--- title: Palo Alto Networks Prisma Cloud Workload Protect slug: connectors/palo-alto-networks-prisma-cloud-workload-protect docTags: createdAt: 2026-06-09T16:29:58.412Z --- The Prisma Cloud Workload Protect connector enables seamless integration with Palo Alto Networks' cloud-native security platform, allowing for automated security operations and threat management. Palo Alto Networks Prisma Cloud Workload Protect offers a comprehensive cloud-native security platform that provides full lifecycle security and full stack protection for multi-cloud environments. By integrating with Swimlane Turbine, users can automate the management of user groups, scan hosts and images for vulnerabilities, and enforce security policies across their cloud workloads. This connector streamlines security operations by enabling rapid response to threats and ensuring consistent security posture management. ## Prerequisites To utilize the Palo Alto Networks Prisma Cloud Workload Protect connector, ensure you have the following prerequisites: - Username and Password authentication with the following parameters: - URL: Endpoint URL for Prisma Cloud API access - Username: Your Prisma Cloud account username - Password: Your Prisma Cloud account password - Version: The version of the Prisma Cloud API you are targeting ## Capabilities This Connector provides the following capabilities: - Add Group - Delete Group by ID - Download App Embedded Defender - Download Host Scan Results - Download Image Scan Results - Download Serverless Layer Bundle - Download VM Image Scan Results - Get Agentless Scan Progress - Get All CI Image Scan Results - Get Compliance Stats - Get Container Scan Results - Get Defender Names - Get Defenders Summary - Get Deployed Defenders - Get Group Names *... and so on* ## Notes - For more information on Palo Alto Prisma Cloud is found at: [Palo Alto Prisma Cloud Main Site](https://pan.dev/prisma-cloud/api/) - [Palo Alto Prisma Cloud API Documentation](https://pan.dev/prisma-cloud/api/cwpp/) # Configurations ## Palo Alto Prisma Cloud Compute Asset Authenticates using Username and Password. ### Configuration Parameters | **Parameter** | **Description** | **Type** | **Required** | | ------------- | ---------------------------------- | -------- | ------------ | | url | A URL to the target host. | string | Required | | username | Username | string | Required | | password | Password | string | Required | | version | Version | string | Required | | verify\_ssl | Verify SSL certificate | boolean | Optional | | http\_proxy | A proxy to route requests through. | string | Optional | # Actions ## Add Group Creates a new user group within Palo Alto Networks Prisma Cloud Workload Protect using the provided JSON body. ### Endpoint - **URL:** `/groups` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------- | -------- | ------------ | ------------------------------------------------------------------------ | | `_id` | string | Optional | Group name. | | `groupId` | string | Optional | Group identifier in the Azure SAML identification process. | | `groupName` | string | Optional | Group name. | | `lastModified` | string | Optional | Datetime when the group was created or last modified. | | `ldapGroup` | boolean | Optional | Indicates if the group is an LDAP group (true) or not (false). | | `oauthGroup` | boolean | Optional | Indicates if the group is an OAuth group (true) or not (false) | | `oidcGroup` | boolean | Optional | Indicates if the group is an OpenID Connect group (true) or not (false). | | `owner` | string | Optional | User who created or modified the group. | | `permissions` | array | Optional | Permissions is a list of permissions | | `permissions.collections` | array | Optional | List of collections the user can access. | | `permissions.project` | string | Optional | Names of projects which the user can access. | | `role` | string | Optional | Role of the group. | | `samlGroup` | boolean | Optional | Indicates if the group is a SAML group (true) or not (false). | | `user` | array | Optional | Users in the group. | | `user.username` | string | Optional | Name of a user. | ### Input Example `{"json_body":{"_id":"1759baf","groupId":"","groupName":"","lastModified":"2024-06-14T05:48:06.114Z","ldapGroup":true,"oauthGroup":true,"oidcGroup":true,"owner":"","permissions":[{"collections":[""],"project":""}],"role":"","samlGroup":true,"user":[{"username":""}]}}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | ------------------------------------ | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `success` | boolean | Whether the operation was successful | ### Output Example `{"status_code":200,"response_headers":{"Date":"Wed, 12 Jun 2024 09:40:11 GMT","Content-Type":"application/json;charset=UTF-8","Transfer-Encoding":"chunked","Connection":"keep-alive"},"reason":"OK","json_body":{"success":true}}` ## Delete Group by ID Removes a specified group from Palo Alto Networks Prisma Cloud Workload Protect using the unique ID provided. ### Endpoint - **URL:** `/groups/{{id}}` - **Method:** `DELETE` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------- | -------- | ------------ | -------------------------------------------- | | `path_parameters.id` | string | Required | Parameters for the Delete Group by ID action | ### Input Example `{"path_parameters":{"id":"e89f1d5adf"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `status` | string | Status value | ### Output Example `{"status_code":200,"response_headers":{"Date":"Wed, 12 Jun 2024 09:40:11 GMT","Content-Type":"application/json;charset=UTF-8","Transfer-Encoding":"chunked","Connection":"keep-alive"},"reason":"OK","json_body":{"status":"Deleted"}}` ## Download App Embedded Defender Generates and provides the Palo Alto Networks Prisma Cloud embedded defender bundle for user download. ### Endpoint - **URL:** `/images/twistlock_defender_app_embedded.tar.gz` - **Method:** `GET` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `status` | string | Status value | ### Output Example `{"status_code":200,"response_headers":{"Date":"Wed, 12 Jun 2024 09:40:11 GMT","Content-Type":"application/json;charset=UTF-8","Transfer-Encoding":"chunked","Connection":"keep-alive"},"reason":"OK","json_body":{"status":"Downloaded."}}` ## Download Host Scan Results Download detailed host scan reports from Palo Alto Networks Prisma Cloud Workload Protection for comprehensive security insights. ### Endpoint - **URL:** `/hosts/download` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------------- | -------- | ------------ | ------------------------------------------------------------------------------------------------------------------------------------------ | | `parameters.offset` | number | Optional | Offsets the result to a specific report count. Offset starts from 0. | | `parameters.limit` | number | Optional | Limit is the amount to fix. | | `parameters.sort` | string | Optional | Sorts the result using a key. | | `parameters.reverse` | boolean | Optional | Sorts the result in reverse order. | | `parameters.hostname` | array | Optional | Filters the result based on hostnames. | | `parameters.distro` | array | Optional | Filters the result based on OS distribution names. | | `parameters.compact` | boolean | Optional | Provides the minimal image data. Information about vulnerabilities, compliance, and extended image metadata are skipped. Default is false. | | `parameters.clusters` | array | Optional | Filters the result based on cluster names. | | `parameters.complianceIDs` | array | Optional | Filters the result based on compliance IDs. | | `parameters.complianceRuleName` | string | Optional | Filters the result based on applied compliance rule name. | | `parameters.agentless` | boolean | Optional | Retrieves the host names that were scanned by the agentless scanner. | | `parameters.csa` | boolean | Optional | Filters only images scanned by CSA. | | `parameters.stopped` | boolean | Optional | Retrieves the host names that were skipped during an agentless scan. Default is false. | | `parameters.normalizedSeverity` | boolean | Optional | Retrieves the result in the normalized form of low, medium, high, and critical based on vulnerability's severity level. Default is false. | | `parameters.uaiID` | string | Optional | Filters results by uaiID. | | `parameters.issueType` | string | Optional | Filters results by issue type. | ### Input Example `{"parameters":{"offset":0,"limit":100,"sort":"","reverse":false,"hostname":[""],"distro":[""],"compact":false,"clusters":[""],"complianceIDs":[0],"complianceRuleName":"","agentless":false,"csa":false,"stopped":false,"normalizedSeverity":false,"uaiID":"","issueType":""}}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `file` | array | Output field: file | ### Output Example `{"file":{"file_data":"string","filename":"Example Name"}}` ## Download Image Scan Results Download detailed CSV reports of image scans from Palo Alto Networks Prisma Cloud Workload Protection. ### Endpoint - **URL:** `/images/download` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------------- | -------- | ------------ | ------------------------------------------------------------------------------------------------------------------------------------------------- | | `parameters.offset` | number | Optional | Offsets the result to a specific report count. Offset starts from 0. | | `parameters.limit` | number | Optional | Limit is the amount to fix. | | `parameters.sort` | string | Optional | Sorts the result using a key. | | `parameters.reverse` | boolean | Optional | Sorts the result in reverse order. | | `parameters.id` | array | Optional | Filters the result based on image IDs. | | `parameters.hostname` | array | Optional | Filters the result based on hostnames. | | `parameters.repository` | array | Optional | Filters the result based on image repository names. | | `parameters.registry` | array | Optional | Filters the result based on image registry names. | | `parameters.fields` | array | Optional | List of fields to retrieve. | | `parameters.name` | array | Optional | Filters the result based on image names. | | `parameters.layers` | boolean | Optional | Indicates whether the CVEs are mapped to a specific image layer. Default is false. | | `parameters.filterBaseImage` | boolean | Optional | Indicates whether to filter the base image for