tags.file

Output Example

{"status_code":200,"response_headers":{"Date":"Mon, 08 Jul 2024 14:34:26 GMT","Content-Type":"application/json;charset=utf-8","Transfer-Encoding":"chunked","Connection":"keep-alive","Access-Control-Allow-Origin":"*","Access-Control-Allow-Headers":"x-redlock-request-id,x-redlock-auth,rl-json-rule,terraform-version,terraform-012...","Access-Control-Allow-Methods":"POST, PUT, GET, OPTIONS, DELETE, PATCH","Access-Control-Expose-Headers":"x-redlock-auth,x-redlock-request-id,x-redlock-status, x-redloc...

Get Alerts Count By Status

Retrieve the count of Palo Alto Networks Prisma Cloud alerts filtered by a specific status.

Endpoint

URL: /alert/count/{{status}}

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.status	string	Required	Alert Status.

Input Example

{"path_parameters":{"status":"open"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
count	number	Count value

Output Example

{"status_code":200,"response_headers":{"Date":"Wed, 10 Jul 2024 12:46:53 GMT","Content-Type":"application/json","Transfer-Encoding":"chunked","Connection":"keep-alive","X-RateLimit-Remaining":"9","X-RateLimit-Requested-Tokens":"1","X-RateLimit-Burst-Capacity":"10","X-RateLimit-Replenish-Rate":"3","Access-Control-Allow-Origin":"*","Access-Control-Allow-Headers":"x-redlock-request-id,x-redlock-auth,rl-json-rule,terraform-version,terraform-012...","Access-Control-Allow-Methods":"POST, PUT, GET, OPT...

Get Alerts List Job Status

Retrieve the current status of a specific alerts list job in Palo Alto Networks Prisma Cloud using the job ID.

Endpoint

URL: /alert/jobs/{{id}}/status

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.id	string	Required	Parameters for the Get Alerts List Job Status action

Input Example

{"path_parameters":{"id":"a5bb74f1876d43bd971369d3349fcc07"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
id	string	Unique identifier
customerId	number	Unique identifier
status	string	Status value
createdBy	string	Output field: createdBy
createdOn	number	Output field: createdOn
lastModified	number	Output field: lastModified
statusUri	string	Status value

Output Example

{"status_code":200,"response_headers":{"Date":"Thu, 11 Jul 2024 04:00:32 GMT","Content-Type":"application/json;charset=utf-8","Transfer-Encoding":"chunked","Connection":"keep-alive","Access-Control-Allow-Origin":"*","Access-Control-Allow-Headers":"x-redlock-request-id,x-redlock-auth,rl-json-rule,terraform-version,terraform-012...","Access-Control-Allow-Methods":"POST, PUT, GET, OPTIONS, DELETE, PATCH","Access-Control-Expose-Headers":"x-redlock-auth,x-redlock-request-id,x-redlock-status, x-redloc...

Get Asset Inventory Trend View V3

Retrieve pass/fail trends of asset inventory from Palo Alto Networks Prisma Cloud, based on specified parameters.

Endpoint

URL: v3/inventory/trend

Method: GET

Input

Argument Name	Type	Required	Description
parameters.cloud.account	string	Optional	Cloud account.
parameters.account.group	string	Optional	Account group.
parameters.cloud.type	string	Optional	Cloud type.
parameters.cloud.region	string	Optional	Cloud region.
parameters.cloud.service	string	Optional	Cloud service.
parameters.resource.type	string	Optional	Resource type.
parameters.groupBy	string	Optional	Comma-separated list of values by to group response items. Valid values are cloud.type, cloud.account, cloud.region, cloud.service, and/or resource.type. Default is cloud.type.
parameters.scan.status	string	Optional	Whether or not the resources passed or failed the scan. All includes both scanned and unscanned resources.
parameters.policy.complianceStandard	string	Optional	Policy compliance standard name.
parameters.policy.complianceRequirement	string	Optional	Policy compliance requirement name.
parameters.asset.severity	string	Optional	Policy severity.
parameters.vulnerability.severity	string	Optional	Vulnerability Severity.

Input Example

{"parameters":{"cloud.account":"Test","account.group":" group","cloud.type":"gcp","cloud.region":"GCP Global","cloud.service":"Test service","resource.type":"Test Resource Type","groupBy":"cloud.account,cloud.service","scan.status":"all","policy.complianceStandard":"Compliance Standard","policy.complianceRequirement":"Policy Compliance Requirement","asset.severity":"high","vulnerability.severity":"high"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase

Output Example

[]

Get Asset Inventory View V3

Retrieve pass/fail compliance data for assets within Palo Alto Networks Prisma Cloud using specified parameters.

Endpoint

URL: v3/inventory

Method: GET

Input

Argument Name	Type	Required	Description
parameters.cloud.account	string	Optional	Cloud account.
parameters.account.group	string	Optional	Account group.
parameters.cloud.type	string	Optional	Cloud type.
parameters.cloud.region	string	Optional	Cloud region.
parameters.cloud.service	string	Optional	Cloud service.
parameters.resource.type	string	Optional	Resource type.
parameters.groupBy	string	Optional	Comma-separated list of values by to group response items. Valid values are cloud.type, cloud.account, cloud.region, cloud.service, and/or resource.type. Default is cloud.type.
parameters.scan.status	string	Optional	Whether or not the resources passed or failed the scan. All includes both scanned and unscanned resources.
parameters.policy.complianceStandard	string	Optional	Policy compliance standard name.
parameters.policy.complianceRequirement	string	Optional	Policy compliance requirement name.
parameters.asset.severity	string	Optional	Policy severity.
parameters.vulnerability.severity	string	Optional	Vulnerability Severity.

Input Example

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
timestamp	number	Output field: timestamp
requestedTimestamp	number	Output field: requestedTimestamp
summary	object	Output field: summary
summary.timestamp	number	Output field: summary.timestamp
summary.failedResources	number	Output field: summary.failedResources
summary.passedResources	number	Output field: summary.passedResources
summary.totalResources	number	Output field: summary.totalResources
summary.highSeverityFailedResources	number	Output field: summary.highSeverityFailedResources
summary.mediumSeverityFailedResources	number	Output field: summary.mediumSeverityFailedResources
summary.lowSeverityFailedResources	number	Output field: summary.lowSeverityFailedResources
summary.criticalSeverityFailedResources	number	Output field: summary.criticalSeverityFailedResources
summary.informationalSeverityFailedResources	number	Output field: summary.informationalSeverityFailedResources
summary.criticalVulnerabilityFailedResources	number	Output field: summary.criticalVulnerabilityFailedResources
summary.highVulnerabilityFailedResources	number	Output field: summary.highVulnerabilityFailedResources
summary.mediumVulnerabilityFailedResources	number	Output field: summary.mediumVulnerabilityFailedResources
summary.lowVulnerabilityFailedResources	number	Output field: summary.lowVulnerabilityFailedResources
summary.totalVulnerabilityFailedResources	number	Output field: summary.totalVulnerabilityFailedResources
groupedAggregates	array	Output field: groupedAggregates
groupedAggregates.cloudTypeName	string	Name of the resource
groupedAggregates.failedResources	number	Output field: groupedAggregates.failedResources
groupedAggregates.passedResources	number	Output field: groupedAggregates.passedResources
groupedAggregates.totalResources	number	Output field: groupedAggregates.totalResources
groupedAggregates.highSeverityFailedResources	number	Output field: groupedAggregates.highSeverityFailedResources

Output Example

{"status_code":200,"response_headers":{"Date":"Mon, 08 Jul 2024 06:36:25 GMT","Content-Type":"application/json;charset=utf-8","Transfer-Encoding":"chunked","Connection":"keep-alive","Access-Control-Allow-Origin":"*","Access-Control-Allow-Headers":"x-redlock-request-id,x-redlock-auth,rl-json-rule,terraform-version,terraform-012...","Access-Control-Allow-Methods":"POST, PUT, GET, OPTIONS, DELETE, PATCH","Access-Control-Expose-Headers":"x-redlock-auth,x-redlock-request-id,x-redlock-status, x-redloc...

Retrieve assets associated with a specific Cloud Identity Inventory resource by using the provided asset_id.

Endpoint

URL: iam/api/v1/asset/{{asset_id}}/related-asset

Method: POST

Input

Argument Name	Type	Required	Description
path_parameters.asset_id	string	Required	The asset UAI where you want to find it related assets.
parameters.limit	number	Optional	Query client records limit, return MAX(0, MIN(client.limit, service.limit)).
relationshipType	string	Optional	Relationship Type.
lastAccessFromTime	number	Optional	Last accessed From epoch (epoch).
lastAccessToTime	number	Optional	Last accessed To epoch (epoch).
nextPageToken	string	Optional	Page Token.

Input Example

{"parameters":{"limit":5},"json_body":{"relationshipType":"AWS_POLICY_ROLE","lastAccessFromTime":1678785157,"lastAccessToTime":1678785157,"nextPageToken":"++fdfkjsdlfsdfdFDSFDFSDFdfdssfdFDS"},"path_parameters":{"asset_id":"681390424b288d835f5cd03e7bfb0993"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
items	array	Output field: items
items.targetAssetId	string	Unique identifier
items.targetCloudResourceId	string	Unique identifier
items.targetDisplayName	string	Name of the resource
items.targetResourceType	string	Type of the resource
items.lastAccessDate	string	Date value
items.lastAccessStatus	string	Status value
items.grantedByLevelType	string	Type of the resource
nextPageToken	string	Output field: nextPageToken
totalRows	number	Output field: totalRows

Output Example

{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"items":[{}],"nextPageToken":"iam/api/{apiVersion}/{apiPath}?page-token=Q74589g444gg","totalRows":1243}}

Get CVE Details by ID

Retrieve detailed CVE information and impacted assets from Palo Alto Networks Prisma Cloud in GZIP CSV format, requiring a specific cveId.

Endpoint

URL: uve/api/v1/vulnerabilities/download

Method: POST

Input

Argument Name	Type	Required	Description
cveId	string	Optional	CVE ID.
riskFactors	array	Optional	List of risk factors.
assetType	string	Optional	Asset type.

Input Example

{"json_body":{"cveId":"CVE-2021-44228","riskFactors":["risk factor"],"assetType":"package"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
file	object	Attachment
file.file	string	Output field: file.file
file.file_name	string	Name of the resource

Output Example

{"status_code":200,"response_headers":{},"reason":"OK","file":{}}

Get CVE Overview V2

Retrieve detailed information for a given CVE ID, including EPSS, CVSS scores, and exploits from Palo Alto Networks Prisma Cloud.

Endpoint

URL: uve/api/v1/cve-overview

Method: GET

Input

Argument Name	Type	Required	Description
parameters.cve_id	string	Required	CVE ID.

Input Example

{"parameters":{"cve_id":"CVE-2021-44228"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
cveId	string	Unique identifier
cvss	number	Output field: cvss
lifeCycle	array	Output field: lifeCycle
riskFactors	array	Output field: riskFactors
severity	string	Output field: severity
impactedDistrosList	array	Output field: impactedDistrosList
impactedDistrosList.distro	string	Output field: impactedDistrosList.distro
impactedDistrosList.impactCount	number	Count value
impactedDistrosList.highestCVSS	number	Output field: impactedDistrosList.highestCVSS
impactedDistrosList.highestSeverity	string	Output field: impactedDistrosList.highestSeverity
impactedDistrosList.firstPublishedDate	number	Date value
impactedDistrosList.lastModifiedDate	number	Date value
impactedDistrosList.distroDetailsList	array	Output field: impactedDistrosList.distroDetailsList
impactedDistrosList.distroDetailsList.cvss	number	Output field: impactedDistrosList.distroDetailsList.cvss
impactedDistrosList.distroDetailsList.packageName	string	Name of the resource
impactedDistrosList.distroDetailsList.release	string	Output field: impactedDistrosList.distroDetailsList.release
impactedDistrosList.distroDetailsList.severity	string	Output field: impactedDistrosList.distroDetailsList.severity
impactedDistrosList.distroDetailsList.affectedVersion	string	Output field: impactedDistrosList.distroDetailsList.affectedVersion
impactedDistrosList.distroDetailsList.fixedTime	number	Time value
impactedDistrosList.distroDetailsList.publishedDate	number	Date value
impactedDistrosList.distroDetailsList.modifiedDate	number	Date value
impactedAssetsCount	number	Count value
impactedAssetsRuntimeCount	number	Count value

Output Example

{"status_code":200,"response_headers":{"Date":"Sat, 13 Jul 2024 15:55:35 GMT","Content-Type":"application/json","Transfer-Encoding":"chunked","Connection":"keep-alive","X-Content-Type-Options":"nosniff","X-XSS-Protection":"1; mode=block","Cache-Control":"no-cache, no-store, max-age=0, must-revalidate","Pragma":"no-cache","Expires":"0","Strict-Transport-Security":"max-age=31536000 ; includeSubDomains","X-Frame-Options":"DENY","Vary":"Origin, Access-Control-Request-Method, Access-Control-Request-H...

Get Existing Least Privilege Access for an Asset

Suggests the minimal policies/roles for an asset in Prisma Cloud, considering actions from the past specified days.

Endpoint

URL: iam/api/v1/assets/{{asset_id}}/existing-least-privileged-access

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.asset_id	string	Required	The UAI asset Id.
parameters.output_format	string	Required	Output format type.Output format type.
parameters.lookback_duration_days	number	Required	Amount of days to look back for used actions.

Input Example

{"parameters":{"output_format":"JSON","lookback_duration_days":90},"path_parameters":{"asset_id":"681390424b288d835f5cd03e7bfb0993"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
nextPageToken	string	Output field: nextPageToken
permissionsInAssetCount	number	Count value
permissionsInLeastPrivilegedCount	number	Count value
analysis	array	Output field: analysis
analysis.action	string	Output field: analysis.action
analysis.configurationName	string	Name of the resource
analysis.keep	boolean	Output field: analysis.keep
value	array	Value for the parameter
value.iamResourceName	string	Name of the resource
value.iamResourceId	string	Unique identifier
value.iamResourceType	string	Type of the resource
value.formatType	string	Type of the resource
value.snippet	string	Value for the parameter

Output Example

{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"nextPageToken":"++fdfkjsdlfsdfdFDSFDFSDFdfdssfdFDS","permissionsInAssetCount":10,"permissionsInLeastPrivilegedCount":10,"analysis":[{}],"value":[{}]}}

Get Host Scan Results

Retrieve detailed vulnerability scan reports for specific hosts from Palo Alto Networks Prisma Cloud.

Endpoint

URL: /api/v32.06/hosts

Method: GET

Input

Argument Name	Type	Required	Description
parameters.offset	number	Optional	Offsets the result to a specific report count. Offset starts from 0.
parameters.limit	number	Optional	Limit is the amount to fix.
parameters.sort	string	Optional	Sorts the result using a key.
parameters.reverse	boolean	Optional	Sorts the result in reverse order.
parameters.hostname	array	Optional	Filters the result based on hostnames.
parameters.distro	array	Optional	Filters the result based on OS distribution names.
parameters.compact	boolean	Optional	Provides the minimal image data. Information about vulnerabilities, compliance, and extended image metadata are skipped.
parameters.clusters	array	Optional	Filters the result based on cluster names.
parameters.complianceIDs	array	Optional	Filters the result based on compliance IDs.
parameters.complianceIDs.file_name	string	Required	Parameters for the Get Host Scan Results action
parameters.complianceIDs.file	string	Required	Parameters for the Get Host Scan Results action
parameters.complianceRuleName	string	Optional	Filters the result based on applied compliance rule name.
parameters.agentless	boolean	Optional	Retrieves the host names that were scanned by the agentless scanner.
parameters.csa	boolean	Optional	Filters only images scanned by CSA.
parameters.stopped	boolean	Optional	Retrieves the host names that were skipped during an agentless scan.
parameters.normalizedSeverity	boolean	Optional	Retrieves the result in the normalized form of low, medium, high, and critical based on vulnerability's severity level.
parameters.uaiID	string	Optional	Filters results by uaiID.
parameters.issueType	array	Optional	Filters results by issue type.

Input Example

{"parameters":{"offset":123,"limit":123,"sort":"string","reverse":true,"hostname":["string"],"distro":["string"],"compact":true,"clusters":["string"],"complianceIDs":[{"file_name":"Example Name","file":"string"}],"complianceRuleName":"Example Name","agentless":true,"csa":true,"stopped":true,"normalizedSeverity":true,"uaiID":"string","issueType":["string"]}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase

Output Example

{"status_code":200,"response_headers":{},"reason":"OK","json_body":[{"Secrets":[],"_id":"string","agentless":true,"aisUUID":"string","allCompliance":{},"appEmbedded":true,"applications":[],"baseImage":"string","binaries":[],"cloudMetadata":{},"clusterType":[],"clusters":[],"collections":[],"complianceDistribution":{},"complianceIssues":[]}]}

Get IAM Query

Retrieve the IAM query for a given alert ID from Palo Alto Networks Prisma Cloud, requiring an 'alertId' parameter.

Endpoint

URL: api/v1/permission/alert/search

Method: GET

Input

Argument Name	Type	Required	Description
parameters.alertId	string	Required	Alert Id.

Input Example

{"parameters":{"alertId":"P-23213241"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
data	array	Response data
query	string	Output field: query
timeRange	object	Output field: timeRange
timeRange.type	string	Type of the resource
timeRange.value	string	Value for the parameter

Output Example

{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"data":["string"],"query":"Query 1","timeRange":{"type":"to_now","value":"epoch"}}}

Get IAM Query V2

Retrieves the IAM query for a given alert using the specified alert_id in Palo Alto Networks Prisma Cloud.

Endpoint

URL: iam/api/v2/alert/{{alert_id}}/query

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.alert_id	string	Required	The alert id.

Input Example

{"path_parameters":{"alert_id":"I-34537"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
timeRange	string	Output field: timeRange
query	string	Output field: query

Output Example

{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"timeRange":"{''type': 'relative', 'value': {'unit': 'day', 'amount': 7} }","query":"config from iam where source.cloud.type = 'AWS'"}}

Get Least Privilege Access Metadata of a Resource

Retrieve metadata for optimizing resource access based on least privilege principles in Palo Alto Networks Prisma Cloud, requiring a resource ID.

Endpoint

URL: iam/api/v1/resources/{{resource_id}}/over-permissive-metadata

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.resource_id	string	Required	The resource ID.

Input Example

{"path_parameters":{"resource_id":"3fab987adf7c268519219cdfe5a4c4c2d4dc"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
nextPageToken	string	Output field: nextPageToken
permissionsInAssetCount	number	Count value
permissionsInLeastPrivilegedCount	number	Count value
analysis	array	Output field: analysis
analysis.action	string	Output field: analysis.action
analysis.configurationName	string	Name of the resource
analysis.keep	boolean	Output field: analysis.keep
value	array	Value for the parameter
value.iamResourceName	string	Name of the resource
value.iamResourceId	string	Unique identifier
value.iamResourceType	string	Type of the resource
value.formatType	string	Type of the resource
value.snippet	string	Value for the parameter

Output Example

Get Least Privilege Access Metadata of an Asset

Retrieve metadata and suggestions for enhancing an asset's Least Privilege Access in Prisma Cloud using the provided asset_id.

Endpoint

URL: iam/api/v1/assets/{{asset_id}}/over-permissive-metadata

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.asset_id	string	Required	The UAI asset Id.

Input Example

{"path_parameters":{"asset_id":"681390424b288d835f5cd03e7bfb0993"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
totalIamResourceCount	number	Count value
overPermissiveCount	number	Count value
isCustomLeastPrivilegedSupported	boolean	Output field: isCustomLeastPrivilegedSupported
isExistingLeastPrivilegedSupported	boolean	Output field: isExistingLeastPrivilegedSupported
iamResourceType	string	Type of the resource

Output Example

{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"totalIamResourceCount":15,"overPermissiveCount":10,"isCustomLeastPrivilegedSupported":true,"isExistingLeastPrivilegedSupported":true,"iamResourceType":"AWS IAM Policy"}}

Get Least Privilege Access Suggestion Resource

Generates least privilege access suggestions for a resource in Palo Alto Networks Prisma Cloud, based on IAM configurations and activity from the specified lookback duration.

Endpoint

URL: iam/api/v1/resources/{{resource_id}}/existing-least-privileged-access

Method: GET

Input

Argument Name	Type	Required	Description
parameters.output_format	string	Required	Output format type.Output format type.
parameters.lookback_duration_days	number	Required	Amount of days to look back for used actions.
path_parameters.resource_id	string	Required	The resource ID.

Input Example

{"parameters":{"output_format":"JSON","lookback_duration_days":90},"path_parameters":{"resource_id":"3fab987adf7c268519219cdfe5a4c4c2d4dc"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
nextPageToken	string	Output field: nextPageToken
permissionsInAssetCount	number	Count value
permissionsInLeastPrivilegedCount	number	Count value
analysis	array	Output field: analysis
analysis.action	string	Output field: analysis.action
analysis.configurationName	string	Name of the resource
analysis.keep	boolean	Output field: analysis.keep
value	array	Value for the parameter
value.iamResourceName	string	Name of the resource
value.iamResourceId	string	Unique identifier
value.iamResourceType	string	Type of the resource
value.formatType	string	Type of the resource
value.snippet	string	Value for the parameter

Output Example

Get New Least Privilege Access for a Resource

Generates a custom least privileged access configuration for a resource in Palo Alto Networks Prisma Cloud based on past actions within a specified lookback period.

Endpoint

URL: iam/api/v1/resources/{{resource_id}}/custom-least-privileged-access

Method: GET

Input

Argument Name	Type	Required	Description
parameters.output_format	string	Required	Output format type.Output format type.
parameters.lookback_duration_days	number	Required	Amount of days to look back for used actions.
path_parameters.resource_id	string	Required	The resource ID.

Input Example

{"parameters":{"output_format":"JSON","lookback_duration_days":90},"path_parameters":{"resource_id":"3fab987adf7c268519219cdfe5a4c4c2d4dc"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
nextPageToken	string	Output field: nextPageToken
permissionsInAssetCount	number	Count value
permissionsInLeastPrivilegedCount	number	Count value
analysis	array	Output field: analysis
analysis.action	string	Output field: analysis.action
analysis.configurationName	string	Name of the resource
analysis.keep	boolean	Output field: analysis.keep
value	array	Value for the parameter
value.formatType	string	Type of the resource
value.snippet	string	Value for the parameter

Output Example

Get New Least Privilege Access for an Asset

Generates a least privileged access configuration for a specified asset in Palo Alto Networks Prisma Cloud, considering the last X days of activity to optimize policy and role usage.

Endpoint

URL: iam/api/v1/assets/{{asset_id}}/custom-least-privileged-access

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.asset_id	string	Required	The UAI asset Id.
parameters.output_format	string	Required	Output format type.Output format type.
parameters.lookback_duration_days	number	Required	Amount of days to look back for used actions.

Input Example

{"parameters":{"output_format":"JSON","lookback_duration_days":90},"path_parameters":{"asset_id":"681390424b288d835f5cd03e7bfb0993"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
nextPageToken	string	Output field: nextPageToken
permissionsInAssetCount	number	Count value
permissionsInLeastPrivilegedCount	number	Count value
analysis	array	Output field: analysis
analysis.action	string	Output field: analysis.action
analysis.configurationName	string	Name of the resource
analysis.keep	boolean	Output field: analysis.keep
value	array	Value for the parameter
value.formatType	string	Type of the resource
value.snippet	string	Value for the parameter

Output Example

Get Permission Accesses

Retrieve usage data for a specific permission in Palo Alto Networks Prisma Cloud, including last access details and requires permissionId and query.

Endpoint

URL: api/v1/permission/access

Method: POST

Input

Argument Name	Type	Required	Description
limit	number	Optional	Maximun number of items to return for the given query.
permissionId	string	Optional	Permission Id.
query	string	Optional	Query string.

Input Example

{"json_body":{"limit":5,"permissionId":"111111","query":"config from iam where ..."}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
data	object	Response data
data.items	array	Response data
data.items.destCloudResourceName	string	Response data
data.items.lastAccessDate	string	Response data
data.nextPageToken	string	Response data
data.totalRows	number	Response data

Output Example

{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"data":{"items":[],"nextPageToken":"++fdfkjsdlfsdfdFDSFDFSDFdfdssfdFDS","totalRows":1243}}}

Get Permission Accesses V3

Retrieve a paginated list of the last accesses for a specific permission in Palo Alto Networks Prisma Cloud, including a token for subsequent pages.

Endpoint

URL: iam/api/v3/permission/{{permission_id}}/list_access

Method: POST

Input

Argument Name	Type	Required	Description
path_parameters.permission_id	string	Required	The permission id. Can be retrieved from search/permission api.
parameters.limit	number	Optional	Query records limit.
query	string	Optional	Query string.
nextPageToken	string	Optional	Page Token.

Input Example

{"parameters":{"limit":5},"json_body":{"query":"config from iam where source.cloud.type = 'AWS'","nextPageToken":"++fdfkjsdlfsdfdFDSFDFSDFdfdssfdFDS"},"path_parameters":{"permission_id":"06c3cb4403ac276ff59679139b8e6afca2afe93100c8b39014f033ca0339ff0f"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
data	object	Response data
data.items	array	Response data
data.items.destCloudResourceName	string	Response data
data.items.lastAccessDate	string	Response data
data.items.destCloudRegion	string	Response data
data.items.destCloudAccount	string	Response data
data.nextPageToken	string	Response data
data.totalRows	number	Response data

Output Example

{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"data":{"items":[],"nextPageToken":"iam/api/{apiVersion}/{apiPath}?page-token=Q74589g444gg","totalRows":1243}}}

Get Permissions

Obtain IAM permissions from Palo Alto Networks Prisma Cloud using query parameters with a defined result limit.

Endpoint

URL: api/v1/permission

Method: POST

Input

Argument Name	Type	Required	Description
id	string	Optional	Request user Id.
limit	number	Optional	Maximun number of items to return for the given query.
query	string	Optional	IAM RQL query.

Input Example

{"json_body":{"id":"123456","limit":5,"query":"config from iam where ..."}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
data	object	Response data
data.items	array	Response data
data.items.accessedResourcesCount	number	Response data
data.items.destCloudAccount	string	Response data
data.items.destCloudRegion	string	Response data
data.items.destCloudResourceRrn	string	Response data
data.items.destCloudServiceName	string	Response data
data.items.destCloudType	string	Response data
data.items.destResourceId	string	Response data
data.items.destResourceName	string	Response data
data.items.destResourceType	string	Response data
data.items.effectiveActionName	string	Response data
data.items.exceptions	array	Response data
data.items.exceptions.messageCode	string	Response data
data.items.grantedByCloudEntityId	string	Response data
data.items.grantedByCloudEntityName	string	Response data
data.items.grantedByCloudEntityRrn	string	Response data
data.items.grantedByCloudEntityType	string	Response data
data.items.grantedByCloudPolicyId	string	Response data
data.items.grantedByCloudPolicyName	string	Response data
data.items.grantedByCloudPolicyRrn	string	Response data
data.items.grantedByCloudPolicyType	string	Response data
data.items.grantedByCloudType	string	Response data

Output Example

{"data":{"items":[{}],"nextPageToken":"string","searchedDestCloudResourceNames":[{}],"totalRows":123},"description":"string","id":"12345678-1234-1234-1234-123456789abc","name":"Example Name","query":"string","saved":true,"searchType":"string","timeRange":{"type":"string","value":"string"}}

Get Permissions Access Next Page

Retrieve the next page of permissions data from Palo Alto Networks Prisma Cloud using a pageToken.

Endpoint

URL: api/v1/permission/access/page

Method: POST

Input

Argument Name	Type	Required	Description
limit	number	Optional	Maximun number of items to return for the given query.
pageToken	string	Optional	Page token

Input Example

{"json_body":{"limit":5,"pageToken":"++fdfkjsdlfsdfdFDSFDFSDFdfdssfdFDS"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
items	array	Output field: items
items.destCloudResourceName	string	Name of the resource
items.lastAccessDate	string	Date value
nextPageToken	string	Output field: nextPageToken
totalRows	number	Output field: totalRows

Output Example

{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"items":[{}],"nextPageToken":"++fdfkjsdlfsdfdFDSFDFSDFdfdssfdFDS","totalRows":1243}}

Get Permissions Next Page

Retrieve the next page of permissions from Palo Alto Networks Prisma Cloud with a given pageToken.

Endpoint

URL: api/v1/permission/page

Method: POST

Input

Argument Name	Type	Required	Description
limit	number	Optional	Maximun number of items to return.
pageToken	string	Optional	Page token from the response object of an earlier request to get permissions.

Input Example

{"json_body":{"limit":0,"pageToken":"asdfvr3456575432weSDFS24ASSD"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
items	array	Output field: items
items.accessedResourcesCount	number	Count value
items.destCloudAccount	string	Count value
items.destCloudRegion	string	Output field: items.destCloudRegion
items.destCloudResourceRrn	string	Output field: items.destCloudResourceRrn
items.destCloudServiceName	string	Name of the resource
items.destCloudType	string	Type of the resource
items.destResourceId	string	Unique identifier
items.destResourceName	string	Name of the resource
items.destResourceType	string	Type of the resource
items.effectiveActionName	string	Name of the resource
items.exceptions	array	Output field: items.exceptions
items.exceptions.messageCode	string	Response message
items.grantedByCloudEntityId	string	Unique identifier
items.grantedByCloudEntityName	string	Name of the resource
items.grantedByCloudEntityRrn	string	Output field: items.grantedByCloudEntityRrn
items.grantedByCloudEntityType	string	Type of the resource
items.grantedByCloudPolicyId	string	Unique identifier
items.grantedByCloudPolicyName	string	Name of the resource
items.grantedByCloudPolicyRrn	string	Output field: items.grantedByCloudPolicyRrn
items.grantedByCloudPolicyType	string	Type of the resource
items.grantedByCloudType	string	Type of the resource
items.id	string	Unique identifier

Output Example

{"items":[{"accessedResourcesCount":123,"destCloudAccount":"string","destCloudRegion":"string","destCloudResourceRrn":"string","destCloudServiceName":"Example Name","destCloudType":"string","destResourceId":"string","destResourceName":"Example Name","destResourceType":"string","effectiveActionName":"Example Name","exceptions":[],"grantedByCloudEntityId":"string","grantedByCloudEntityName":"Example Name","grantedByCloudEntityRrn":"string","grantedByCloudEntityType":"string"}],"nextPageToken":"str...

Get Permissions Role or Policy Definition V2

Retrieve configuration details for a specific permission ID in Palo Alto Networks Prisma Cloud.

Endpoint

URL: iam/api/v2/search/iam_config

Method: POST

Input

Argument Name	Type	Required	Description
permissionId	string	Optional	PermissionId to get the raw config for. Can be obtain form calling search/permission API.

Input Example

{"json_body":{"permissionId":"06c3cb4403ac276ff59679139b8e6afca2afe93100c8b39014f033ca0339ff0f"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
raw	string	Output field: raw

Output Example

{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"raw":"test raw"}}

Get Permissions V4

Retrieves permissions grouped by fields and provides a page token for subsequent queries in Palo Alto Networks Prisma Cloud. Requires a 'query' JSON body input.

Endpoint

URL: iam/api/v4/search/permission

Method: POST

Input

Argument Name	Type	Required	Description
parameters.limit	number	Optional	Query records limit.
query	string	Optional	RQL query.
searchId	string	Optional	Saved search id.
nextPageToken	string	Optional	Page Token.
groupByFields	array	Optional	Fields to group results by. Empty or missing array is considered the same as an array with all possible fields.

Input Example

{"parameters":{"limit":5},"json_body":{"query":"config from iam where dest.cloud.type='AWS'","searchId":"ff4fcb80-03f6-41dd-8bd8-6179fd46b3a4","nextPageToken":"++fdfkjsdlfsdfdFDSFDFSDFdfdssfdFDS","groupByFields":["source","sourceCloudAccount","grantedByEntity","entityCloudAccount","grantedByPolicy","policyCloudAccount","grantedByLevel","action","destination","destCloudAccount","lastAccess"]}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
data	object	Response data
data.items	array	Response data
data.items.id	string	Response data
data.items.sourcePublic	boolean	Response data
data.items.sourceCloudType	string	Response data
data.items.sourceCloudAccount	string	Response data
data.items.sourceCloudRegion	string	Response data
data.items.sourceCloudServiceName	string	Response data
data.items.sourceResourceName	string	Response data
data.items.sourceResourceType	string	Response data
data.items.sourceResourceId	string	Response data
data.items.sourceCloudResourceUai	string	Response data
data.items.sourceIdpService	string	Response data
data.items.sourceIdpDomain	string	Response data
data.items.sourceIdpEmail	string	Response data
data.items.sourceIdpUserId	string	Response data
data.items.sourceIdpUsername	string	Response data
data.items.sourceIdpGroup	string	Response data
data.items.sourceIdpUai	string	Response data
data.items.destCloudType	string	Response data
data.items.destCloudAccount	string	Response data
data.items.destCloudRegion	string	Response data
data.items.destCloudServiceName	string	Response data

Output Example

{"data":{"items":[{}],"nextPageToken":"string","totalRows":123,"searchedDestCloudResourceNames":[{}]},"query":"string","id":"12345678-1234-1234-1234-123456789abc","saved":true,"name":"Example Name","timeRange":"string","searchType":"string","description":"string","cloudType":"string"}

Get Policy Alert Job Status

Retrieves the current status of a policy alert job in Palo Alto Networks Prisma Cloud using the provided job ID.

Endpoint

URL: /alert/policy/jobs/{{id}}/status

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.id	string	Required	Job ID.

Input Example

{"path_parameters":{"id":"b70ac365a19446a59da964785d03142d"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
id	string	Unique identifier
customerId	number	Unique identifier
status	string	Status value
createdBy	string	Output field: createdBy
createdOn	number	Output field: createdOn
lastModified	number	Output field: lastModified
timeTaken	number	Output field: timeTaken
recordCount	number	Count value
statusUri	string	Status value
downloadUri	string	Output field: downloadUri

Output Example

{"status_code":200,"response_headers":{"Date":"Thu, 11 Jul 2024 05:48:19 GMT","Content-Type":"application/json;charset=utf-8","Transfer-Encoding":"chunked","Connection":"keep-alive","Access-Control-Allow-Origin":"*","Access-Control-Allow-Headers":"x-redlock-request-id,x-redlock-auth,rl-json-rule,terraform-version,terraform-012...","Access-Control-Allow-Methods":"POST, PUT, GET, OPTIONS, DELETE, PATCH","Access-Control-Expose-Headers":"x-redlock-auth,x-redlock-request-id,x-redlock-status, x-redloc...

Get Prioritized Vulnerabilities V3

Retrieve top-priority vulnerabilities from Palo Alto Networks Prisma Cloud, categorized by urgency and exploitability, including asset impact.

Endpoint

URL: uve/api/v3/dashboard/vulnerabilities/prioritised

Method: GET

Input

Argument Name	Type	Required	Description
parameters.asset_type	string	Required	Type of Asset.
parameters.life_cycle	string	Required	Life Cycle stage.

Input Example

{"parameters":{"asset_type":"iac","life_cycle":"code"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
lastUpdatedDateTime	number	Time value
totalVulnerabilities	number	Output field: totalVulnerabilities
urgent	object	Output field: urgent
urgent.vulnerabilityCount	number	Count value
urgent.assetCount	number	Count value
patchable	object	Output field: patchable
patchable.vulnerabilityCount	number	Count value
patchable.assetCount	number	Count value
exploitable	object	Output field: exploitable
exploitable.vulnerabilityCount	number	Count value
exploitable.assetCount	number	Count value
internetExposed	object	Output field: internetExposed
internetExposed.vulnerabilityCount	number	Count value
internetExposed.assetCount	number	Count value
packageInUse	object	Output field: packageInUse
packageInUse.vulnerabilityCount	number	Count value
packageInUse.assetCount	number	Count value

Output Example

{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"lastUpdatedDateTime":0,"totalVulnerabilities":0,"urgent":{"vulnerabilityCount":0,"assetCount":0},"patchable":{"vulnerabilityCount":0,"assetCount":0},"exploitable":{"vulnerabilityCount":0,"assetCount":0},"internetExposed":{"vulnerabilityCount":0,"assetCount":0},"packageInUse":{"vulnerabilityCount":0,"assetCount":0}}}

Get Query Suggestions

Provides auto-complete suggestions and validity checks for partial IAM queries in Palo Alto Networks Prisma Cloud.

Endpoint

URL: api/v1/suggest

Method: POST

Input

Argument Name	Type	Required	Description
query	string	Optional	Query to validate.

Input Example

{"json_body":{"query":"config from iam where dest.cloud.type='AWS'"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
needsOffsetUpdate	boolean	Date value
offset	number	Output field: offset
suggestions	array	Output field: suggestions
translate	boolean	Output field: translate
valid	boolean	Unique identifier

Output Example

{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"needsOffsetUpdate":true,"offset":43,"suggestions":["AND"],"translate":false,"valid":true}}

Get Query Suggestions V2

Offers auto-completion suggestions and syntax validation for RQL queries in Palo Alto Networks Prisma Cloud.

Endpoint

URL: iam/api/v2/suggestion

Method: POST

Input

Argument Name	Type	Required	Description
query	string	Optional	Query to validate.

Input Example

{"json_body":{"query":"config from iam where dest.cloud.type = 'AWS'"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
valid	boolean	Unique identifier
suggestions	array	Output field: suggestions
translate	boolean	Output field: translate
needsOffsetUpdate	boolean	Date value
offset	number	Output field: offset

Output Example

{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"valid":true,"suggestions":["AND"],"translate":false,"needsOffsetUpdate":true,"offset":43}}

Get Remediation

Retrieve a list of remediation actions for specified alert IDs in Palo Alto Networks Prisma Cloud.

Endpoint

URL: api/v1/permission/alert/remediation

Method: POST

Input

Argument Name	Type	Required	Description
alerts	array	Optional	List of relevant alerts.

Input Example

{"json_body":{"alerts":["I-1234","I-1235"]}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
alertIdVsCliScript	object	Unique identifier
alertIdVsCliScript.I-1234	string	Unique identifier
alertIdVsCliScript.I-1235	string	Unique identifier
cliDescription	string	Unique identifier

Output Example

{"status_code":200,"response_headers":{"Date":"Sat, 13 Jul 2024 11:00:15 GMT","Content-Type":"application/json","Transfer-Encoding":"chunked","Connection":"keep-alive","X-RateLimit-Remaining":"49","X-RateLimit-Requested-Tokens":"1","X-RateLimit-Burst-Capacity":"50","X-RateLimit-Replenish-Rate":"50","Vary":"Origin, Access-Control-Request-Method, Access-Control-Request-Headers, x-redlock...","X-Xss-Protection":"1; mode=block","Strict-Transport-Security":"max-age=31536000; includeSubDomains","X-Fra...

Get Remediation Command

Retrieve a specific remediation command for an alert by using the unique alert_id in Palo Alto Networks Prisma Cloud.

Endpoint

URL: iam/api/v2/alert/{{alert_id}}/remediation_command

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.alert_id	string	Required	The alert id.

Input Example

{"path_parameters":{"alert_id":"I-34537"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
cliCommand	string	Output field: cliCommand
cliDescription	string	Unique identifier

Output Example

{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"cliCommand":"cli command","cliDescription":"The following are CLI command is required for remediation. Successful execution ..."}}

Get Remediation Status

Retrieve remediation action statuses for assets in Palo Alto Networks Prisma Cloud using cveId, prismaId, and assetType.

Endpoint

URL: uve/api/v1/remediation/vuln-remediation-status

Method: POST

Input

Argument Name	Type	Required	Description
cveId	string	Optional	CVE ID of the vulnerability.
prismaId	string	Optional	Prisma ID allocated to the customer.
assetType	string	Optional	Asset type.
assetId	array	Optional	List of asset UAI IDs.

Input Example

{"json_body":{"cveId":"CVE-2021-44228","prismaId":"807152287759069184","assetType":"iac","assetId":["80715228775906918412312"]}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
values	array	Value for the parameter
values.prismaId	string	Unique identifier
values.unifiedAssetId	string	Unique identifier
values.assetType	string	Type of the resource
values.assetLifecycle	string	Value for the parameter
values.cveId	string	Unique identifier
values.source	string	Value for the parameter
values.remediationAction	array	Value for the parameter
values.remediationAction.action	string	Value for the parameter
values.remediationAction.status	string	Status value
values.remediationAction.actionResult	string	Value for the parameter
values.remediationAction.message	string	Value for the parameter
values.lastUpdatedTimestamp	number	Value for the parameter

Output Example

{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"values":[{}]}}

Get Saved Asset Inventory Filter

Retrieves a saved asset inventory filter by ID from Palo Alto Networks Prisma Cloud, enabling targeted asset management.

Endpoint

URL: filter/inventory/{{id}}

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.id	string	Required	Asset Inventory ID.

Input Example

{"path_parameters":{"id":"AWS_ALL_DynamoDB"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
customerId	number	Unique identifier
filterId	string	Unique identifier
name	string	Name of the resource
description	string	Output field: description
createdBy	string	Output field: createdBy
lastModifiedBy	string	Output field: lastModifiedBy
createdOn	number	Output field: createdOn
filterTarget	string	Output field: filterTarget
filters	array	Output field: filters
filters.name	string	Name of the resource
filters.value	string	Value for the parameter
filters.operator	string	Output field: filters.operator

Output Example

{"status_code":200,"response_headers":{"Date":"Mon, 08 Jul 2024 04:14:44 GMT","Content-Type":"application/json;charset=utf-8","Transfer-Encoding":"chunked","Connection":"keep-alive","Access-Control-Allow-Origin":"*","Access-Control-Allow-Headers":"x-redlock-request-id,x-redlock-auth,rl-json-rule,terraform-version,terraform-012...","Access-Control-Allow-Methods":"POST, PUT, GET, OPTIONS, DELETE, PATCH","Access-Control-Expose-Headers":"x-redlock-auth,x-redlock-request-id,x-redlock-status, x-redloc...

Get Top Impacting Vulnerabilities V2

Retrieve critical vulnerabilities with risk scores, severity, CVSS, and impacted assets from Palo Alto Networks Prisma Cloud. Requires 'life_cycle' and 'top' parameters.

Endpoint

URL: uve/api/v2/dashboard/vulnerabilities/prioritised-vuln

Method: GET

Input

Argument Name	Type	Required	Description
parameters.life_cycle	string	Required	Life Cycle stage.
parameters.top	number	Required	Number of results to be returned.

Input Example

{"parameters":{"life_cycle":"code","top":5}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
lastUpdatedDateTime	number	Time value
cve	array	Output field: cve
cve.id	string	Unique identifier
cve.cvssScore	number	Score value
cve.epssScore	number	Score value
cve.completeEpssScore	number	Score value
cve.epssScorePrevious	number	Output field: cve.epssScorePrevious
cve.severity	string	Output field: cve.severity
cve.riskFactors	array	Output field: cve.riskFactors
cve.assetsImpacted	object	Output field: cve.assetsImpacted
cve.assetsImpacted.codeCount	number	Count value
cve.assetsImpacted.buildCount	number	Count value
cve.assetsImpacted.deployCount	number	Count value
cve.assetsImpacted.runtimeCount	number	Count value
cve.assetsAtRisk	number	Output field: cve.assetsAtRisk

Output Example

{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"lastUpdatedDateTime":0,"cve":[{}]}}

Get Vulnerabilities Burndown

Retrieve vulnerability burndown data for specified asset types, life cycles, and severities in Palo Alto Networks Prisma Cloud.

Endpoint

URL: uve/api/v2/dashboard/vulnerabilities/burndown

Method: GET

Input

Argument Name	Type	Required	Description
parameters.asset_type	string	Required	Type of Asset.
parameters.life_cycle	string	Required	Life Cycle stage.
parameters.severities	string	Required	Severity.

Input Example

{"parameters":{"asset_type":"iac","life_cycle":"code","severities":"medium"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase

Output Example

{"status_code":200,"response_headers":{},"reason":"OK","json_body":[{"dayNum":0,"totalCount":0,"remediatedCount":0,"epochTimestamp":0}]}

Get Vulnerabilities by RQL

Retrieve a detailed list of vulnerabilities from Palo Alto Networks Prisma Cloud using an RQL query. Requires a 'query' in the JSON body.

Endpoint

URL: uve/api/v1/vulnerabilities/search

Method: POST

Input

Argument Name	Type	Required	Description
parameters.page_token	string	Optional	Token for pagination.
query	string	Optional	Search query.
id	string	Optional	saved search ID.

Input Example

{"parameters":{"page_token":"324234t5SFEWEFGE32412343"},"json_body":{"query":"vulnerability where age > 30 days","id":"234134345423423"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
id	string	Unique identifier
name	string	Name of the resource
description	string	Output field: description
searchType	string	Type of the resource
saved	boolean	Output field: saved
timeRange	object	Output field: timeRange
timeRange.type	string	Type of the resource
timeRange.value	string	Value for the parameter
query	string	Output field: query
data	object	Response data
data.totalRows	number	Response data
data.totalVulnerabilities	number	Response data
data.totalAssets	number	Response data
data.items	array	Response data
data.items.cveId	string	Response data
data.items.name	string	Response data
data.items.cvssScore	number	Response data
data.items.epssScore	number	Response data
data.items.epssScorePrevious	number	Response data
data.items.completeEpssScore	number	Response data
data.items.totalImpactedAssets	number	Response data
data.items.riskFactors	array	Response data
data.items.code	object	Response data

Output Example

{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"id":"string","name":"string","description":"string","searchType":"string","saved":true,"timeRange":{"type":"string","value":"string"},"query":"string","data":{"totalRows":0,"totalVulnerabilities":0,"totalAssets":0,"items":[],"nextPageToken":"string"}}}

Get Vulnerability Impact by Stage

Provides a summary of vulnerabilities by application stage in Palo Alto Networks Prisma Cloud, segmented by lifecycle and severity.

Endpoint

URL: uve/api/v1/dashboard/vulnerabilities/impact-stage

Method: GET

Input

Argument Name	Type	Required	Description
parameters.asset_type	string	Required	Type of Asset.
parameters.life_cycle	string	Required	Life Cycle stage.
parameters.severities	string	Required	Severity.

Input Example

{"parameters":{"asset_type":"iac","life_cycle":"code","severities":"medium"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
value	object	Value for the parameter
value.code	object	Value for the parameter
value.code.package	number	Value for the parameter
value.code.iac	number	Value for the parameter
value.build	object	Value for the parameter
value.run	object	Value for the parameter
value.run.serverlessFunction	number	Value for the parameter
value.run.host	number	Value for the parameter
value.run.deployedImage	number	Value for the parameter
value.deploy	object	Value for the parameter
value.deploy.registryImage	number	Value for the parameter
value.deploy.vmImage	number	Value for the parameter

Output Example

{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"value":{"code":{},"build":{},"run":{},"deploy":{}}}}

Get Vulnerability Overview V2

Provides a categorized summary of total runtime vulnerabilities by asset and remediation status in Palo Alto Networks Prisma Cloud.

Endpoint

URL: uve/api/v2/dashboard/vulnerabilities/overview

Method: GET

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
overviewSummary	object	Output field: overviewSummary
overviewSummary.totalVulnerableRuntimeAssets	object	Output field: overviewSummary.totalVulnerableRuntimeAssets
overviewSummary.totalVulnerableRuntimeAssets.totalCount	number	Count value
overviewSummary.totalVulnerableRuntimeAssets.deployedImageCount	number	Count value
overviewSummary.totalVulnerableRuntimeAssets.serverlessFunctionCount	number	Count value
overviewSummary.totalVulnerableRuntimeAssets.hostCount	number	Count value
overviewSummary.totalVulnerabilitiesinRuntime	object	Time value
overviewSummary.totalVulnerabilitiesinRuntime.totalCount	number	Count value
overviewSummary.totalVulnerabilitiesinRuntime.criticalCount	number	Count value
overviewSummary.totalVulnerabilitiesinRuntime.highCount	number	Count value
overviewSummary.totalVulnerabilitiesinRuntime.mediumCount	number	Count value
overviewSummary.totalVulnerabilitiesinRuntime.lowCount	number	Count value
overviewSummary.totalRemediatedinRuntime	object	Time value
overviewSummary.totalRemediatedinRuntime.totalCount	number	Count value
overviewSummary.totalRemediatedinRuntime.criticalCount	number	Count value
overviewSummary.totalRemediatedinRuntime.highCount	number	Count value
overviewSummary.totalRemediatedinRuntime.mediumCount	number	Count value
overviewSummary.totalRemediatedinRuntime.lowCount	number	Count value
values	array	Value for the parameter
values.lastUpdatedDateTime	number	Value for the parameter
values.totalVulnerabilityCount	number	Value for the parameter
values.totalVulnerableAsset	number	Value for the parameter
values.totalRemediationCount	number	Value for the parameter

Output Example

{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"overviewSummary":{"totalVulnerableRuntimeAssets":{},"totalVulnerabilitiesinRuntime":{},"totalRemediatedinRuntime":{}},"values":[{}]}}

Get Vulnerable Assets by CVE

Retrieve a list of assets impacted by a specified CVE ID from Palo Alto Networks Prisma Cloud, requiring the cve_id.

Endpoint

URL: uve/api/v1/dashboard/vulnerabilities/vuln-assets

Method: POST

Input

Argument Name	Type	Required	Description
query	string	Optional	Parameter for Get Vulnerable Assets by CVE
cve_id	string	Optional	Unique identifier
risk_factors	array	Optional	Parameter for Get Vulnerable Assets by CVE
sort_by	string	Optional	Parameter for Get Vulnerable Assets by CVE
asset_type	string	Optional	Type of the resource
page_offset	number	Optional	Parameter for Get Vulnerable Assets by CVE
page_size	number	Optional	Parameter for Get Vulnerable Assets by CVE
filter_suppressed	boolean	Optional	Parameter for Get Vulnerable Assets by CVE

Input Example

{"json_body":{"query":"query","cve_id":"CVE-2021-44228","risk_factors":["attack vector: network","critical severity"],"sort_by":"cvssScore","asset_type":"iac","page_offset":0,"page_size":0,"filter_suppressed":true}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
value	object	Value for the parameter
value.severity	array	Value for the parameter
value.riskFactors	array	Value for the parameter
value.serverlessFunction	object	Value for the parameter
value.serverlessFunction.count	number	Value for the parameter
value.serverlessFunction.repositorycount	number	Value for the parameter
value.serverlessFunction.fixImpact	object	Value for the parameter
value.serverlessFunction.fixImpact.percentageVulns	number	Value for the parameter
value.serverlessFunction.fixImpact.across	number	Value for the parameter
value.serverlessFunction.remediationAvailable	array	Value for the parameter
value.serverlessFunction.remediationAvailable.action	string	Value for the parameter
value.serverlessFunction.remediationAvailable.status	string	Status value
value.serverlessFunction.remediationAvailable.actionResult	object	Value for the parameter
value.serverlessFunction.remediationAvailable.message	object	Value for the parameter
value.cvssScore	number	Value for the parameter
value.cveId	string	Unique identifier
value.host	object	Value for the parameter
value.host.count	number	Value for the parameter
value.host.repositorycount	number	Value for the parameter
value.host.fixImpact	object	Value for the parameter
value.host.fixImpact.percentageVulns	number	Value for the parameter
value.host.fixImpact.across	number	Value for the parameter
value.host.remediationAvailable	array	Value for the parameter

Output Example

{"status_code":200,"response_headers":{"Date":"Sat, 13 Jul 2024 16:25:53 GMT","Content-Type":"application/json","Transfer-Encoding":"chunked","Connection":"keep-alive","X-Content-Type-Options":"nosniff","X-XSS-Protection":"1; mode=block","Cache-Control":"no-cache, no-store, max-age=0, must-revalidate","Pragma":"no-cache","Expires":"0","Strict-Transport-Security":"max-age=31536000 ; includeSubDomains","X-Frame-Options":"DENY","Vary":"Origin, Access-Control-Request-Method, Access-Control-Request-H...

Get Vulnerable Assets by RQL

Retrieve a list of assets vulnerable to specific CVEs using an RQL query in Palo Alto Networks Prisma Cloud, including asset IDs, lifecycle, and type.

Endpoint

URL: uve/api/v1/vulnerabilities/search/asset

Method: POST

Input

Argument Name	Type	Required	Description
parameters.page_token	string	Optional	Token for pagination.
query	string	Optional	Search query.
cveId	string	Optional	CVE ID.
assetLifecycle	string	Optional	Asset Lifecycle.
assetType	string	Optional	Asset type.

Input Example

{"parameters":{"page_token":"3456234532456234"},"json_body":{"query":"vulnerability where age > 30 days","cveId":"CVE-2021-44228","assetLifecycle":"code","assetType":"package"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
value	array	Value for the parameter
value.id	string	Unique identifier
value.name	string	Name of the resource
value.atRisk	boolean	Value for the parameter
value.internetExposed	boolean	Value for the parameter
nextPageToken	string	Output field: nextPageToken

Output Example

{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"value":[{}],"nextPageToken":"string"}}

Is Dismissal Note Required

Determines if a dismissal note is mandatory when dismissing an alert in Palo Alto Networks Prisma Cloud.

Endpoint

URL: /alert/dismiss/require_dismissal_note

Method: GET

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
requireDismissalNote	boolean	Output field: requireDismissalNote

Output Example

{"status_code":200,"response_headers":{"Date":"Wed, 10 Jul 2024 12:11:19 GMT","Content-Type":"application/json","Transfer-Encoding":"chunked","Connection":"keep-alive","Access-Control-Allow-Origin":"*","Access-Control-Allow-Headers":"x-redlock-request-id,x-redlock-auth,rl-json-rule,terraform-version,terraform-012...","Access-Control-Allow-Methods":"POST, PUT, GET, OPTIONS, DELETE, PATCH","Access-Control-Expose-Headers":"x-redlock-auth,x-redlock-request-id,x-redlock-status, x-redlock-fileName,Con...

List Account Group Names

Retrieve a list of account group names, their IDs, and auto-creation status from Palo Alto Networks Prisma Cloud.

Endpoint

URL: /cloud/group/name

Method: GET

Input

Argument Name	Type	Required	Description
parameters.include_auto_created	boolean	Optional	Include account groups that were automatically created during cloud onboarding.

Input Example

{"parameters":{"include_auto_created":true}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase

Output Example

{"status_code":200,"response_headers":{"Date":"Mon, 08 Jul 2024 12:56:50 GMT","Content-Type":"application/json;charset=UTF-8","Transfer-Encoding":"chunked","Connection":"keep-alive","X-RateLimit-Remaining":"39","X-RateLimit-Requested-Tokens":"1","X-RateLimit-Burst-Capacity":"40","X-RateLimit-Replenish-Rate":"40","tracer-id":"e6d3dfc7310e5d8cb9529097fb0ccf7d","X-Content-Type-Options":"nosniff","X-XSS-Protection":"0","Cache-Control":"no-cache, no-store, max-age=0, must-revalidate","Pragma":"no-cac...

List Account Group Names by Cloud Type

Retrieve account group IDs and names from Palo Alto Networks Prisma Cloud, filtered by specified cloud type.

Endpoint

URL: /cloud/group/name/{{cloud_type}}

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.cloud_type	string	Required	Cloud Type.

Input Example

{"path_parameters":{"cloud_type":"aws"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase

Output Example

{"status_code":200,"response_headers":{"Date":"Mon, 08 Jul 2024 13:30:19 GMT","Content-Type":"application/json;charset=UTF-8","Transfer-Encoding":"chunked","Connection":"keep-alive","X-RateLimit-Remaining":"4","X-RateLimit-Requested-Tokens":"1","X-RateLimit-Burst-Capacity":"5","X-RateLimit-Replenish-Rate":"5","tracer-id":"0b2c8db9ce63fd1aa372abf3419c7533","X-Content-Type-Options":"nosniff","X-XSS-Protection":"0","Cache-Control":"no-cache, no-store, max-age=0, must-revalidate","Pragma":"no-cache"...

List Account Groups

Retrieve an array of account groups the user has access to within Palo Alto Networks Prisma Cloud.

Endpoint

URL: /cloud/group

Method: GET

Input

Argument Name	Type	Required	Description
parameters.excludeCloudAccountDetails	boolean	Optional	Exclude cloud account details.

Input Example

{"parameters":{"excludeCloudAccountDetails":true}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase

Output Example

{"status_code":200,"response_headers":{"Date":"Mon, 08 Jul 2024 09:08:24 GMT","Content-Type":"application/json;charset=UTF-8","Transfer-Encoding":"chunked","Connection":"keep-alive","X-RateLimit-Remaining":"39","X-RateLimit-Requested-Tokens":"1","X-RateLimit-Burst-Capacity":"40","X-RateLimit-Replenish-Rate":"40","tracer-id":"c43e70f1ed7ee27df8f577f2b78ceb50","X-Content-Type-Options":"nosniff","X-XSS-Protection":"0","Cache-Control":"no-cache, no-store, max-age=0, must-revalidate","Pragma":"no-cac...

List Alert Counts By Policy - GET

Retrieve alert counts categorized by policy from Palo Alto Networks Prisma Cloud, with optional query filters.

Endpoint

URL: /alert/policy

Method: GET

Input

Argument Name	Type	Required	Description
parameters.alert.id	string	Optional	Alert ID.
parameters.alert.status	string	Optional	Alert status.
parameters.cloud.account	string	Optional	Cloud account.
parameters.cloud.accountId	string	Optional	Cloud account Id.
parameters.account.group	string	Optional	Account group.
parameters.cloud.type	string	Optional	Cloud type.
parameters.cloud.region	string	Optional	Cloud region.
parameters.cloud.service	string	Optional	Cloud service. - string
parameters.policy.id	string	Optional	Policy ID.
parameters.policy.name	string	Optional	Policy name.
parameters.policy.severity	string	Optional	Policy severity.
parameters.policy.label	string	Optional	Policy label.
parameters.policy.type	string	Optional	Policy type.
parameters.policy.complianceStandard	string	Optional	Policy compliance standard name.
parameters.policy.complianceRequirement	string	Optional	Policy compliance requirement name.
parameters.policy.complianceSection	string	Optional	Policy compliance section ID.
parameters.policy.remediable	string	Optional	Policy is remediable.
parameters.alertRule.name	string	Optional	Alert rule name.
parameters.resource.id	string	Optional	Resource ID.
parameters.resource.name	string	Optional	Resource name.
parameters.resource.type	string	Optional	Resource TYPE.

Input Example

{"parameters":{"alert.id":"string","alert.status":"open","cloud.account":"string","cloud.accountId":"string","account.group":"string","cloud.type":"string","cloud.region":"string","cloud.service":"string","policy.id":"string","policy.name":"string","policy.severity":"critical","policy.label":"string","policy.type":"config","policy.complianceStandard":"string","policy.complianceRequirement":"string","policy.complianceSection":"string","policy.remediable":"true","alertRule.name":"string","resource.id":"string","resource.name":"string","resource.type":"string"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase

Output Example

{"status_code":200,"response_headers":{"Date":"Tue, 09 Jul 2024 14:16:44 GMT","Content-Type":"application/json","Transfer-Encoding":"chunked","Connection":"keep-alive","X-RateLimit-Remaining":"4","X-RateLimit-Requested-Tokens":"1","X-RateLimit-Burst-Capacity":"5","X-RateLimit-Replenish-Rate":"2","Access-Control-Allow-Origin":"*","Access-Control-Allow-Headers":"x-redlock-request-id,x-redlock-auth,rl-json-rule,terraform-version,terraform-012...","Access-Control-Allow-Methods":"POST, PUT, GET, OPTI...

List Alert Counts By Policy - POST

Retrieve alert counts categorized by policy within a specified time range in Palo Alto Networks Prisma Cloud.

Endpoint

URL: /alert/policy

Method: POST

Input

Argument Name	Type	Required	Description
parameters.detailed	boolean	Optional	Return detailed alert data.
detailed	boolean	Optional	Detailed.
fields	array	Optional	Array of specific fields to return.
filters	array	Optional	Filtering parameters.
filters.name	string	Optional	Name of the resource
filters.operator	string	Optional	Parameter for List Alert Counts By Policy - POST
filters.value	string	Optional	Value for the parameter
groupBy	array	Optional	For asset or data inventory only.
limit	number	Optional	Maximum number of items to return.
offset	number	Optional	The number of items to skip before selecting items to return.
pageToken	string	Optional	Setting this pagination Token to the nextPageToken from a response object returns the next page of data.
sortBy	array	Optional	Array of sort properties.
timeRange	object	Optional	Parameter for List Alert Counts By Policy - POST
timeRange.relativeTimeType	string	Optional	Direction in which to count time.
timeRange.type	string	Optional	Type of the resource
timeRange.value	object	Required	Model for RelativeTimeDuration.
timeRange.value.amount	number	Optional	Number of time units.
timeRange.value.unit	string	Optional	Time unit.

Input Example

{"parameters":{"detailed":false},"json_body":{"detailed":true,"fields":["string"],"filters":[{"name":"string","operator":"=","value":"string"}],"groupBy":["cloud.type"],"limit":0,"offset":0,"pageToken":"string","sortBy":["id:asc","timestamp:desc"],"timeRange":{"relativeTimeType":"BACKWARD","type":"relative","value":{"amount":0,"unit":"minute"}}}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase

Output Example

{"status_code":200,"response_headers":{"Date":"Mon, 15 Jul 2024 04:53:02 GMT","Content-Type":"application/json","Transfer-Encoding":"chunked","Connection":"keep-alive","X-RateLimit-Remaining":"4","X-RateLimit-Requested-Tokens":"1","X-RateLimit-Burst-Capacity":"5","X-RateLimit-Replenish-Rate":"2","Access-Control-Allow-Origin":"*","Access-Control-Allow-Headers":"x-redlock-request-id,x-redlock-auth,rl-json-rule,terraform-version,terraform-012...","Access-Control-Allow-Methods":"POST, PUT, GET, OPTI...

List Alert Filter Autocomplete Suggestions

Retrieve available autocomplete suggestions for an alert filter key in Palo Alto Networks Prisma Cloud.

Endpoint

URL: /filter/alert/suggest

Method: POST

Input

Argument Name	Type	Required	Description
filterName	string	Optional	Filter name.
query	string	Optional	Case-insensitive fuzzy search autocomplete filter.

Input Example

{"json_body":{"filterName":"string","query":"string"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
completeParameters	array	Parameters for the List Alert Filter Autocomplete Suggestions action
completeParameters.name	string	Parameters for the List Alert Filter Autocomplete Suggestions action
completeParameters.operator	string	Parameters for the List Alert Filter Autocomplete Suggestions action
completeParameters.value	string	Parameters for the List Alert Filter Autocomplete Suggestions action
links	string	Output field: links
needsOffsetUpdate	boolean	Date value
offset	number	Output field: offset
queryRemainder	string	Output field: queryRemainder
suggestions	array	Output field: suggestions
translate	boolean	Output field: translate
valid	boolean	Unique identifier

Output Example

{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"completeParameters":[{}],"links":"string","needsOffsetUpdate":true,"offset":0,"queryRemainder":"string","suggestions":["string"],"translate":true,"valid":true}}

List Alert Filters

Retrieve a list of available policy filters from Palo Alto Networks Prisma Cloud.

Endpoint

URL: /filter/alert/suggest

Method: GET

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
policy.name	object	Name of the resource
policy.name.options	array	Name of the resource
policy.name.options.file_name	string	Name of the resource
policy.name.options.file	string	Name of the resource
policy.name.staticFilter	boolean	Name of the resource
policy.type	object	Type of the resource
policy.type.staticFilter	boolean	Type of the resource
policy.label	object	Output field: policy.label
policy.label.options	array	Output field: policy.label.options
policy.label.options.file_name	string	Name of the resource
policy.label.options.file	string	Output field: policy.label.options.file
policy.label.staticFilter	boolean	Output field: policy.label.staticFilter
policy.severity	object	Output field: policy.severity
policy.severity.staticFilter	boolean	Output field: policy.severity.staticFilter
alertRule.name	object	Name of the resource
alertRule.name.options	array	Name of the resource
alertRule.name.options.file_name	string	Name of the resource
alertRule.name.options.file	string	Name of the resource
alertRule.name.staticFilter	boolean	Name of the resource
resource.id	object	Unique identifier
resource.id.options	array	Unique identifier
resource.id.options.file_name	string	Unique identifier
resource.id.options.file	string	Unique identifier

Output Example

{"status_code":200,"response_headers":{"Date":"Mon, 08 Jul 2024 15:20:26 GMT","Content-Type":"application/json;charset=utf-8","Transfer-Encoding":"chunked","Connection":"keep-alive","Access-Control-Allow-Origin":"*","Access-Control-Allow-Headers":"x-redlock-request-id,x-redlock-auth,rl-json-rule,terraform-version,terraform-012...","Access-Control-Allow-Methods":"POST, PUT, GET, OPTIONS, DELETE, PATCH","Access-Control-Expose-Headers":"x-redlock-auth,x-redlock-request-id,x-redlock-status, x-redloc...

List Alert Remediation Commands

Generates a list of specific remediation commands for alerts and policies in Palo Alto Networks Prisma Cloud, requiring a filter.

Endpoint

URL: /alert/remediation

Method: POST

Input

Argument Name	Type	Required	Description
alerts	array	Optional	List of alert IDs. One or more alert IDs associated with a single policy are required if no policies are specified.
filter	object	Optional	Model for Filter.
filter.detailed	boolean	Optional	Detailed.
filter.fields	array	Optional	Array of specific fields to return.
filter.filters	array	Optional	Filtering parameters.
filter.filters.name	string	Optional	Name.
filter.filters.operator	string	Optional	Operator.
filter.filters.value	string	Optional	Value.
filter.groupBy	array	Optional	For asset or data inventory only.
filter.limit	number	Optional	Maximum number of items to return.
filter.offset	number	Optional	The number of items to skip before selecting items to return.
filter.pageToken	string	Optional	Setting this pagination Token to the nextPageToken from a response object returns the next page of data.
filter.sortBy	array	Optional	Array of sort properties.
filter.timeRange	object	Required	Parameter for List Alert Remediation Commands
filter.timeRange.relativeTimeType	string	Optional	Direction in which to count time.
filter.timeRange.type	string	Optional	Type of the resource
filter.timeRange.value	object	Required	Model for RelativeTimeDuration.
filter.timeRange.value.amount	number	Optional	Number of time units.
filter.timeRange.value.unit	string	Optional	Time unit.
policies	array	Optional	List of policy IDs. A single policy ID is required if no alerts are specified.

Input Example

{"json_body":{"alerts":["string"],"filter":{"detailed":true,"fields":["string"],"filters":[{"name":"string","operator":"=","value":"string"}],"groupBy":["string"],"limit":0,"offset":0,"pageToken":"string","sortBy":["string"],"timeRange":{"relativeTimeType":"BACKWARD","type":"relative","value":{"amount":0,"unit":"minute"}}},"policies":["string"]}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
alertIdVsCliScript	object	Unique identifier
cliDescription	string	Unique identifier
cliScript	string	Output field: cliScript
scriptImpact	string	Output field: scriptImpact

Output Example

{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"alertIdVsCliScript":{},"cliDescription":"string","cliScript":"string","scriptImpact":"string"}}

List Alert Rules V2

Retrieve all alert rules available to your user role in Palo Alto Networks Prisma Cloud, excluding open alerts count.

Endpoint

URL: /v2/alert/rule

Method: GET

Input

Argument Name	Type	Required	Description
parameters.enabled	boolean	Optional	Process only enabled alert rules.

Input Example

{"parameters":{"enabled":true}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase

Output Example

{"status_code":200,"response_headers":{"Date":"Mon, 08 Jul 2024 14:08:08 GMT","Content-Type":"application/json;charset=utf-8","Transfer-Encoding":"chunked","Connection":"keep-alive","Access-Control-Allow-Origin":"*","Access-Control-Allow-Headers":"x-redlock-request-id,x-redlock-auth,rl-json-rule,terraform-version,terraform-012...","Access-Control-Allow-Methods":"POST, PUT, GET, OPTIONS, DELETE, PATCH","Access-Control-Expose-Headers":"x-redlock-auth,x-redlock-request-id,x-redlock-status, x-redloc...

List Alerts V2 - GET

Retrieve a paginated list of alerts based on time filters from the Prisma Cloud platform, requiring timeType, timeAmount, and timeUnit parameters.

Endpoint

URL: /v2/alert

Method: GET

Input

Argument Name	Type	Required	Description
parameters.timeType	string	Required	Time Type.
parameters.timeAmount	string	Required	Number of timeUnits.
parameters.timeUnit	string	Required	Time Unit
parameters.detailed	boolean	Required	Return detailed alert data.
parameters.fields	string	Optional	Array of specific fields to return.
parameters.sortBy	string	Optional	Response object property by which to sort response list.
parameters.limit	number	Optional	The maximum number of items that will be returned in one response.
parameters.pageToken	string	Optional	Token that identifies the required page of data.
parameters.alert.id	string	Optional	Alert ID
parameters.alert.status	string	Optional	Alert status.
parameters.cloud.account	string	Optional	Cloud account.
parameters.cloud.accountId	string	Optional	Cloud account Id.
parameters.account.group	string	Optional	Account group.
parameters.cloud.type	string	Optional	Cloud type.
parameters.cloud.region	string	Optional	Cloud region.
parameters.cloud.service	string	Optional	Cloud service.
parameters.policy.id	string	Optional	Policy ID.
parameters.policy.name	string	Optional	Policy name.
parameters.policy.severity	string	Optional	Policy severity.
parameters.policy.label	string	Optional	Policy label.
parameters.policy.type	string	Optional	Policy type.
parameters.policy.complianceStandard	string	Optional	Policy compliance standard name.
parameters.policy.complianceRequirement	string	Optional	Policy compliance requirement name.
parameters.policy.complianceSection	string	Optional	Policy compliance section ID.
parameters.policy.remediable	string	Optional	Policy is remediable.

Input Example

{"parameters":{"timeType":"relative","timeAmount":"5","timeUnit":"minute","detailed":true,"fields":"alert.id","sortBy":"sortBy=id:desc&sortBy=firstseen:asc,lastseen:desc","limit":10000,"pageToken":"","alert.id":"","alert.status":"open","cloud.account":"","cloud.accountId":"","account.group":"","cloud.type":"","cloud.region":"","cloud.service":"","policy.id":"","policy.name":"","policy.severity":"critical","policy.label":"","policy.type":"config","policy.complianceStandard":"","policy.complianceRequirement":"","policy.complianceSection":"","policy.remediable":"true","alertRule.name":"","resource.id":"","resource.name":"","resource.type":""}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
dynamicColumns	array	Output field: dynamicColumns
infoMsg	string	Output field: infoMsg
items	array	Output field: items
items.alertAdditionalInfo	object	Output field: items.alertAdditionalInfo
items.alertAttribution	object	Output field: items.alertAttribution
items.alertCount	number	Count value
items.alertRules	array	Output field: items.alertRules
items.alertRules.file_name	string	Name of the resource
items.alertRules.file	string	Output field: items.alertRules.file
items.alertTime	number	Time value
items.appMetadata	array	Response data
items.connectionDetails	array	Output field: items.connectionDetails
items.connectionDetails.file_name	string	Name of the resource
items.connectionDetails.file	string	Output field: items.connectionDetails.file
items.dismissalDuration	string	Output field: items.dismissalDuration
items.dismissalNote	string	Output field: items.dismissalNote
items.dismissalUntilTs	number	Output field: items.dismissalUntilTs
items.dismissedBy	string	Output field: items.dismissedBy
items.eventOccurred	number	Output field: items.eventOccurred
items.firstSeen	number	Output field: items.firstSeen
items.history	array	Output field: items.history
items.history.file_name	string	Name of the resource
items.history.file	string	Output field: items.history.file

Output Example

{"status_code":200,"response_headers":{"Date":"Mon, 15 Jul 2024 04:32:38 GMT","Content-Type":"application/json","Transfer-Encoding":"chunked","Connection":"keep-alive","X-RateLimit-Remaining":"9","X-RateLimit-Requested-Tokens":"1","X-RateLimit-Burst-Capacity":"10","X-RateLimit-Replenish-Rate":"3","Access-Control-Allow-Origin":"*","Access-Control-Allow-Headers":"x-redlock-request-id,x-redlock-auth,rl-json-rule,terraform-version,terraform-012...","Access-Control-Allow-Methods":"POST, PUT, GET, OPT...

List Alerts V2 - POST

Retrieve a paginated list of Prisma Cloud alerts within a specified time range. Requires 'timeRange' in the JSON body.

Endpoint

URL: /v2/alert

Method: POST

Input

Argument Name	Type	Required	Description
parameters.detailed	boolean	Optional	Return detailed alert data.
detailed	boolean	Optional	Detailed.
fields	array	Optional	Array of specific fields to return.
filters	array	Optional	Filtering parameters.
filters.name	string	Optional	Name of the resource
filters.operator	string	Optional	Parameter for List Alerts V2 - POST
filters.value	string	Optional	Value for the parameter
groupBy	array	Optional	For asset or data inventory only.
limit	number	Optional	Maximum number of items to return.
offset	number	Optional	The number of items to skip before selecting items to return.
pageToken	string	Optional	Setting this pagination Token to the nextPageToken from a response object returns the next page of data.
sortBy	array	Optional	Array of sort properties.
timeRange	object	Optional	Parameter for List Alerts V2 - POST
timeRange.relativeTimeType	string	Optional	Direction in which to count time.
timeRange.type	string	Optional	Type of the resource
timeRange.value	object	Required	Model for RelativeTimeDuration.
timeRange.value.amount	number	Optional	Number of time units.
timeRange.value.unit	string	Optional	Time unit

Input Example

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
dynamicColumns	array	Output field: dynamicColumns
infoMsg	string	Output field: infoMsg
items	array	Output field: items
items.alertAdditionalInfo	object	Output field: items.alertAdditionalInfo
items.alertAttribution	object	Output field: items.alertAttribution
items.alertAttribution.attributionEventList	array	Output field: items.alertAttribution.attributionEventList
items.alertAttribution.attributionEventList.file_name	string	Name of the resource
items.alertAttribution.attributionEventList.file	string	Output field: items.alertAttribution.attributionEventList.file
items.alertAttribution.resourceCreatedBy	string	Output field: items.alertAttribution.resourceCreatedBy
items.alertAttribution.resourceCreatedOn	number	Output field: items.alertAttribution.resourceCreatedOn
items.alertCount	number	Count value
items.alertRules	array	Output field: items.alertRules
items.alertRules.file_name	string	Name of the resource
items.alertRules.file	string	Output field: items.alertRules.file
items.alertTime	number	Time value
items.appMetadata	array	Response data
items.connectionDetails	array	Output field: items.connectionDetails
items.connectionDetails.file_name	string	Name of the resource
items.connectionDetails.file	string	Output field: items.connectionDetails.file
items.dismissalDuration	string	Output field: items.dismissalDuration
items.dismissalNote	string	Output field: items.dismissalNote
items.dismissalUntilTs	number	Output field: items.dismissalUntilTs
items.dismissedBy	string	Output field: items.dismissedBy

Output Example

{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"dynamicColumns":["string"],"infoMsg":"string","items":[{}],"nextPageToken":"string","sortAllowedColumns":["string"],"totalRows":0}}

List Inventory Dashboard Filter

Retrieve autocomplete suggestions for inventory dashboard filters in Palo Alto Networks Prisma Cloud, requiring a 'filterName'.

Endpoint

URL: /filter/v2/inventory/suggest

Method: POST

Input

Argument Name	Type	Required	Description
filterName	string	Optional	Filter name.
query	string	Optional	Case-insensitive fuzzy search autocomplete filter. Includes only items that contain the query as a substring.

Input Example

{"json_body":{"filterName":"cloud.service","query":"string"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
valid	boolean	Unique identifier
offset	number	Output field: offset
suggestions	array	Output field: suggestions
translate	boolean	Output field: translate
needsOffsetUpdate	boolean	Date value
queryRemainder	string	Output field: queryRemainder
completeParameters	array	Parameters for the List Inventory Dashboard Filter action
completeParameters.file_name	string	Parameters for the List Inventory Dashboard Filter action
completeParameters.file	string	Parameters for the List Inventory Dashboard Filter action

Output Example

{"status_code":200,"response_headers":{"Date":"Fri, 12 Jul 2024 05:41:28 GMT","Content-Type":"application/json;charset=utf-8","Transfer-Encoding":"chunked","Connection":"keep-alive","Access-Control-Allow-Origin":"*","Access-Control-Allow-Headers":"x-redlock-request-id,x-redlock-auth,rl-json-rule,terraform-version,terraform-012...","Access-Control-Allow-Methods":"POST, PUT, GET, OPTIONS, DELETE, PATCH","Access-Control-Expose-Headers":"x-redlock-auth,x-redlock-request-id,x-redlock-status, x-redloc...

List Inventory Filters V2

Retrieve an object listing supported asset inventory filters with default options in Palo Alto Networks Prisma Cloud.

Endpoint

URL: /filter/v2/inventory/suggest

Method: GET

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
account.group	object	Output field: account.group
account.group.options	array	Output field: account.group.options
account.group.options.file_name	string	Name of the resource
account.group.options.file	string	Output field: account.group.options.file
account.group.staticFilter	boolean	Output field: account.group.staticFilter
cloud.account	object	Count value
cloud.account.options	array	Output field: cloud.account.options
cloud.account.options.file_name	string	Name of the resource
cloud.account.options.file	string	Output field: cloud.account.options.file
cloud.account.staticFilter	boolean	Output field: cloud.account.staticFilter
cloud.region	object	Output field: cloud.region
cloud.region.options	array	Output field: cloud.region.options
cloud.region.staticFilter	boolean	Output field: cloud.region.staticFilter
cloud.service	object	Output field: cloud.service
cloud.service.options	array	Output field: cloud.service.options
cloud.service.options.file_name	string	Name of the resource
cloud.service.options.file	string	Output field: cloud.service.options.file
cloud.service.staticFilter	boolean	Output field: cloud.service.staticFilter
resource.type	object	Type of the resource
resource.type.options	array	Type of the resource
resource.type.options.file_name	string	Name of the resource
resource.type.options.file	string	Type of the resource
resource.type.staticFilter	boolean	Type of the resource

Output Example

{"status_code":200,"response_headers":{"Date":"Fri, 12 Jul 2024 05:23:03 GMT","Content-Type":"application/json;charset=utf-8","Transfer-Encoding":"chunked","Connection":"keep-alive","Access-Control-Allow-Origin":"*","Access-Control-Allow-Headers":"x-redlock-request-id,x-redlock-auth,rl-json-rule,terraform-version,terraform-012...","Access-Control-Allow-Methods":"POST, PUT, GET, OPTIONS, DELETE, PATCH","Access-Control-Expose-Headers":"x-redlock-auth,x-redlock-request-id,x-redlock-status, x-redloc...

List Saved Asset Inventory Filters

Retrieve a list of saved asset inventory filters from Palo Alto Networks Prisma Cloud.

Endpoint

URL: /filter/inventory

Method: GET

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase

Output Example

{"status_code":200,"response_headers":{"Date":"Fri, 12 Jul 2024 05:37:46 GMT","Content-Type":"application/json;charset=utf-8","Transfer-Encoding":"chunked","Connection":"keep-alive","Access-Control-Allow-Origin":"*","Access-Control-Allow-Headers":"x-redlock-request-id,x-redlock-auth,rl-json-rule,terraform-version,terraform-012...","Access-Control-Allow-Methods":"POST, PUT, GET, OPTIONS, DELETE, PATCH","Access-Control-Expose-Headers":"x-redlock-auth,x-redlock-request-id,x-redlock-status, x-redloc...

List Top N assets

Retrieves the top N assets with the highest alert counts over the last 30 days, filtered by swimlane type and time range.

Endpoint

URL: api/v1/top-assets/{{swimlane_type}}

Method: POST

Input

Argument Name	Type	Required	Description
path_parameters.swimlane_type	string	Required	Type of the swimlane.
filters	array	Optional	List of filters that can be applied for the API.
filters.name	string	Optional	FilterType.
filters.operator	string	Optional	Only allowed operator for the filter is '='.
filters.value	string	Optional	Value for the applied filter.
timeRange	object	Optional	Parameter for List Top N assets
timeRange.type	string	Optional	Type of time ranges.
timeRange.value	object	Optional	Absolute Time containing start and end time. Maximum time range supported is last 30 days.
timeRange.value.startTime	number	Optional	Value for the parameter
timeRange.value.endTime	number	Optional	Value for the parameter
limit	number	Optional	Limit on the number of resources requested. supported values >= 1 and <= 10

Input Example

{"json_body":{"filters":[{"name":"account.group","operator":"=","value":"test"}],"timeRange":{"type":"absolute","value":{"startTime":0,"endTime":0}}},"path_parameters":{"swimlane_type":"misconfigurations"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
value	array	Value for the parameter
value.externalResourceId	string	Unique identifier
value.resourceName	string	Name of the resource
value.cloudName	string	Name of the resource
value.serviceName	string	Name of the resource
value.accountName	string	Name of the resource
value.alertCount	number	Value for the parameter
value.criticalAlertCount	number	Value for the parameter
value.highAlertCount	number	Value for the parameter
startTime	number	Time value
endTime	number	Time value
swimlaneType	string	Type of the resource
lastScanTs	number	Output field: lastScanTs

Output Example

{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"value":[{}],"startTime":0,"endTime":0,"swimlaneType":"misconfigurations","lastScanTs":0}}

List Top Policies

Retrieve the top policies with the most alerts from Palo Alto Networks Prisma Cloud, specifying time range, accounts, and swimlane type.

Endpoint

URL: api/v1/top-policies/{{swimlane_type}}

Method: POST

Input

Argument Name	Type	Required	Description
path_parameters.swimlane_type	string	Required	Type of the swimlane.
filters	array	Optional	List of filters that can be applied for the API.
filters.name	string	Optional	FilterType.
filters.operator	string	Optional	Only allowed operator for the filter is '='.
filters.value	string	Optional	Value for the applied filter.
timeRange	object	Optional	Parameter for List Top Policies
timeRange.type	string	Optional	Type of time ranges.
timeRange.value	object	Optional	Absolute Time containing start and end time. Maximum time range supported is last 30 days.
timeRange.value.startTime	number	Optional	Value for the parameter
timeRange.value.endTime	number	Optional	Value for the parameter
limit	number	Optional	Limit on the number of resources requested. supported values >= 1 and <= 10

Input Example

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
value	array	Value for the parameter
value.policyId	string	Unique identifier
value.policyName	string	Name of the resource
value.policyType	string	Type of the resource
value.severity	string	Value for the parameter
value.alertCount	number	Value for the parameter
value.policyDescription	string	Value for the parameter
startTime	number	Time value
endTime	number	Time value
swimlaneType	string	Type of the resource
lastScanTs	number	Output field: lastScanTs

Output Example

{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"value":[{}],"startTime":0,"endTime":0,"swimlaneType":"misconfigurations","lastScanTs":0}}

List Top Vulnerabilities

Retrieve the top 5 hosts and images with the most vulnerabilities from Palo Alto Networks Prisma Cloud, filterable by type, time, accounts, and groups.

Endpoint

URL: v1/top-vulnerabilities

Method: POST

Input

Argument Name	Type	Required	Description
parameters.limit	number	Optional	Parameters for the List Top Vulnerabilities action
parameters.type	string	Optional	Parameters for the List Top Vulnerabilities action
filters	array	Optional	List of filters that can be applied for the API.
filters.name	string	Optional	FilterType.
filters.operator	string	Optional	Only allowed operator for the filter is '='.
filters.value	string	Optional	Value for the applied filter.
timeRange	object	Optional	Parameter for List Top Vulnerabilities
timeRange.type	string	Optional	Type of time ranges.
timeRange.value	object	Optional	Absolute Time containing start and end time. Maximum time range supported is last 30 days.
timeRange.value.startTime	number	Optional	Value for the parameter
timeRange.value.endTime	number	Optional	Value for the parameter

Input Example

{"parameters":{"limit":5,"type":"type"},"json_body":{"filters":[{"name":"account.group","operator":"=","value":"test"}],"timeRange":{"type":"absolute","value":{"startTime":0,"endTime":0}}}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
value	array	Value for the parameter
value.unifiedAssetId	string	Unique identifier
value.resourceName	string	Name of the resource
value.numCriticalVulnerabilities	number	Value for the parameter
value.numHighVulnerabilities	number	Value for the parameter
value.totalVulnerabilities	number	Value for the parameter
date	string	Date value
ts	number	Output field: ts
lastScanTs	number	Output field: lastScanTs

Output Example

{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"value":[{}],"date":"11-04-2024","ts":0,"lastScanTs":0}}

List Total Alerts Based on the Severity

Retrieve a count of Prisma Cloud alerts by severity over a specified time range, requiring account and group details.

Endpoint

URL: api/v1/summary/{{swimlane_type}}

Method: POST

Input

Argument Name	Type	Required	Description
path_parameters.swimlane_type	string	Required	Type of the swimlane.
filters	array	Optional	List of filters that can be applied for the API.
filters.name	string	Optional	FilterType.
filters.operator	string	Optional	Only allowed operator for the filter is '='.
filters.value	string	Optional	Value for the applied filter.
timeRange	object	Optional	Parameter for List Total Alerts Based on the Severity
timeRange.type	string	Optional	Type of time ranges.
timeRange.value	object	Optional	Absolute Time containing start and end time. Maximum time range supported is last 30 days.
timeRange.value.startTime	number	Optional	Value for the parameter
timeRange.value.endTime	number	Optional	Value for the parameter

Input Example

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
value	object	Value for the parameter
value.totalCriticalAlerts	number	Value for the parameter
value.totalHighAlerts	number	Value for the parameter
startTime	number	Time value
endTime	number	Time value
swimlaneType	string	Type of the resource
lastScanTs	number	Output field: lastScanTs

Output Example

{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"value":{"totalCriticalAlerts":0,"totalHighAlerts":0},"startTime":0,"endTime":0,"swimlaneType":"misconfigurations","lastScanTs":0}}

List Total Vulnerable Images and Hosts

Retrieve a summary of all vulnerable images and hosts within specified time, accounts, and account groups in Palo Alto Networks Prisma Cloud.

Endpoint

URL: v1/vulnerabilities/summary

Method: POST

Input

Argument Name	Type	Required	Description
parameters.prismaId	string	Optional	Parameters for the List Total Vulnerable Images and Hosts action
filters	array	Optional	List of filters that can be applied for the API.
filters.name	string	Optional	FilterType.
filters.operator	string	Optional	Only allowed operator for the filter is '='.
filters.value	string	Optional	Value for the applied filter.
timeRange	object	Optional	Parameter for List Total Vulnerable Images and Hosts
timeRange.type	string	Optional	Type of time ranges.
timeRange.value	object	Optional	Absolute Time containing start and end time. Maximum time range supported is last 30 days.
timeRange.value.startTime	number	Optional	Value for the parameter
timeRange.value.endTime	number	Optional	Value for the parameter

Input Example

{"parameters":{"prismaId":"807152287759069184"},"json_body":{"filters":[{"name":"account.group","operator":"=","value":"test"}],"timeRange":{"type":"absolute","value":{"startTime":0,"endTime":0}}}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
value	object	Value for the parameter
value.images	object	Value for the parameter
value.images.totalCriticalVulnerabilities	number	Value for the parameter
value.images.totalHighVulnerabilities	number	Value for the parameter
value.hosts	object	Value for the parameter
value.hosts.totalCriticalVulnerabilities	number	Value for the parameter
value.hosts.totalHighVulnerabilities	number	Value for the parameter
value.totalBySeverity	object	Value for the parameter
value.totalBySeverity.totalCriticalVulnerabilities	number	Value for the parameter
value.totalBySeverity.totalHighVulnerabilities	number	Value for the parameter
date	string	Date value
ts	number	Output field: ts
lastScanTs	number	Output field: lastScanTs

Output Example

{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"value":{"images":{},"hosts":{},"totalBySeverity":{}},"date":"11-04-2024","ts":0,"lastScanTs":0}}

Remediate Alert

Remediates a specified alert in Palo Alto Networks Prisma Cloud when associated with a remediable policy, requiring an alert ID.

Endpoint

URL: /alert/remediation/{{id}}

Method: PATCH

Input

Argument Name	Type	Required	Description
parameters.findingId	string	Optional	Parameters for the Remediate Alert action
path_parameters.id	string	Required	Alert ID.

Input Example

{"parameters":{"findingId":"string"},"path_parameters":{"id":"cbb0bcc7-7835-4e24-a73d-f2ca65c8f8d7"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase

Output Example

{"status_code":200,"response_headers":{},"reason":"OK","json_body":{}}

Reopen Alerts

Reopens dismissed or snoozed alerts in Palo Alto Networks Prisma Cloud using specified filters and time range.

Endpoint

URL: /alert/reopen

Method: POST

Input

Argument Name	Type	Required	Description
alerts	array	Optional	Alert IDs.
dismissalNote	string	Optional	Reason for dismissal.
dismissalTimeRange	object	Optional	Parameter for Reopen Alerts
dismissalTimeRange.type	string	Required	Type of the resource
dismissalTimeRange.relativeTimeType	string	Optional	Direction in which to count time.
dismissalTimeRange.value	object	Required	Model for RelativeTimeDuration.
dismissalTimeRange.value.amount	number	Optional	Number of time units.
dismissalTimeRange.value.unit	string	Optional	Time unit
filter	object	Optional	Model for Filter
filter.detailed	boolean	Optional	Detailed.
filter.fields	array	Optional	Array of specific fields to return.
filter.filters	array	Optional	Filtering parameters.
filter.filters.name	string	Optional	Name.
filter.filters.operator	string	Optional	Operator.
filter.filters.value	string	Optional	Value.
filter.groupBy	array	Optional	For asset or data inventory only.
filter.limit	number	Optional	Maximum number of items to return.
filter.offset	number	Optional	The number of items to skip before selecting items to return.
filter.pageToken	string	Optional	Setting this pagination Token to the nextPageToken from a response object returns the next page of data.
filter.sortBy	array	Optional	Array of sort properties.
filter.timeRange	object	Required	Parameter for Reopen Alerts
filter.timeRange.relativeTimeType	string	Optional	Direction in which to count time.
filter.timeRange.type	string	Optional	Type of the resource
filter.timeRange.value	object	Required	Model for RelativeTimeDuration.
filter.timeRange.value.amount	number	Optional	Number of time units.

Input Example

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase

Output Example

{"status_code":200,"response_headers":{},"reason":"OK","json_body":{}}

Save Asset Inventory Filter

Saves a specified asset inventory filter in Palo Alto Networks Prisma Cloud with a defined time range.

Endpoint

URL: /filter/inventory

Method: POST

Input

Argument Name	Type	Required	Description
detailed	boolean	Optional	Detailed.
fields	array	Optional	Array of specific fields to return.
filters	array	Optional	Filtering parameters.
filters.name	string	Optional	Name.
filters.operator	string	Optional	Operator.
filters.value	string	Optional	Value.
groupBy	array	Optional	For asset or data inventory only. Group returned items by cloud.type, cloud.service, cloud.region, cloud.account, and/or resource.type
limit	number	Optional	Maximum number of items to return.
offset	number	Optional	The number of items to skip before selecting items to return.
pageToken	string	Optional	Setting this pagination Token to the nextPageToken from a response object returns the next page of data.
sortBy	array	Optional	Array of sort properties.
timeRange	object	Optional	Parameter for Save Asset Inventory Filter
timeRange.relativeTimeType	string	Optional	Direction in which to count time.
timeRange.type	string	Optional	Type of the resource
timeRange.value	object	Required	Value for the parameter
timeRange.value.amount	number	Optional	Number of time units.
timeRange.value.unit	string	Optional	Time unit

Input Example

{"json_body":{"detailed":true,"fields":["string"],"filters":[{"name":"string","operator":"tag:yaml.org,2002:value =","value":"string"}],"groupBy":["cloud.type"],"limit":0,"offset":0,"pageToken":"string","sortBy":["id:asc","timestamp:desc"],"timeRange":{"relativeTimeType":"BACKWARD","type":"relative","value":{"amount":0,"unit":"minute"}}}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase

Output Example

{"status_code":200,"response_headers":{},"reason":"OK","json_body":{}}

Submit Alert CSV Generation Job

Submits a job to generate a downloadable CSV file of alerts within the specified time range. Returns job ID and status.

Endpoint

URL: /alert/csv

Method: POST

Input

Argument Name	Type	Required	Description
parameters.detailed	boolean	Optional	Return detailed alert data.
detailed	boolean	Optional	Detailed.
fields	array	Optional	Array of specific fields to return.
filters	array	Optional	Filtering parameters.
filters.name	string	Optional	Name.
filters.operator	string	Optional	Operator.
filters.value	string	Optional	Value.
groupBy	array	Optional	For asset or data inventory only.
limit	number	Optional	Maximum number of items to return.
offset	number	Optional	The number of items to skip before selecting items to return.
pageToken	string	Optional	Setting this pagination Token to the nextPageToken from a response object returns the next page of data.
sortBy	array	Optional	Array of sort properties.
timeRange	object	Optional	Parameter for Submit Alert CSV Generation Job
timeRange.relativeTimeType	string	Optional	Direction in which to count time.
timeRange.type	string	Optional	Type of the resource
timeRange.value	object	Required	Model for RelativeTimeDuration.
timeRange.value.amount	number	Optional	Number of time units.
timeRange.value.unit	string	Optional	Time unit.

Input Example

{"parameters":{"detailed":"true"},"json_body":{"detailed":true,"fields":["string"],"filters":[{"name":"string","operator":"=","value":"string"}],"groupBy":["cloud.type"],"limit":0,"offset":0,"pageToken":"string","sortBy":["id:asc","timestamp:desc"],"timeRange":{"relativeTimeType":"BACKWARD","type":"relative","value":{"amount":0,"unit":"minute"}}}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
id	string	Unique identifier
customerId	number	Unique identifier
status	string	Status value
createdBy	string	Output field: createdBy
createdOn	number	Output field: createdOn
statusUri	string	Status value

Output Example

{"status_code":200,"response_headers":{"Date":"Thu, 11 Jul 2024 04:51:46 GMT","Content-Type":"application/json;charset=utf-8","Transfer-Encoding":"chunked","Connection":"keep-alive","Access-Control-Allow-Origin":"*","Access-Control-Allow-Headers":"x-redlock-request-id,x-redlock-auth,rl-json-rule,terraform-version,terraform-012...","Access-Control-Allow-Methods":"POST, PUT, GET, OPTIONS, DELETE, PATCH","Access-Control-Expose-Headers":"x-redlock-auth,x-redlock-request-id,x-redlock-status, x-redloc...

Submit Job to List Alerts

Submits a job to Palo Alto Networks Prisma Cloud to generate a list of alerts within a specified time range, providing a job ID and status.

Endpoint

URL: /alert/jobs

Method: POST

Input

Argument Name	Type	Required	Description
detailed	boolean	Optional	Detailed.
fields	array	Optional	Array of specific fields to return.
filters	array	Optional	Filtering parameters.
filters.name	string	Optional	Name of the resource
filters.operator	string	Optional	Parameter for Submit Job to List Alerts
filters.value	string	Optional	Value for the parameter
groupBy	array	Optional	For asset or data inventory only.
limit	number	Optional	Maximum number of items to return.
offset	number	Optional	The number of items to skip before selecting items to return.
pageToken	string	Optional	Setting this pagination Token to the nextPageToken from a response object returns the next page of data.
sortBy	array	Optional	Array of sort properties.
timeRange	object	Optional	Parameter for Submit Job to List Alerts
timeRange.relativeTimeType	string	Optional	Direction in which to count time.
timeRange.type	string	Optional	Type of the resource
timeRange.value	object	Required	Model for RelativeTimeDuration.
timeRange.value.amount	number	Optional	Number of time units.
timeRange.value.unit	string	Optional	Time unit.

Input Example

{"json_body":{"detailed":true,"fields":["string"],"filters":[{"name":"string","operator":"=","value":"string"}],"groupBy":["string"],"limit":0,"offset":0,"pageToken":"string","sortBy":["string"],"timeRange":{"relativeTimeType":"BACKWARD","type":"relative","value":{"amount":0,"unit":"minute"}}}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
id	string	Unique identifier
customerId	number	Unique identifier
status	string	Status value
createdBy	string	Output field: createdBy
createdOn	number	Output field: createdOn
statusUri	string	Status value

Output Example

{"status_code":200,"response_headers":{"Date":"Thu, 11 Jul 2024 04:15:19 GMT","Content-Type":"application/json;charset=utf-8","Transfer-Encoding":"chunked","Connection":"keep-alive","Access-Control-Allow-Origin":"*","Access-Control-Allow-Headers":"x-redlock-request-id,x-redlock-auth,rl-json-rule,terraform-version,terraform-012...","Access-Control-Allow-Methods":"POST, PUT, GET, OPTIONS, DELETE, PATCH","Access-Control-Expose-Headers":"x-redlock-auth,x-redlock-request-id,x-redlock-status, x-redloc...

Submit Job to List Alerts By Policy

Submits a job to Prisma Cloud to generate alerts grouped by policy violation, returning job ID and status. Requires a 'timeRange' in the JSON body.

Endpoint

URL: /alert/policy/jobs

Method: POST

Input

Argument Name	Type	Required	Description
detailed	boolean	Optional	Detailed.
fields	array	Optional	Array of specific fields to return.
filters	array	Optional	Filtering parameters.
filters.name	string	Optional	Name of the resource
filters.operator	string	Optional	Parameter for Submit Job to List Alerts By Policy
filters.value	string	Optional	Value for the parameter
groupBy	array	Optional	For asset or data inventory only.
limit	number	Optional	Maximum number of items to return.
offset	number	Optional	The number of items to skip before selecting items to return.
pageToken	string	Optional	Setting this pagination Token to the nextPageToken from a response object returns the next page of data.
sortBy	array	Optional	Array of sort properties.
timeRange	object	Optional	Parameter for Submit Job to List Alerts By Policy
timeRange.relativeTimeType	string	Optional	Direction in which to count time.
timeRange.type	string	Optional	Type of the resource
timeRange.value	object	Required	Model for RelativeTimeDuration.
timeRange.value.amount	number	Optional	Number of time units.
timeRange.value.unit	string	Optional	Time unit.

Input Example

{"json_body":{"detailed":true,"fields":["string"],"filters":[{"name":"string","operator":"=","value":"string"}],"groupBy":["cloud.type"],"limit":0,"offset":0,"pageToken":"string","sortBy":["id:asc","timestamp:desc"],"timeRange":{"relativeTimeType":"BACKWARD","type":"relative","value":{"amount":0,"unit":"minute"}}}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
id	string	Unique identifier
customerId	number	Unique identifier
status	string	Status value
createdBy	string	Output field: createdBy
createdOn	number	Output field: createdOn
statusUri	string	Status value

Output Example

{"status_code":200,"response_headers":{"Date":"Thu, 11 Jul 2024 05:42:59 GMT","Content-Type":"application/json","Transfer-Encoding":"chunked","Connection":"keep-alive","Access-Control-Allow-Origin":"*","Access-Control-Allow-Headers":"x-redlock-request-id,x-redlock-auth,rl-json-rule,terraform-version,terraform-012...","Access-Control-Allow-Methods":"POST, PUT, GET, OPTIONS, DELETE, PATCH","Access-Control-Expose-Headers":"x-redlock-auth,x-redlock-request-id,x-redlock-status, x-redlock-fileName,Con...

Update Account Group

Updates an existing account group in Palo Alto Networks Prisma Cloud using the specified 'id', 'accountIds', and 'name'.

Endpoint

URL: /cloud/group/{{id}}

Method: PUT

Input

Argument Name	Type	Required	Description
path_parameters.id	string	Required	Account Group ID.
accountIds	array	Optional	Cloud Account IDs.
cloudAccountInfos	array	Optional	Cloud account details of account associated with this account group.
cloudAccountInfos.accountId	string	Optional	Account ID.
cloudAccountInfos.cloudType	string	Optional	Cloud Type.
cloudAccountInfos.lastModifiedBy	string	Optional	Last Modified By.
description	string	Optional	Description.
name	string	Optional	Name.

Input Example

{"json_body":{"accountIds":[""],"cloudAccountInfos":[{"accountId":"string","cloudType":"AWS","lastModifiedBy":"string"}],"description":"string","name":"string"},"path_parameters":{"id":"59c8256b-835b-4868-9d3e-0c679a2cf421"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase

Output Example

{"status_code":200,"response_headers":{},"reason":"OK","json_body":{}}

Update Dismissal Note Requirement

Enforces or waives the requirement for a dismissal note when an alert is dismissed in Palo Alto Networks Prisma Cloud.

Endpoint

URL: /alert/dismiss/require_dismissal_note

Method: PUT

Input

Argument Name	Type	Required	Description
requireDismissalNote	boolean	Optional	Require Dismissal Note.

Input Example

{"json_body":{"requireDismissalNote":true}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
response_text	string	Output field: response_text

Output Example

{"status_code":200,"response_headers":{"Date":"Wed, 10 Jul 2024 11:52:44 GMT","Content-Length":"0","Connection":"keep-alive","Access-Control-Allow-Origin":"*","Access-Control-Allow-Headers":"x-redlock-request-id,x-redlock-auth,rl-json-rule,terraform-version,terraform-012...","Access-Control-Allow-Methods":"POST, PUT, GET, OPTIONS, DELETE, PATCH","Access-Control-Expose-Headers":"x-redlock-auth,x-redlock-request-id,x-redlock-status, x-redlock-fileName,Content...","Access-Control-Max-Age":"60","Str...

Update Saved Asset Inventory Filter

Updates an existing saved asset inventory filter in Palo Alto Networks Prisma Cloud with a specific ID and time range.

Endpoint

URL: filter/inventory/{{id}}

Method: PUT

Input

Argument Name	Type	Required	Description
path_parameters.id	string	Required	Asset Inventory ID.
detailed	boolean	Optional	Detailed.
fields	array	Optional	Array of specific fields to return.
filters	array	Optional	Parameter for Update Saved Asset Inventory Filter
filters.name	string	Optional	Name.
filters.value	string	Optional	Value for the parameter
filters.operator	string	Optional	Operator.
groupBy	array	Optional	For asset or data inventory only. Group returned items by cloud.type, cloud.service, cloud.region, cloud.account, and/or resource.type.
limit	number	Optional	Maximum number of items to return. When data is paginated, maximum number of items per page.The maximum cannot exceed 10,000.
offset	number	Optional	The number of items to skip before selecting items to return.
pageToken	string	Optional	Setting this pagination Token to the nextPageToken from a response object returns the next page of data.
sortBy	array	Optional	Array of sort properties. Append :asc or :desc to the key to sort by ascending or descending order respectively.
timeRange	object	Optional	Parameter for Update Saved Asset Inventory Filter
timeRange.relativeTimeType	string	Optional	Direction in which to count time.
timeRange.type	string	Optional	Type of the resource
timeRange.value	object	Required	Value for the parameter
timeRange.value.amount	number	Optional	Number of time units.
timeRange.value.unit	string	Optional	Time unit.

Input Example

{"json_body":{"detailed":true,"fields":["cloud.type"],"filters":[{"name":"cloud.service","value":"DynamoDB","operator":"="}],"groupBy":["cloud.type"],"limit":0,"offset":0,"pageToken":"++fwefvsfcasbds23451452","sortBy":["cloud.type"],"timeRange":{"relativeTimeType":"BACKWARD","type":"relative","value":{"amount":0,"unit":"minute"}}},"path_parameters":{"id":"AWS_ALL_DynamoDB"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase

Output Example

{"status_code":200,"response_headers":{"Date":"Mon, 08 Jul 2024 05:22:32 GMT","Content-Length":"0","Connection":"keep-alive","Access-Control-Allow-Origin":"*","Access-Control-Allow-Headers":"x-redlock-request-id,x-redlock-auth,rl-json-rule,terraform-version,terraform-012...","Access-Control-Allow-Methods":"POST, PUT, GET, OPTIONS, DELETE, PATCH","Access-Control-Expose-Headers":"x-redlock-auth,x-redlock-request-id,x-redlock-status, x-redlock-fileName,Content...","Access-Control-Max-Age":"60","Str...

Response Headers

Header	Description	Example
Access-Control-Allow-Headers	HTTP response header: Access-Control-Allow-Headers	x-redlock-request-id,x-redlock-auth,rl-json-rule,terraform-version,terraform-012-parameters,rl-variable-file-names,rl-parameters,Content-Type,x-b3-traceid,x-b3-spanid,sentry-trace
Access-Control-Allow-Methods	HTTP response header: Access-Control-Allow-Methods	POST, PUT, GET, OPTIONS, DELETE, PATCH
Access-Control-Allow-Origin	HTTP response header: Access-Control-Allow-Origin	*
Access-Control-Expose-Headers	HTTP response header: Access-Control-Expose-Headers	x-redlock-auth,x-redlock-request-id,x-redlock-status, x-redlock-fileName,Content-Disposition,x-record-count
Access-Control-Max-Age	HTTP response header: Access-Control-Max-Age	60
Cache-Control	Directives for caching mechanisms	no-cache, no-store, max-age=0, must-revalidate
Connection	HTTP response header: Connection	keep-alive
Content-Encoding	HTTP response header: Content-Encoding	gzip
Content-Length	The length of the response body in bytes	22
Content-Security-Policy	HTTP response header: Content-Security-Policy	default-src 'self'
Content-Type	The media type of the resource	application/json
Date	The date and time at which the message was originated	Wed, 10 Jul 2024 11:52:44 GMT
Expires	The date/time after which the response is considered stale	0
Pragma	HTTP response header: Pragma	no-cache
Referrer-Policy	HTTP response header: Referrer-Policy	no-referrer
Strict-Transport-Security	HTTP response header: Strict-Transport-Security	max-age=31536000; includeSubDomains
tracer-id	HTTP response header: tracer-id	e6d3dfc7310e5d8cb9529097fb0ccf7d
Transfer-Encoding	HTTP response header: Transfer-Encoding	chunked
Vary	HTTP response header: Vary	Origin, Access-Control-Request-Method, Access-Control-Request-Headers, x-redlock-auth, Origin
X-Content-Type-Options	HTTP response header: X-Content-Type-Options	nosniff
X-Download-Options	HTTP response header: X-Download-Options	noopen
X-Frame-Options	HTTP response header: X-Frame-Options	DENY
X-Permitted-Cross-Domain-Policies	HTTP response header: X-Permitted-Cross-Domain-Policies	none
X-RateLimit-Burst-Capacity	HTTP response header: X-RateLimit-Burst-Capacity	5
X-RateLimit-Remaining	The number of requests remaining in the current rate limit window	99
X-RateLimit-Replenish-Rate	HTTP response header: X-RateLimit-Replenish-Rate	50
X-RateLimit-Requested-Tokens	HTTP response header: X-RateLimit-Requested-Tokens	1
x-redlock-request-id	HTTP response header: x-redlock-request-id	2aa8e79f6a024809857ca34323dfb8e3
x-redlock-status	HTTP response header: x-redlock-status	[{"i18nKey":"missing_filter_target","severity":"error","subject":null}]
X-Xss-Protection	HTTP response header: X-Xss-Protection	1; mode=block