vulnerabilities. Requires predefined base images that have already been scanned. Default is false. | | `parameters.compact` | boolean | Optional | Provides the minimal image data. Information about vulnerabilities, compliance, and extended image metadata are skipped. Default is false | | `parameters.trustStatuses` | array | Optional | Filters the result based on whether an image is trusted or not trusted by a trusted image policy. | | `parameters.clusters` | array | Optional | Filters the result based on cluster names. | | `parameters.complianceIDs` | array | Optional | Filters the result by compliance IDs. | | `parameters.complianceRuleName` | string | Optional | Filters the result based on applied compliance rule name. | | `parameters.appEmbedded` | boolean | Optional | Filters the result based on whether the images are scanned by App-Embedded Defenders. Default is false. | | `parameters.normalizedSeverity` | boolean | Optional | Retrieves the result in the normalized form of low, medium, high, and critical based on vulnerability's severity level. Default is false. | | `parameters.agentless` | boolean | Optional | Indicates whether to retrieve host names that are scanned by agentless scanner. Default is false. | | `parameters.csa` | boolean | Optional | Filters only images scanned by CSA. | | `parameters.uaiID` | string | Optional | Filters results by uaiID. | | `parameters.issueType` | string | Optional | Filters results by issue type. | ### Input Example `{"parameters":{"offset":0,"limit":100,"sort":"","reverse":false,"id":["sha256:abd4f451ddb707c8e68a36d695456a515cdd6f9581b7a8348a380030a6fd7689"],"hostname":[""],"repository":[""],"registry":[""],"fields":[""],"name":[""],"layers":false,"filterBaseImage":false,"compact":false,"trustStatuses":[""],"clusters":[""],"complianceIDs":[0],"complianceRuleName":"","appEmbedded":false,"normalizedSeverity":false,"agentless":false,"csa":false,"uaiID":"","issueType":""}}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `file` | array | Output field: file | ### Output Example `{"file":{"file_data":"string","filename":"Example Name"}}` ## Download Serverless Layer Bundle Retrieves a ZIP file with the Defender runtime for serverless apps from Palo Alto Networks Prisma Cloud, requiring a JSON body input. ### Endpoint - **URL:** `/images/twistlock_defender_layer.zip` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------ | -------- | ------------ | ------------------------------------------------------------ | | `nodeJSModuleType` | array | Optional | NodeJSModuleType is the type of a NodeJS module. | | `provider` | array | Optional | CloudProvider specifies the cloud provider name | | `proxyCA` | string | Optional | ProxyCA is the proxy’s CA certificate for Defender to trust. | | `runtime` | array | Optional | This represents the runtime type of the serverless function. | ### Input Example `{"json_body":{"nodeJSModuleType":["commonjs","ecmascript"],"provider":["aws","azure","others"],"proxyCA":"","runtime":["python","python3.6","python3.7","python3.8","python3.9","dotnetcore2.1","dotnetcore3.1","dotnet6","java","ruby","ruby2.7"]}}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `file` | array | Output field: file | ### Output Example `{"file":{"file_data":"string","filename":"Example Name"}}` ## Download VM Image Scan Results Retrieve CSV-formatted scan reports for all VM images from Palo Alto Networks Prisma Cloud Workload Protection. ### Endpoint - **URL:** `/vms/download` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------------- | -------- | ------------ | ----------------------------------------------------------------------------------------------------------------------------------------- | | `parameters.offset` | number | Optional | Offsets the result to a specific report count. Offset starts from 0. | | `parameters.limit` | number | Optional | Limit is the amount to fix. | | `parameters.sort` | string | Optional | Sorts the result using a key. | | `parameters.reverse` | boolean | Optional | Sorts the result in reverse order. | | `parameters.id` | array | Optional | Filters the result based on VM IDs. | | `parameters.name` | array | Optional | Filters the result based on image names. | | `parameters.credential` | array | Optional | Filters the result based on cloud credentials. | | `parameters.distro` | array | Optional | Filters the result based on OS distribution names. | | `parameters.release` | array | Optional | Filters the result based on release versions. | | `parameters.imageType` | array | Optional | Filters the result based on cloud image types. Use marketplace, managed, or gallery for Microsoft Azure. | | `parameters.complianceIDs` | array | Optional | Filters the result based on compliance IDs. | | `parameters.complianceRuleName` | string | Optional | Filters the result based on applied compliance rule name. | | `parameters.normalizedSeverity` | boolean | Optional | Retrieves the result in the normalized form of low, medium, high, and critical based on vulnerability's severity level. Default is false. | | `parameters.issueType` | string | Optional | Filters results by issue type. | ### Input Example `{"parameters":{"offset":0,"limit":100,"sort":"","reverse":false,"id":[""],"name":[""],"credential":[""],"distro":[""],"release":[""],"imageType":[""],"complianceIDs":[0],"complianceRuleName":"","normalizedSeverity":false,"issueType":""}}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `file` | array | Output field: file | ### Output Example `{"file":{"file_data":"string","filename":"Example Name"}}` ## Get Agentless Scan Progress Displays the progress of agentless vulnerability and compliance scans in Palo Alto Networks Prisma Cloud. ### Endpoint - **URL:** `/agentless/progress` - **Method:** `GET` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | ### Output Example `{"status_code":200,"response_headers":{"Date":"Wed, 12 Jun 2024 09:40:11 GMT","Content-Type":"application/json;charset=UTF-8","Transfer-Encoding":"chunked","Connection":"keep-alive"},"reason":"OK","json_body":[{"aisInitialScanInProgress":true,"aisOnDemandScanInProgress":true,"discovery":true,"error":"string","hostname":"string","id":"string","onDemand":true,"scanTime":"2024-06-14T05:48:06.188Z","scanned":0,"title":"string","total":0,"type":[]}]}` ## Get All CI Image Scan Results Retrieve comprehensive CI image scan reports from Palo Alto Prisma Cloud, encompassing Jenkins plugin and twistcli scan data. ### Endpoint - **URL:** `/scans` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ---------------------------- | -------- | ------------ | ------------------------------------------------------------------------------------------------------------------------------------------------- | | `parameters.offset` | number | Optional | Offsets the result to a specific report count. Offset starts from 0. | | `parameters.limit` | number | Optional | Limit is the amount to fix. | | `parameters.sort` | string | Optional | Sorts the result using a key. | | `parameters.reverse` | boolean | Optional | Sorts the result in reverse order. | | `parameters._id` | string | Optional | Scan ID used in the image layers fetch. | | `parameters.jobName` | array | Optional | Jenkins job name. | | `parameters.type` | array | Optional | Scan type. | | `parameters.pass` | boolean | Optional | Indicates whether to filter on passed scans (true) or not (false). | | `parameters.build` | string | Optional | Build number. | | `parameters.imageID` | string | Optional | Image ID of scanned image. | | `parameters.layers` | boolean | Optional | Indicates if CVEs are mapped to image layer (true) or not (false). | | `parameters.from` | string | Optional | Filters results by start datetime. Based on scan time. | | `parameters.to` | string | Optional | Filters results by end datetime. Based on scan time. | | `parameters.fields` | array | Optional | List of fields to retrieve. | | `parameters.filterBaseImage` | boolean | Optional | Indicates if base image vulnerabilities are to be filtered (true) or not (false). Requires predefined base images that have already been scanned. | | `parameters.uaiID` | string | Optional | Filters results by uaiID. | | `parameters.issueType` | string | Optional | Filters results by issue type. | ### Input Example `{"parameters":{"offset":0,"limit":100,"sort":"","reverse":false,"_id":"","jobName":[""],"type":[""],"pass":false,"build":"","imageID":"","layers":false,"from":"2024-06-14T05:48:06.625Z","to":"2024-06-14T05:48:06.625Z","fields":[""],"filterBaseImage":false,"uaiID":"","issueType":""}}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | ### Output Example `{"status_code":200,"response_headers":{"Date":"Wed, 12 Jun 2024 09:40:11 GMT","Content-Type":"application/json;charset=UTF-8","Transfer-Encoding":"chunked","Connection":"keep-alive"},"reason":"OK","json_body":[{"_id":"string","build":"string"}]}` ## Get Compliance Stats Retrieve compliance statistics from Palo Alto Networks Prisma Cloud Workload Protect to assess security posture. ### Endpoint - **URL:** `/stats/compliance` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------ | -------- | ------------ | --------------------------------------------------------------------------------------------------------------------------- | | `parameters.collections` | array | Optional | Scopes query by collection. | | `parameters.accountIDs` | array | Optional | Scopes query by account ID. | | `parameters.ruleName` | string | Optional | Filters results by rule name. | | `parameters.policyType` | string | Optional | Filters results by policy type. Used to further scope queries because rule names do not need to be unique between policies. | | `parameters.category` | string | Optional | Filters results by category. For example, a benchmark or resource type. | | `parameters.template` | string | Optional | Filters results by compliance template. | ### Input Example `{"parameters":{"collections":[""],"accountIDs":[""],"ruleName":"","policyType":"","category":"","template":""}}` ### Output | **Parameter** | **Type** | **Description** | | ----------------------------- | -------- | ----------------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `categories` | array | Output field: categories | | `categories.failed` | number | Output field: categories.failed | | `categories.name` | array | Name of the resource | | `categories.total` | number | Output field: categories.total | | `daily` | array | Output field: daily | | `daily._id` | string | Unique identifier | | `daily.distribution` | object | Output field: daily.distribution | | `daily.distribution.critical` | number | Output field: daily.distribution.critical | | `daily.distribution.high` | number | Output field: daily.distribution.high | | `daily.distribution.low` | number | Output field: daily.distribution.low | | `daily.distribution.medium` | number | Output field: daily.distribution.medium | | `daily.distribution.total` | number | Output field: daily.distribution.total | | `daily.modified` | string | Output field: daily.modified | | `ids` | array | Unique identifier | | `ids.benchmarkID` | string | Unique identifier | | `ids.category` | array | Unique identifier | | `ids.description` | string | Unique identifier | | `ids.failed` | number | Unique identifier | | `ids.id` | number | Unique identifier | | `ids.severity` | string | Unique identifier | | `ids.templateTitle` | string | Unique identifier | | `ids.total` | number | Unique identifier | | `ids.type` | array | Unique identifier | ### Output Example `{"status_code":200,"response_headers":{"Date":"Wed, 12 Jun 2024 09:40:11 GMT","Content-Type":"application/json;charset=UTF-8","Transfer-Encoding":"chunked","Connection":"keep-alive"},"reason":"OK","json_body":{"categories":[{}],"daily":[{}],"ids":[{}],"rules":[{}],"templates":[{}]}}` ## Get Container Scan Results Retrieve detailed container scan reports from Palo Alto Networks Prisma Cloud Workload Protection. ### Endpoint - **URL:** `/containers` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------------- | -------- | ------------ | ---------------------------------------------------------------------------------------------------- | | `parameters.offset` | number | Optional | Offsets the result to a specific report count. Offset starts from 0. | | `parameters.limit` | number | Optional | Limit is the amount to fix. | | `parameters.sort` | string | Optional | Sorts the result using a key. | | `parameters.reverse` | boolean | Optional | Sorts the result in reverse order. | | `parameters.hostname` | array | Optional | Hosts is used to filter containers by host. | | `parameters.image` | array | Optional | Images is used to filter containers by image name. | | `parameters.imageId` | array | Optional | ImageIDs is used to filter containers by image ids. | | `parameters.id` | array | Optional | IDs is used to filter container by container ID. | | `parameters.profileId` | array | Optional | ProfileIDs is used to filter container by runtime profile ID. | | `parameters.namespaces` | array | Optional | Namespaces are the namespaces to filter. | | `parameters.fields` | array | Optional | Fields are used to fetch specific container field. | | `parameters.firewallSupported` | boolean | Optional | FirewallSupported is used to fetch containers with app firewall supported. | | `parameters.clusters` | array | Optional | Clusters is used to filter containers by cluster name. | | `parameters.complianceIDs` | array | Optional | ComplianceIDs is used to filter containers by compliance IDs. | | `parameters.complianceRuleName` | string | Optional | ComplianceRuleName is used to filter containers by applied compliance rule name. | | `parameters.agentless` | boolean | Optional | Agentless indicates that we should return only containers that were scanned by an agentless scanner. | | `parameters.csa` | boolean | Optional | CSA indicates that we should return only containers that were scanned by CSA. | | `parameters.collections` | string | Optional | Collections IDs. | ### Input Example `{"parameters":{"offset":0,"limit":100,"sort":"","reverse":false,"hostname":[""],"image":[""],"imageId":[""],"id":[""],"profileId":[""],"namespaces":[""],"fields":[""],"firewallSupported":false,"clusters":[""],"complianceIDs":[1759],"complianceRuleName":"","agentless":false,"csa":false,"collections":"abK2938"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | ### Output Example `{"status_code":200,"response_headers":{"Date":"Wed, 12 Jun 2024 09:40:11 GMT","Content-Type":"application/json;charset=UTF-8","Transfer-Encoding":"chunked","Connection":"keep-alive"},"reason":"OK","json_body":[{"_id":"string","agentless":true,"agentlessScanID":0,"ais":true,"collections":[],"csa":true,"firewallProtection":{},"hostname":"string","info":{},"runtimeEnabled":true,"scanTime":"2024-06-14T05:48:06.267Z"}]}` ## Get Defender Names Retrieve a list of Defender hostnames from Palo Alto Networks Prisma Cloud Workload Protection. ### Endpoint - **URL:** `/defenders/names` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------------------- | -------- | ------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------- | | `parameters.offset` | number | Optional | Offsets the result to a specific report count. Offset starts from 0. | | `parameters.limit` | number | Optional | Limit is the amount to fix. | | `parameters.sort` | string | Optional | Sorts the result using a key. | | `parameters.reverse` | boolean | Optional | Sorts the result in reverse order. | | `parameters.hostname` | string | Optional | Hostname is a name of a specific Defender to retrieve. | | `parameters.role` | array | Optional | Roles are the defender api.Roles to filter. | | `parameters.connected` | boolean | Optional | Indicates whether to return only connected Defenders (true) or disconnected Defenders (false). | | `parameters.type` | array | Optional | Indicates the Defender types to return (e.g., docker, dockerWindows, cri, etc). | | `parameters.latest` | boolean | Optional | Indicates whether to return a list of Defenders that are running the latest version of Prisma Cloud (true) or defenders with older versions (false). | | `parameters.supportedVersion` | boolean | Optional | SupportedVersion indicates only Defenders of supported versions should be fetched. | | `parameters.cluster` | array | Optional | Scopes the query by cluster name. | | `parameters.tasClusterIDs` | array | Optional | Scopes the query by TAS cluster IDs. | | `parameters.tasBlobstoreScanner` | boolean | Optional | Scopes the query by TAS blobstore scanning only Defenders (true) or TAS full coverage Defenders (false). | | `parameters.tasFoundations` | array | Optional | Scopes the query by TAS foundations. | | `parameters.usingOldCA` | boolean | Optional | Scopes the query to defenders which are using old certificate. | | `parameters.usingExpiredCA` | boolean | Optional | Scopes the query to defenders which are using expired certificate. | | `parameters.isARM64` | boolean | Optional | Scopes the query by provider type Indicates whether to return only defenders running on ARM64 architecture. | | `parameters.isVPCObserver` | boolean | Optional | Indicates whether to return only defenders running as VPC Observer. | ### Input Example `{"parameters":{"offset":0,"limit":100,"sort":"","reverse":false,"hostname":"","role":[""],"connected":false,"type":[""],"latest":false,"supportedVersion":false,"cluster":[""],"tasClusterIDs":[""],"tasBlobstoreScanner":false,"tasFoundations":[""],"usingOldCA":false,"usingExpiredCA":false,"isARM64":false,"isVPCObserver":false}}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | ### Output Example `{"status_code":200,"response_headers":{"Date":"Wed, 12 Jun 2024 09:40:11 GMT","Content-Type":"application/json;charset=UTF-8","Transfer-Encoding":"chunked","Connection":"keep-alive"},"reason":"OK","json_body":["string"]}` ## Get Defenders Summary Retrieve a summary count of Defenders across categories in Palo Alto Networks Prisma Cloud Workload Protection. ### Endpoint - **URL:** `/defenders/summary` - **Method:** `GET` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | ### Output Example `{"status_code":200,"response_headers":{"Date":"Wed, 12 Jun 2024 09:40:11 GMT","Content-Type":"application/json;charset=UTF-8","Transfer-Encoding":"chunked","Connection":"keep-alive"},"reason":"OK","json_body":[{"category":[],"connected":0,"deployed":0,"licensed":0}]}` ## Get Deployed Defenders Retrieve a list of all deployed Defenders in the Palo Alto Networks Prisma Cloud Workload Protection environment. ### Endpoint - **URL:** `/defenders` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------------------- | -------- | ------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------- | | `parameters.offset` | number | Optional | Offsets the result to a specific report count. Offset starts from 0. | | `parameters.limit` | number | Optional | Limit is the amount to fix. | | `parameters.sort` | string | Optional | Sorts the result using a key. | | `parameters.reverse` | boolean | Optional | Sorts the result in reverse order. | | `parameters.hostname` | string | Optional | Hostname is a name of a specific Defender to retrieve | | `parameters.role` | array | Optional | Roles are the defender api.Roles to filter. | | `parameters.connected` | boolean | Optional | Indicates whether to return only connected Defenders (true) or disconnected Defenders (false). | | `parameters.type` | array | Optional | Indicates the Defender types to return (e.g., docker, dockerWindows, cri, etc). | | `parameters.latest` | boolean | Optional | Indicates whether to return a list of Defenders that are running the latest version of Prisma Cloud (true) or defenders with older versions (false). | | `parameters.supportedVersion` | boolean | Optional | SupportedVersion indicates only Defenders of supported versions should be fetched. | | `parameters.cluster` | array | Optional | Scopes the query by cluster name. | | `parameters.tasClusterIDs` | array | Optional | Scopes the query by TAS Cluster IDs. | | `parameters.tasBlobstoreScanner` | boolean | Optional | Scopes the query by TAS blobstore scanning only Defenders (true) or TAS full coverage Defenders (false). | | `parameters.tasFoundations` | array | Optional | Scopes the query by TAS foundations. | | `parameters.usingOldCA` | boolean | Optional | Scopes the query to defenders which are using old certificate. | | `parameters.usingExpiredCA` | boolean | Optional | Scopes the query to defenders which are using expired certificate. | | `parameters.isARM64` | boolean | Optional | Scopes the query by provider type Indicates whether to return only defenders running on ARM64 architecture. | | `parameters.isVPCObserver` | boolean | Optional | Indicates whether to return only defenders running as VPC Observer. | ### Input Example `{"parameters":{"offset":0,"limit":100,"sort":"","reverse":false,"hostname":"","role":[""],"connected":false,"type":[""],"latest":false,"supportedVersion":false,"cluster":[""],"tasClusterIDs":[""],"tasBlobstoreScanner":false,"tasFoundations":[""],"usingOldCA":false,"usingExpiredCA":false,"isARM64":false,"isVPCObserver":false}}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | ### Output Example `{"status_code":200,"response_headers":{"Date":"Wed, 12 Jun 2024 09:40:11 GMT","Content-Type":"application/json;charset=UTF-8","Transfer-Encoding":"chunked","Connection":"keep-alive"},"reason":"OK","json_body":[{"category":[],"certificateExpiration":"2024-06-14T05:48:06.278Z","cloudMetadata":{}}]}` ## Get Group Names Retrieves all available group names from Palo Alto Networks Prisma Cloud Workload Protection. ### Endpoint - **URL:** `/groups/names` - **Method:** `GET` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | ### Output Example `{"status_code":200,"response_headers":{"Date":"Wed, 12 Jun 2024 09:40:11 GMT","Content-Type":"application/json;charset=UTF-8","Transfer-Encoding":"chunked","Connection":"keep-alive"},"reason":"OK","json_body":["admins","secops","devops"]}` ## Get Groups Retrieves a complete list of groups from Palo Alto Networks Prisma Cloud Workload Protection. ### Endpoint - **URL:** `/groups` - **Method:** `GET` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | ### Output Example `{"status_code":200,"response_headers":{"Date":"Wed, 12 Jun 2024 09:40:11 GMT","Content-Type":"application/json;charset=UTF-8","Transfer-Encoding":"chunked","Connection":"keep-alive"},"reason":"OK","json_body":[{"_id":"string","groupId":"string","groupName":"string","lastModified":"2024-06-14T05:48:06.290Z","ldapGroup":true,"oauthGroup":true,"oidcGroup":true,"owner":"string","permissions":[],"role":"string","samlGroup":true,"user":[]}]}` ## Get Host Information Retrieve essential details about deployed hosts from Palo Alto Prisma Cloud, including hostname, distro, release, and agentless status. ### Endpoint - **URL:** `/hosts/info` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------------- | -------- | ------------ | ------------------------------------------------------------------------------------------------------------------------------------------ | | `parameters.offset` | number | Optional | Offsets the result to a specific report count. Offset starts from 0. | | `parameters.limit` | number | Optional | Limit is the amount to fix. | | `parameters.sort` | string | Optional | Sorts the result using a key. | | `parameters.reverse` | boolean | Optional | Sorts the result in reverse order. | | `parameters.hostname` | array | Optional | Filters the result based on hostnames. | | `parameters.distro` | array | Optional | Filters the result based on OS distribution names. | | `parameters.compact` | boolean | Optional | Provides the minimal image data. Information about vulnerabilities, compliance, and extended image metadata are skipped. Default is false. | | `parameters.clusters` | array | Optional | Filters the result based on cluster names. | | `parameters.complianceIDs` | array | Optional | Filters the result based on compliance IDs. | | `parameters.complianceRuleName` | string | Optional | Filters the result based on applied compliance rule name. | | `parameters.agentless` | boolean | Optional | Retrieves the host names that were scanned by the agentless scanner. | | `parameters.csa` | boolean | Optional | Filters only images scanned by CSA. | | `parameters.stopped` | boolean | Optional | Retrieves the host names that were skipped during an agentless scan. Default is false. | | `parameters.normalizedSeverity` | boolean | Optional | Retrieves the result in the normalized form of low, medium, high, and critical based on vulnerability's severity level. Default is false. | | `parameters.uaiID` | string | Optional | Filters results by uaiID. | | `parameters.issueType` | string | Optional | Filters results by issue type. | ### Input Example `{"parameters":{"offset":0,"limit":100,"sort":"","reverse":false,"hostname":[""],"distro":[""],"compact":false,"clusters":[""],"complianceIDs":[0],"complianceRuleName":"","agentless":false,"csa":false,"stopped":false,"normalizedSeverity":false,"uaiID":"","issueType":""}}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | ### Output Example `{"status_code":200,"response_headers":{"Date":"Wed, 12 Jun 2024 09:40:11 GMT","Content-Type":"application/json;charset=UTF-8","Transfer-Encoding":"chunked","Connection":"keep-alive"},"reason":"OK","json_body":[{"Secrets":[],"_id":"string"}]}` ## Get Host Scan Results Retrieve detailed host vulnerability reports from Palo Alto Networks Prisma Cloud Workload Protection. ### Endpoint - **URL:** `/hosts` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------------- | -------- | ------------ | ------------------------------------------------------------------------------------------------------------------------------------------ | | `parameters.fields` | string | Optional | Fields query parameters. | | `parameters.offset` | number | Optional | Offsets the result to a specific report count. Offset starts from 0. | | `parameters.limit` | number | Optional | Limit is the amount to fix. | | `parameters.sort` | string | Optional | Sorts the result using a key. | | `parameters.reverse` | boolean | Optional | Sorts the result in reverse order. | | `parameters.hostname` | array | Optional | Filters the result based on hostnames. | | `parameters.distro` | array | Optional | Filters the result based on OS distribution names. | | `parameters.compact` | boolean | Optional | Provides the minimal image data. Information about vulnerabilities, compliance, and extended image metadata are skipped. Default is false. | | `parameters.clusters` | array | Optional | Filters the result based on cluster names. | | `parameters.complianceIDs` | array | Optional | Filters the result based on compliance IDs. | | `parameters.complianceRuleName` | string | Optional | Filters the result based on applied compliance rule name. | | `parameters.agentless` | boolean | Optional | Retrieves the host names that were scanned by the agentless scanner. | | `parameters.csa` | boolean | Optional | Filters only images scanned by CSA. | | `parameters.stopped` | boolean | Optional | Retrieves the host names that were skipped during an agentless scan. Default is false. | | `parameters.normalizedSeverity` | boolean | Optional | Retrieves the result in the normalized form of low, medium, high, and critical based on vulnerability's severity level. Default is false. | | `parameters.uaiID` | string | Optional | Filters results by uaiID. | | `parameters.issueType` | string | Optional | Filters results by issue type. | ### Input Example `{"parameters":{"fields":"type","offset":0,"limit":100,"sort":"","reverse":false,"hostname":[""],"distro":[""],"compact":false,"clusters":[""],"complianceIDs":[0],"complianceRuleName":"","agentless":false,"csa":false,"stopped":false,"normalizedSeverity":false,"uaiID":"","issueType":""}}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | ### Output Example `{"status_code":200,"response_headers":{"Date":"Wed, 12 Jun 2024 09:40:11 GMT","Content-Type":"application/json;charset=UTF-8","Transfer-Encoding":"chunked","Connection":"keep-alive"},"reason":"OK","json_body":[{"Secrets":[],"_id":"string","agentless":true,"vulnerabilitiesCount":0,"vulnerabilityDistribution":{},"vulnerabilityRiskScore":0,"wildFireUsage":{}}]}` ## Get Image Names Retrieve a list of image names from Palo Alto Networks Prisma Cloud Workload Protect to manage and analyze your inventory. ### Endpoint - **URL:** `/images/names` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------------- | -------- | ------------ | ------------------------------------------------------------------------------------------------------------------------------------------------- | | `parameters.offset` | number | Optional | Offsets the result to a specific report count. Offset starts from 0. | | `parameters.limit` | number | Optional | Limit is the amount to fix. | | `parameters.sort` | string | Optional | Sorts the result using a key. | | `parameters.reverse` | boolean | Optional | Sorts the result in reverse order. | | `parameters.id` | array | Optional | Filters the result based on image IDs. | | `parameters.hostname` | array | Optional | Filters the result based on hostnames. | | `parameters.repository` | array | Optional | Filters the result based on image repository names. | | `parameters.registry` | array | Optional | Filters the result based on image registry names. | | `parameters.fields` | array | Optional | List of fields to retrieve. | | `parameters.name` | array | Optional | Filters the result based on image names. | | `parameters.layers` | boolean | Optional | Indicates whether the CVEs are mapped to a specific image layer. Default is false. | | `parameters.filterBaseImage` | boolean | Optional | Indicates whether to filter the base image for vulnerabilities. Requires predefined base images that have already been scanned. Default is false. | | `parameters.compact` | boolean | Optional | Provides the minimal image data. Information about vulnerabilities, compliance, and extended image metadata are skipped. Default is false. | | `parameters.trustStatuses` | array | Optional | Filters the result based on whether an image is trusted or not trusted by a trusted image policy. | | `parameters.clusters` | array | Optional | Filters the result based on cluster names. | | `parameters.complianceIDs` | array | Optional | Filters the result by compliance IDs. | | `parameters.complianceRuleName` | string | Optional | Filters the result based on applied compliance rule name. | | `parameters.appEmbedded` | boolean | Optional | Filters the result based on whether the images are scanned by App-Embedded Defenders. Default is false. | | `parameters.normalizedSeverity` | boolean | Optional | Retrieves the result in the normalized form of low, medium, high, and critical based on vulnerability's severity level. Default is false. | | `parameters.agentless` | boolean | Optional | Indicates whether to retrieve host names that are scanned by agentless scanner. Default is false. | | `parameters.csa` | boolean | Optional | Filters only images scanned by CSA. | | `parameters.uaiID` | string | Optional | Filters results by uaiID. | | `parameters.issueType` | string | Optional | Filters results by issue type. | ### Input Example `{"parameters":{"offset":0,"limit":100,"sort":"","reverse":false,"id":[""],"hostname":[""],"repository":[""],"registry":[""],"fields":[""],"name":[""],"layers":false,"filterBaseImage":false,"compact":false,"trustStatuses":[""],"clusters":[""],"complianceIDs":[0],"complianceRuleName":"","appEmbedded":false,"normalizedSeverity":false,"agentless":false,"csa":false,"uaiID":"","issueType":""}}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | ### Output Example `{"status_code":200,"response_headers":{"Date":"Wed, 12 Jun 2024 09:40:11 GMT","Content-Type":"application/json;charset=UTF-8","Transfer-Encoding":"chunked","Connection":"keep-alive"},"reason":"OK","json_body":["string"]}` ## Get Image Scan Results Retrieve detailed scan results for container images, identifying vulnerabilities and compliance issues from Palo Alto Prisma Cloud. ### Endpoint - **URL:** `/images` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------------- | -------- | ------------ | ------------------------------------------------------------------------------------------------------------------------------------------------- | | `parameters.offset` | number | Optional | Offsets the result to a specific report count. Offset starts from 0. | | `parameters.limit` | number | Optional | Limit is the amount to fix. | | `parameters.sort` | string | Optional | Sorts the result using a key. | | `parameters.reverse` | boolean | Optional | Sorts the result in reverse order. | | `parameters.id` | array | Optional | Filters the result based on image IDs. | | `parameters.hostname` | array | Optional | Filters the result based on hostnames. | | `parameters.repository` | array | Optional | Filters the result based on image repository names. | | `parameters.registry` | array | Optional | Filters the result based on image registry names. | | `parameters.fields` | array | Optional | List of fields to retrieve. | | `parameters.name` | array | Optional | Filters the result based on image names. | | `parameters.layers` | boolean | Optional | Indicates whether the CVEs are mapped to a specific image layer. Default is false. | | `parameters.filterBaseImage` | boolean | Optional | Indicates whether to filter the base image for vulnerabilities. Requires predefined base images that have already been scanned. Default is false. | | `parameters.compact` | boolean | Optional | Provides the minimal image data. Information about vulnerabilities, compliance, and extended image metadata are skipped. Default is false. | | `parameters.trustStatuses` | array | Optional | Filters the result based on whether an image is trusted or not trusted by a trusted image policy. | | `parameters.clusters` | array | Optional | Filters the result based on cluster names. | | `parameters.complianceIDs` | array | Optional | Filters the result by compliance IDs. | | `parameters.complianceRuleName` | string | Optional | Filters the result based on applied compliance rule name. | | `parameters.appEmbedded` | boolean | Optional | Filters the result based on whether the images are scanned by App-Embedded Defenders. Default is false. | | `parameters.normalizedSeverity` | boolean | Optional | Retrieves the result in the normalized form of low, medium, high, and critical based on vulnerability's severity level. Default is false. | | `parameters.agentless` | boolean | Optional | Indicates whether to retrieve host names that are scanned by agentless scanner. Default is false. | | `parameters.csa` | boolean | Optional | Filters only images scanned by CSA. | | `parameters.uaiID` | string | Optional | Filters results by uaiID. | | `parameters.issueType` | string | Optional | Filters results by issue type. | ### Input Example `{"parameters":{"offset":0,"limit":100,"sort":"","reverse":false,"id":[""],"hostname":[""],"repository":[""],"registry":[""],"fields":[""],"name":[""],"layers":false,"filterBaseImage":false,"compact":false,"trustStatuses":[""],"clusters":[""],"complianceIDs":[0],"complianceRuleName":"","appEmbedded":false,"normalizedSeverity":false,"agentless":false,"csa":false,"uaiID":"","issueType":""}}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | ### Output Example `{"status_code":200,"response_headers":{"Date":"Wed, 12 Jun 2024 09:40:11 GMT","Content-Type":"application/json;charset=UTF-8","Transfer-Encoding":"chunked","Connection":"keep-alive"},"reason":"OK","json_body":[{"Secrets":[],"_id":"string","agentless":true}]}` ## Get Registry Scan Results Retrieve detailed scan reports for registry images from Palo Alto Networks Prisma Cloud Workload Protection. ### Endpoint - **URL:** `/registry` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------------- | -------- | ------------ | ------------------------------------------------------------------------------------------------------------------------------------------------- | | `parameters.offset` | number | Optional | Offsets the result to a specific report count. Offset starts from 0. | | `parameters.limit` | number | Optional | Limit is the amount to fix. | | `parameters.sort` | string | Optional | Sorts the result using a key. | | `parameters.reverse` | boolean | Optional | Sorts the result in reverse order. | | `parameters.id` | array | Optional | Filters results by registry image. | | `parameters.imageID` | array | Optional | Filters the result by image IDs that are available in daemonset. | | `parameters.repository` | array | Optional | Filters the result based on image repository names. | | `parameters.registry` | array | Optional | Filters the result based on image registry names. | | `parameters.name` | array | Optional | Filters the result based on full image names. | | `parameters.layers` | boolean | Optional | Indicates whether the CVEs are mapped to an image layer. Default is false. | | `parameters.compact` | boolean | Optional | Provides the minimal image data. Information about vulnerabilities, compliance, and extended image metadata are skipped. Default is false. | | `parameters.filterBaseImage` | boolean | Optional | Indicates whether to filter the base image for vulnerabilities. Requires predefined base images that have already been scanned. Default is false. | | `parameters.normalizedSeverity` | boolean | Optional | Retrieves the result in the normalized form of low, medium, high, and critical based on vulnerability's severity level. Default is false. | | `parameters.uaiID` | string | Optional | Filters results by uaiID. | | `parameters.issueType` | string | Optional | Filters results by issue type. | ### Input Example `{"parameters":{"offset":0,"limit":10,"sort":"","reverse":false,"id":[""],"imageID":[""],"repository":[""],"registry":[""],"name":[""],"layers":false,"compact":false,"filterBaseImage":false,"normalizedSeverity":false,"uaiID":"","issueType":""}}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | ### Output Example `{"status_code":200,"response_headers":{"Date":"Wed, 12 Jun 2024 09:40:11 GMT","Content-Type":"application/json;charset=UTF-8","Transfer-Encoding":"chunked","Connection":"keep-alive"},"reason":"OK","json_body":[{"Secrets":[],"_id":"string"}]}` ## Get Serverless Function Scan Results Retrieve scan reports for all serverless functions in Palo Alto Networks Prisma Cloud Workload Protection. ### Endpoint - **URL:** `/serverless` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------------------- | -------- | ------------ | ----------------------------------------------------------------------------------------------------------------------------------------- | | `parameters.offset` | number | Optional | Offsets the result to a specific report count. Offset starts from 0. | | `parameters.limit` | number | Optional | Limit is the amount to fix. | | `parameters.sort` | string | Optional | Sorts the result using a key. | | `parameters.reverse` | boolean | Optional | Sorts the result in reverse order. | | `parameters.id` | array | Optional | Retrieves a list of cloud function IDs. | | `parameters.cloudControllerAddresses` | array | Optional | Retrieves a list of cloud controller addresses that contains the cloud functions. | | `parameters.runtime` | array | Optional | Filters the result based on cloud runtimes. | | `parameters.version` | array | Optional | Filters the result based on cloud function's versions. | | `parameters.functionLayers` | array | Optional | Filters the result based on AWS Lambda Layers. | | `parameters.defended` | boolean | Optional | Filters result based on cloud functions that are connected and protected by a Defender. | | `parameters.complianceIDs` | array | Optional | Filters result based on compliance IDs. | | `parameters.complianceRuleName` | string | Optional | Filters the result based on applied compliance rule name. | | `parameters.platform` | array | Optional | Filters result based on platforms (OS and architecture) such as Windows, Linux ARM x64, Linux x86, and so on. | | `parameters.normalizedSeverity` | boolean | Optional | Retrieves the result in the normalized form of low, medium, high, and critical based on vulnerability's severity level. Default is false. | | `parameters.issueType` | string | Optional | Filters results by issue type. | ### Input Example `{"parameters":{"offset":0,"limit":100,"sort":"","reverse":false,"id":[""],"cloudControllerAddresses":[""],"runtime":[""],"version":[""],"functionLayers":[""],"defended":false,"complianceIDs":[0],"complianceRuleName":"","platform":[""],"normalizedSeverity":false,"issueType":""}}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | ### Output Example `{"status_code":200,"response_headers":{"Date":"Wed, 12 Jun 2024 09:40:11 GMT","Content-Type":"application/json;charset=UTF-8","Transfer-Encoding":"chunked","Connection":"keep-alive"},"reason":"OK","json_body":[{"Secrets":[],"_id":"string"}]}` ## Get VM Image Names Retrieve a list of virtual machine image names from Palo Alto Networks Prisma Cloud Workload Protection. ### Endpoint - **URL:** `/vms/names` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------------- | -------- | ------------ | ----------------------------------------------------------------------------------------------------------------------------------------- | | `parameters.offset` | number | Optional | Offsets the result to a specific report count. Offset starts from 0. | | `parameters.limit` | number | Optional | Limit is the amount to fix. | | `parameters.sort` | string | Optional | Sorts the result using a key. | | `parameters.reverse` | boolean | Optional | Sorts the result in reverse order. | | `parameters.id` | array | Optional | Filters the result based on VM IDs. | | `parameters.name` | array | Optional | Filters the result based on image names. | | `parameters.credential` | array | Optional | Filters the result based on cloud credentials. | | `parameters.distro` | array | Optional | Filters the result based on OS distribution names. | | `parameters.release` | array | Optional | Filters the result based on release versions. | | `parameters.imageType` | array | Optional | Filters the result based on cloud image types. Use marketplace, managed, or gallery for Microsoft Azure. | | `parameters.complianceIDs` | array | Optional | Filters the result based on compliance IDs. | | `parameters.complianceRuleName` | string | Optional | Filters the result based on applied compliance rule name. | | `parameters.normalizedSeverity` | boolean | Optional | Retrieves the result in the normalized form of low, medium, high, and critical based on vulnerability's severity level. Default is false. | | `parameters.issueType` | string | Optional | Filters results by issue type. | ### Input Example `{"parameters":{"offset":0,"limit":100,"sort":"","reverse":false,"id":[""],"name":[""],"credential":[""],"distro":[""],"release":[""],"imageType":[""],"complianceIDs":[0],"complianceRuleName":"","normalizedSeverity":false,"issueType":""}}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | ### Output Example `{"status_code":200,"response_headers":{"Date":"Wed, 12 Jun 2024 09:40:11 GMT","Content-Type":"application/json;charset=UTF-8","Transfer-Encoding":"chunked","Connection":"keep-alive"},"reason":"OK","json_body":["string"]}` ## Get VM Image Scan Results Retrieve comprehensive security insights with VM image scan reports from Palo Alto Networks Prisma Cloud Workload Protect. ### Endpoint - **URL:** `/vms` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------------- | -------- | ------------ | ----------------------------------------------------------------------------------------------------------------------------------------- | | `parameters.offset` | number | Optional | Offsets the result to a specific report count. Offset starts from 0. | | `parameters.limit` | number | Optional | Limit is the amount to fix. | | `parameters.sort` | string | Optional | Sorts the result using a key. | | `parameters.reverse` | boolean | Optional | Sorts the result in reverse order. | | `parameters.id` | array | Optional | Filters the result based on VM IDs. | | `parameters.name` | array | Optional | Filters the result based on image names. | | `parameters.credential` | array | Optional | Filters the result based on cloud credentials. | | `parameters.distro` | array | Optional | Filters the result based on OS distribution names. | | `parameters.release` | array | Optional | Filters the result based on release versions. | | `parameters.imageType` | array | Optional | Filters the result based on cloud image types. Use marketplace, managed, or gallery for Microsoft Azure. | | `parameters.complianceIDs` | array | Optional | Filters the result based on compliance IDs. | | `parameters.complianceRuleName` | string | Optional | Filters the result based on applied compliance rule name. | | `parameters.normalizedSeverity` | boolean | Optional | Retrieves the result in the normalized form of low, medium, high, and critical based on vulnerability's severity level. Default is false. | | `parameters.issueType` | string | Optional | Filters results by issue type. | ### Input Example `{"parameters":{"offset":0,"limit":100,"sort":"","reverse":false,"id":[""],"name":[""],"credential":[""],"distro":[""],"release":[""],"imageType":[""],"complianceIDs":[0],"complianceRuleName":"","normalizedSeverity":false,"issueType":""}}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | ### Output Example `{"status_code":200,"response_headers":{"Date":"Wed, 12 Jun 2024 09:40:11 GMT","Content-Type":"application/json;charset=UTF-8","Transfer-Encoding":"chunked","Connection":"keep-alive"},"reason":"OK","json_body":[{"Secrets":[],"_id":"string"}]}` ## Get VM Image Tags Retrieve all AWS tags for scanned VM images in Palo Alto Networks Prisma Cloud Workload Protection. ### Endpoint - **URL:** `/vms/labels` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------------- | -------- | ------------ | ----------------------------------------------------------------------------------------------------------------------------------------- | | `parameters.offset` | number | Optional | Offsets the result to a specific report count. Offset starts from 0. | | `parameters.limit` | number | Optional | Limit is the amount to fix. | | `parameters.sort` | string | Optional | Sorts the result using a key. | | `parameters.reverse` | boolean | Optional | Sorts the result in reverse order. | | `parameters.id` | array | Optional | Filters the result based on VM IDs. | | `parameters.name` | array | Optional | Filters the result based on image names. | | `parameters.credential` | array | Optional | Filters the result based on cloud credentials. | | `parameters.distro` | array | Optional | Filters the result based on OS distribution names. | | `parameters.release` | array | Optional | Filters the result based on release versions. | | `parameters.imageType` | array | Optional | Filters the result based on cloud image types. Use marketplace, managed, or gallery for Microsoft Azure. | | `parameters.complianceIDs` | array | Optional | Filters the result based on compliance IDs. | | `parameters.complianceRuleName` | string | Optional | Filters the result based on applied compliance rule name. | | `parameters.normalizedSeverity` | boolean | Optional | Retrieves the result in the normalized form of low, medium, high, and critical based on vulnerability's severity level. Default is false. | | `parameters.issueType` | string | Optional | Filters results by issue type. | ### Input Example `{"parameters":{"offset":0,"limit":100,"sort":"","reverse":false,"id":[""],"name":[""],"credential":[""],"distro":[""],"release":[""],"imageType":[""],"complianceIDs":[0],"complianceRuleName":"","normalizedSeverity":false,"issueType":""}}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | ### Output Example `{"status_code":200,"response_headers":{"Date":"Wed, 12 Jun 2024 09:40:11 GMT","Content-Type":"application/json;charset=UTF-8","Transfer-Encoding":"chunked","Connection":"keep-alive"},"reason":"OK","json_body":["string"]}` ## Get Vulnerability CVEs Stats Retrieve a list of CVEs for images, hosts, and serverless functions in Palo Alto Networks Prisma Cloud. ### Endpoint - **URL:** `/stats/vulnerabilities` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------------ | -------- | ------------ | ----------------------------------------------------------------------------------------------------------------------------------- | | `parameters.offset` | number | Optional | Offsets the result to a specific report count. Offset starts from 0. | | `parameters.limit` | number | Optional | Limit is the amount to fix. | | `parameters.sort` | string | Optional | Sorts the result using a key. | | `parameters.reverse` | boolean | Optional | Sorts the result in reverse order. | | `parameters.cve` | string | Optional | CVE is the single CVE ID to return vulnerability data for. | | `parameters.severityThreshold` | string | Optional | SeverityThreshold is the minimum severity indicating that all retrieved CVEs severities are greater than or equal to the threshold. | | `parameters.cvssThreshold` | number | Optional | CVSSThreshold is the minimum CVSS score indicating that all retrieved CVEs CVSS scores are greater than or equal to the threshold. | | `parameters.resourceType` | string | Optional | ResourceType is the single resource type to return vulnerability data for. | | `parameters.agentless` | boolean | Optional | Agentless indicates whether to retrieve vulnerability data for agentless hosts/images. | | `parameters.stopped` | boolean | Optional | Stopped indicates whether to retrieve vulnerability data for hosts that were not running during agentless scan. | | `parameters.packages` | array | Optional | Packages filter by impacted packages. | | `parameters.riskFactors` | array | Optional | RiskFactors filter by CVE risk factors. | | `parameters.envRiskFactors` | array | Optional | EnvRiskFactors filter by environmental risk factors. | ### Input Example `{"parameters":{"offset":0,"limit":100,"sort":"","reverse":false,"cve":"","severityThreshold":"","cvssThreshold":10.357,"resourceType":"","agentless":false,"stopped":false,"packages":[""],"riskFactors":[""],"envRiskFactors":[""]}}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | ### Output Example `{"status_code":200,"response_headers":{"Date":"Wed, 12 Jun 2024 09:40:11 GMT","Content-Type":"application/json;charset=UTF-8","Transfer-Encoding":"chunked","Connection":"keep-alive"},"reason":"OK","json_body":[{"_id":"string","containers":{},"functions":{}}]}` ## Resolve Hosts Adds vulnerability data for specified hosts in Palo Alto Networks Prisma Cloud Workload Protect using a provided JSON body. ### Endpoint - **URL:** `/hosts/evaluate` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------------------------------- | -------- | ------------ | --------------------------- | | `images` | array | Optional | Parameter for Resolve Hosts | | `images.Secrets` | array | Optional | Parameter for Resolve Hosts | | `images._id` | string | Optional | Unique identifier | | `images.agentless` | boolean | Optional | Parameter for Resolve Hosts | | `images.aisUUID` | string | Optional | Unique identifier | | `images.allCompliance` | object | Optional | Parameter for Resolve Hosts | | `images.allCompliance.compliance` | array | Optional | Parameter for Resolve Hosts | | `images.allCompliance.compliance.applicableRules` | array | Optional | Parameter for Resolve Hosts | | `images.allCompliance.compliance.binaryPkgs` | array | Optional | Parameter for Resolve Hosts | | `images.allCompliance.compliance.block` | boolean | Optional | Parameter for Resolve Hosts | | `images.allCompliance.compliance.cause` | string | Optional | Parameter for Resolve Hosts | | `images.allCompliance.compliance.cri` | boolean | Optional | Parameter for Resolve Hosts | | `images.allCompliance.compliance.custom` | boolean | Optional | Parameter for Resolve Hosts | | `images.allCompliance.compliance.cve` | string | Optional | Parameter for Resolve Hosts | | `images.allCompliance.compliance.cvss` | number | Optional | Parameter for Resolve Hosts | | `images.allCompliance.compliance.description` | string | Optional | Parameter for Resolve Hosts | | `images.allCompliance.compliance.discovered` | string | Optional | Parameter for Resolve Hosts | | `images.allCompliance.compliance.exploit` | array | Optional | Parameter for Resolve Hosts | | `images.allCompliance.compliance.exploits` | array | Optional | Parameter for Resolve Hosts | | `images.allCompliance.compliance.exploits.kind` | array | Optional | Parameter for Resolve Hosts | | `images.allCompliance.compliance.exploits.link` | string | Optional | Parameter for Resolve Hosts | | `images.allCompliance.compliance.exploits.source` | array | Optional | Parameter for Resolve Hosts | | `images.allCompliance.compliance.fixDate` | number | Optional | Date value | | `images.allCompliance.compliance.fixLink` | string | Optional | Parameter for Resolve Hosts | | `images.allCompliance.compliance.functionLayer` | string | Optional | Parameter for Resolve Hosts | ### Input Example `{"images":[{"Secrets":["string"],"_id":"string","agentless":true,"aisUUID":"string","allCompliance":{"compliance":[{"applicableRules":["string"],"binaryPkgs":["string"],"block":true,"cause":"string","cri":true,"custom":true,"cve":"string","cvss":123,"description":"string","discovered":"string","exploit":["string"],"exploits":[],"fixDate":123,"fixLink":"string","functionLayer":"string","gracePeriodDays":123,"id":123,"layerTime":123,"link":"string","packageName":"Example Name","packageType":["string"],"packageVersion":"string","published":123,"riskFactors":{},"secret":{},"severity":"string","status":"active","templates":[],"text":"string","title":"string","twistlock":true,"type":["string"],"vecStr":"string","vulnTagInfos":[],"wildfireMalware":{}}],"enabled":true},"appEmbedded":true,"applications":[{"installedFromPackage":true,"knownVulnerabilities":123,"layerTime":123,"name":"Example Name","originPackageName":"Example Name","path":"string","service":true,"version":"string"}],"baseImage":"string","binaries":[{"altered":true,"cveCount":123,"deps":["string"],"fileMode":123,"functionLayer":"string","md5":"string","missingPkg":true,"name":"Example Name","path":"string","pkgRootDir":"string","services":["string"],"version":"string"}],"cloudMetadata":{"accountID":"string","awsExecutionEnv":"string","image":"string","labels":[{"key":"string","sourceName":"Example Name","sourceType":["string"],"timestamp":"2024-01-01T00:00:00Z","value":"string"}],"name":"Example Name","provider":["string"],"region":"string","resourceID":"string","resourceURL":"string","type":"string","vmID":"string","vmImageID":"string"},"clusterType":["string"],"clusters":["string"],"collections":["string"],"complianceDistribution":{"critical":123,"high":123,"low":123,"medium":123,"total":123},"complianceIssues":[{"applicableRules":["string"],"binaryPkgs":["string"],"block":true,"cause":"string","cri":true,"custom":true,"cve":"string","cvss":123,"description":"string","discovered":"string","exploit":["string"],"exploits":[{"kind":["string"],"link":"string","source":["string"]}],"fixDate":123,"fixLink":"string","functionLayer":"string","gracePeriodDays":123,"id":123,"layerTime":123,"link":"string","packageName":"Example Name","packageType":["string"],"packageVersion":"string","published":123,"riskFactors":{},"secret":{"locationInFile":"string","modifiedTime":123,"path":"string","secretID":"string","snippet":"string","type":["string"]},"severity":"string","status":"active","templates":[{"0":"string","1":"string","2":"string","3":"string","4":"string"}],"text":"string","title":"string","twistlock":true,"type":["string"],"vecStr":"string","vulnTagInfos":[{"color":"string","comment":"string","name":"Example Name"}],"wildfireMalware":{"md5":"string","path":"string","verdict":"string"}}],"complianceIssuesCount":123,"complianceRiskScore":123,"compressed":true,"compressedLayerTimes":{"appTimes":[123],"pkgsTimes":[{"pkgTimes":[123],"pkgsType":["string"]}]},"creationTime":"string","csa":true,"distro":"string","ecsClusterName":"Example Name","err":"string","errCode":123,"externalLabels":[{"key":"string","sourceName":"Example Name","sourceType":["string"],"timestamp":"2024-01-01T00:00:00Z","value":"string"}],"files":[{"md5":"string","path":"string","sha1":"string","sha256":"string"}],"firewallProtection":{"enabled":true,"outOfBandMode":["string"],"ports":[123],"supported":true,"tlsPorts":[123],"unprotectedProcesses":[{"port":123,"process":"string","tls":true}]},"firstScanTime":"string","foundSecrets":[{"locationInFile":"string","modifiedTime":123,"path":"string","secretID":"string","snippet":"string","type":["string"]}],"history":[{"baseLayer":true,"created":123,"emptyLayer":true,"id":"12345678-1234-1234-1234-123456789abc","instruction":"string","sizeBytes":123,"tags":["string"],"vulnerabilities":[{"applicableRules":["string"],"binaryPkgs":["string"],"block":true,"cause":"string","cri":true,"custom":true,"cve":"string","cvss":123,"description":"string","discovered":"string","exploit":["string"],"exploits":[],"fixDate":123,"fixLink":"string","functionLayer":"string","gracePeriodDays":123,"id":123,"layerTime":123,"link":"string","packageName":"Example Name","packageType":["string"],"packageVersion":"string","published":123,"riskFactors":{},"secret":{},"severity":"string","status":"active","templates":[],"text":"string","title":"string","twistlock":true,"type":["string"],"vecStr":"string","vulnTagInfos":[],"wildfireMalware":{}}]}],"hostDevices":[{"ip":"string","name":"Example Name"}],"hostRuntimeEnabled":true,"hostname":"Example Name","hosts":{},"id":"12345678-1234-1234-1234-123456789abc","image":{"created":"2024-01-01T00:00:00Z","entrypoint":["string"],"env":["string"],"healthcheck":true,"history":[{"baseLayer":true,"created":123,"emptyLayer":true,"id":"12345678-1234-1234-1234-123456789abc","instruction":"string","sizeBytes":123,"tags":["string"],"vulnerabilities":[]}],"id":"12345678-1234-1234-1234-123456789abc","labels":{},"layers":["string"],"os":"string","repoDigest":["string"],"repoTags":["string"],"user":"string","workingDir":"string"},"installedProducts":{"agentless":true,"apache":"string","awsCloud":true,"clusterType":["string"],"crio":true,"docker":"string","dockerEnterprise":true,"hasPackageManager":true,"k8sApiServer":true,"k8sControllerManager":true,"k8sEtcd":true,"k8sFederationApiServer":true,"k8sFederationControllerManager":true,"k8sKubelet":true,"k8sProxy":true,"k8sScheduler":true,"kubernetes":"string","managedClusterVersion":"string","openshift":true,"openshiftVersion":"string","osDistro":"string","serverless":true,"swarmManager":true,"swarmNode":true},"instances":[{"host":"string","image":"string","modified":"string","registry":"string","repo":"string","tag":"string"}],"isARM64":true,"k8sClusterAddr":"string","labels":["string"],"layers":["string"],"malwareAnalyzedTime":"string","missingDistroVulnCoverage":true,"namespaces":["string"],"osDistro":"string","osDistroRelease":"string","osDistroVersion":"string","packageManager":true}]}` ### Output | **Parameter** | **Type** | **Description** | | ---------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `images` | array | Output field: images | | `images.Secrets` | array | Output field: images.Secrets | | `images._id` | string | Unique identifier | ### Output Example `{"status_code":200,"response_headers":{"Date":"Wed, 12 Jun 2024 09:40:11 GMT","Content-Type":"application/json;charset=UTF-8","Transfer-Encoding":"chunked","Connection":"keep-alive"},"reason":"OK","json_body":{"images":[{}]}}` ## Resolve Images Adds vulnerability data for specified images in Palo Alto Networks Prisma Cloud Workload Protect, requiring a JSON body input. ### Endpoint - **URL:** `/images/evaluate` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------------------------------- | -------- | ------------ | ---------------------------- | | `images` | array | Optional | Parameter for Resolve Images | | `images.Secrets` | array | Optional | Parameter for Resolve Images | | `images._id` | string | Optional | Unique identifier | | `images.agentless` | boolean | Optional | Parameter for Resolve Images | | `images.aisUUID` | string | Optional | Unique identifier | | `images.allCompliance` | object | Optional | Parameter for Resolve Images | | `images.allCompliance.compliance` | array | Optional | Parameter for Resolve Images | | `images.allCompliance.compliance.applicableRules` | array | Optional | Parameter for Resolve Images | | `images.allCompliance.compliance.binaryPkgs` | array | Optional | Parameter for Resolve Images | | `images.allCompliance.compliance.block` | boolean | Optional | Parameter for Resolve Images | | `images.allCompliance.compliance.cause` | string | Optional | Parameter for Resolve Images | | `images.allCompliance.compliance.cri` | boolean | Optional | Parameter for Resolve Images | | `images.allCompliance.compliance.custom` | boolean | Optional | Parameter for Resolve Images | | `images.allCompliance.compliance.cve` | string | Optional | Parameter for Resolve Images | | `images.allCompliance.compliance.cvss` | number | Optional | Parameter for Resolve Images | | `images.allCompliance.compliance.description` | string | Optional | Parameter for Resolve Images | | `images.allCompliance.compliance.discovered` | string | Optional | Parameter for Resolve Images | | `images.allCompliance.compliance.exploit` | array | Optional | Parameter for Resolve Images | | `images.allCompliance.compliance.exploits` | array | Optional | Parameter for Resolve Images | | `images.allCompliance.compliance.exploits.kind` | array | Optional | Parameter for Resolve Images | | `images.allCompliance.compliance.exploits.link` | string | Optional | Parameter for Resolve Images | | `images.allCompliance.compliance.exploits.source` | array | Optional | Parameter for Resolve Images | | `images.allCompliance.compliance.fixDate` | number | Optional | Date value | | `images.allCompliance.compliance.fixLink` | string | Optional | Parameter for Resolve Images | | `images.allCompliance.compliance.functionLayer` | string | Optional | Parameter for Resolve Images | ### Input Example `{"json_body":{"images":[{"Secrets":[""],"_id":"","agentless":true,"aisUUID":"","allCompliance":{"compliance":[{"applicableRules":[""],"binaryPkgs":[""],"block":true,"cause":"","cri":true,"custom":true,"cve":"","cvss":0,"description":"","discovered":"2024-06-14T05:48:06.123Z","exploit":["","exploit-db","exploit-windows","cisa-kev"],"exploits":[{"kind":["poc","in-the-wild"],"link":"","source":["","exploit-db","exploit-windows","cisa-kev"]}],"fixDate":0,"fixLink":"","functionLayer":"","gracePeriodDays":0,"id":0,"layerTime":0,"link":"","packageName":"","packageType":["nodejs"],"packageVersion":"","published":0,"riskFactors":{},"secret":{"locationInFile":"","modifiedTime":0,"path":"","secretID":"","snippet":"","type":[""]},"severity":"","status":"","templates":[["PCI"]],"text":"","title":"","twistlock":true,"type":["container"],"vecStr":"","vulnTagInfos":[{"color":"","comment":"","name":""}],"wildfireMalware":{"md5":"","path":"","verdict":""}}],"enabled":true},"appEmbedded":true,"applications":[{"installedFromPackage":true,"knownVulnerabilities":0,"layerTime":0,"name":"","originPackageName":"","path":"","service":true,"version":""}],"baseImage":"","binaries":[{"altered":true,"cveCount":0,"deps":[""],"fileMode":0,"functionLayer":"","md5":"","missingPkg":true,"name":"","path":"","pkgRootDir":"","services":[""],"version":""}],"cloudMetadata":{"accountID":"","awsExecutionEnv":"","image":"","labels":[{"key":"","sourceName":"","sourceType":["namespace"],"timestamp":"2024-06-14T05:48:06.123Z","value":""}],"name":"","provider":["aws"],"region":"","resourceID":"","resourceURL":"","type":"","vmID":"","vmImageID":""},"clusterType":["AKS"],"clusters":[""],"collections":[""],"complianceDistribution":{"critical":0,"high":0,"low":0,"medium":0,"total":0},"complianceIssues":[{"applicableRules":[""],"binaryPkgs":[""],"block":true,"cause":"","cri":true,"custom":true,"cve":"","cvss":0,"description":"","discovered":"2024-06-14T05:48:06.123Z","exploit":["","exploit-db","exploit-windows","cisa-kev"],"exploits":[{"kind":["poc","in-the-wild"],"link":"","source":["","exploit-db","exploit-windows","cisa-kev"]}],"fixDate":0,"fixLink":"","functionLayer":"","gracePeriodDays":0,"id":0,"layerTime":0,"link":"","packageName":"","packageType":["nodejs"],"packageVersion":"","published":0,"riskFactors":{},"secret":{"locationInFile":"","modifiedTime":0,"path":"","secretID":"","snippet":"","type":["AWS Access Key ID"]},"severity":"","status":"","templates":[["PCI","HIPAA","NIST SP 800-190","GDPR","DISA STIG"]],"text":"","title":"","twistlock":true,"type":["container"],"vecStr":"","vulnTagInfos":[{"color":"","comment":"","name":""}],"wildfireMalware":{"md5":"","path":"","verdict":""}}],"complianceIssuesCount":0,"complianceRiskScore":0,"compressed":true,"compressedLayerTimes":{"appTimes":[0],"pkgsTimes":[{"pkgTimes":[0],"pkgsType":["nodejs"]}]},"creationTime":"2024-06-14T05:48:06.123Z","csa":true,"distro":"","ecsClusterName":"","err":"","errCode":0,"externalLabels":[{"key":"","sourceName":"","sourceType":["oci"],"timestamp":"2024-06-14T05:48:06.123Z","value":""}],"files":[{"md5":"","path":"","sha1":"","sha256":""}],"firewallProtection":{"enabled":true,"outOfBandMode":["","Observation","Protection"],"ports":[0],"supported":true,"tlsPorts":[0],"unprotectedProcesses":[{"port":0,"process":"","tls":true}]},"firstScanTime":"2024-06-14T05:48:06.123Z","foundSecrets":[{"locationInFile":"","modifiedTime":0,"path":"","secretID":"","snippet":"","type":["AWS Access Key ID"]}],"history":[{"baseLayer":true,"created":0,"emptyLayer":true,"id":"","instruction":"","sizeBytes":0,"tags":[""],"vulnerabilities":[{"applicableRules":[""],"binaryPkgs":[""],"block":true,"cause":"","cri":true,"custom":true,"cve":"","cvss":0,"description":"","discovered":"2024-06-14T05:48:06.124Z","exploit":[""],"exploits":[{"kind":["poc","in-the-wild"],"link":"","source":[""]}],"fixDate":0,"fixLink":"","functionLayer":"","gracePeriodDays":0,"id":0,"layerTime":0,"link":"","packageName":"","packageType":["nodejs"],"packageVersion":"","published":0,"riskFactors":{},"secret":{"locationInFile":"","modifiedTime":0,"path":"","secretID":"","snippet":"","type":[""]},"severity":"","status":"","templates":[["PCI"]],"text":"","title":"","twistlock":true,"type":[""],"vecStr":"","vulnTagInfos":[{"color":"","comment":"","name":""}],"wildfireMalware":{"md5":"","path":"","verdict":""}}]}],"hostDevices":[{"ip":"","name":""}],"hostRuntimeEnabled":true,"hostname":"","hosts":{},"id":"","image":{"created":"2024-06-14T05:48:06.124Z","entrypoint":[""],"env":[""],"healthcheck":true,"history":[{"baseLayer":true,"created":0,"emptyLayer":true,"id":"","instruction":"","sizeBytes":0,"tags":[""],"vulnerabilities":[{"applicableRules":[""],"binaryPkgs":[""],"block":true,"cause":"","cri":true,"custom":true,"cve":"","cvss":0,"description":"","discovered":"2024-06-14T05:48:06.124Z","exploit":["","exploit-db","exploit-windows","cisa-kev"],"exploits":[{"kind":["poc","in-the-wild"],"link":"","source":[""]}],"fixDate":0,"fixLink":"","functionLayer":"","gracePeriodDays":0,"id":0,"layerTime":0,"link":"","packageName":"","packageType":["nodejs"],"packageVersion":"","published":0,"riskFactors":{},"secret":{"locationInFile":"","modifiedTime":0,"path":"","secretID":"","snippet":"","type":["AWS Access Key ID"]},"severity":"","status":"","templates":[["PCI"]],"text":"","title":"","twistlock":true,"type":["container"],"vecStr":"","vulnTagInfos":[{"color":"","comment":"","name":""}],"wildfireMalware":{"md5":"","path":"","verdict":""}}]}],"id":"","labels":{},"layers":[""],"os":"","repoDigest":[""],"repoTags":[""],"user":"","workingDir":""},"installedProducts":{"agentless":true,"apache":"","awsCloud":true,"clusterType":["AKS","ECS","EKS","GKE","Kubernetes"],"crio":true,"docker":"","dockerEnterprise":true,"hasPackageManager":true,"k8sApiServer":true,"k8sControllerManager":true,"k8sEtcd":true,"k8sFederationApiServer":true,"k8sFederationControllerManager":true,"k8sKubelet":true,"k8sProxy":true,"k8sScheduler":true,"kubernetes":"","managedClusterVersion":"","openshift":true,"openshiftVersion":"","osDistro":"","serverless":true,"swarmManager":true,"swarmNode":true},"instances":[{"host":"","image":"","modified":"2024-06-14T05:48:06.124Z","registry":"","repo":"","tag":""}],"isARM64":true,"k8sClusterAddr":"","labels":[""],"layers":[""],"malwareAnalyzedTime":"2024-06-14T05:48:06.124Z","missingDistroVulnCoverage":true,"namespaces":[""],"osDistro":"","osDistroRelease":"","osDistroVersion":"","packageManager":true,"packages":[{"pkgs":[{"author":"","binaryIdx":[0],"binaryPkgs":[""],"cveCount":0,"defaultGem":true,"fileInfos":[{"md5":"","path":"","sha1":"","sha256":""}],"files":[{"md5":"","path":"","sha1":"","sha256":""}],"fullPkgPath":"","functionLayer":"","goPkg":true,"jarIdentifier":"","layerTime":0,"license":"","name":"","originPackageName":"","osPackage":true,"path":"","purl":"","securityRepoPkg":true,"symbols":[""],"version":""}],"pkgsType":["nodejs"]}],"pullDuration":0,"pushTime":"2024-06-14T05:48:06.125Z","redHatNonRPMImage":true,"registryNamespace":"","registryTags":[""],"registryType":"","repoDigests":[""],"repoTag":{"digest":"","id":"","registry":"","repo":"","tag":""},"rhelRepos":[""],"riskFactors":{},"scanBuildDate":"","scanDuration":0,"scanID":0,"scanTime":"2024-06-14T05:48:06.125Z","scanVersion":"","secretScanMetrics":{"failedScans":0,"foundSecrets":0,"scanTime":0,"scanTimeouts":0,"scannedFileSize":0,"scannedFiles":0,"totalBytes":0,"totalFiles":0,"totalTime":0,"typesCount":{}},"startupBinaries":[{"altered":true,"cveCount":0,"deps":[""],"fileMode":0,"functionLayer":"","md5":"","missingPkg":true,"name":"","path":"","pkgRootDir":"","services":[""],"version":""}],"stopped":true,"tags":[{"digest":"","id":"","registry":"","repo":"","tag":""}],"topLayer":"","trustResult":{"groups":[{"_id":"","disabled":true,"images":[""],"layers":[""],"modified":"2024-06-14T05:48:06.125Z","name":"","notes":"","owner":"","previousName":""}],"hostsStatuses":[{"host":"","status":["trusted","untrusted"]}]},"trustStatus":["trusted","untrusted"],"twistlockImage":true,"type":["image"],"vulnerabilities":[{"applicableRules":[""],"binaryPkgs":[""],"block":true,"cause":"","cri":true,"custom":true,"cve":"","cvss":0,"description":"","discovered":"2024-06-14T05:48:06.125Z","exploit":[""],"exploits":[{"kind":["poc","in-the-wild"],"link":"","source":[""]}],"fixDate":0,"fixLink":"","functionLayer":"","gracePeriodDays":0,"id":0,"layerTime":0,"link":"","packageName":"","packageType":["nodejs"],"packageVersion":"","published":0,"riskFactors":{},"secret":{"locationInFile":"","modifiedTime":0,"path":"","secretID":"","snippet":"","type":["AWS Access Key ID"]},"severity":"","status":"","templates":[["PCI"]],"text":"","title":"","twistlock":true,"type":["container"],"vecStr":"","vulnTagInfos":[{"color":"","comment":"","name":""}],"wildfireMalware":{"md5":"","path":"","verdict":""}}],"vulnerabilitiesCount":0,"vulnerabilityDistribution":{"critical":0,"high":0,"low":0,"medium":0,"total":0},"vulnerabilityRiskScore":0,"wildFireUsage":{"bytes":0,"queries":0,"uploads":0}}]}}` ### Output | **Parameter** | **Type** | **Description** | | ---------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `images` | array | Output field: images | | `images.Secrets` | array | Output field: images.Secrets | | `images._id` | string | Unique identifier | ### Output Example `{"status_code":200,"response_headers":{"Date":"Wed, 12 Jun 2024 09:40:11 GMT","Content-Type":"application/json;charset=UTF-8","Transfer-Encoding":"chunked","Connection":"keep-alive"},"reason":"OK","json_body":{"images":[{}]}}` ## Start a Host Scan Initiates a comprehensive re-scan of all hosts in Palo Alto Networks Prisma Cloud Workload Protect to update security posture. ### Endpoint - **URL:** `/hosts/scan` - **Method:** `POST` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `status` | string | Status value | ### Output Example `{"status_code":200,"response_headers":{"Date":"Wed, 12 Jun 2024 09:40:11 GMT","Content-Type":"application/json;charset=UTF-8","Transfer-Encoding":"chunked","Connection":"keep-alive"},"reason":"OK","json_body":{"status":"Scanned Hosts."}}` ## Start Image Scan Initiates a re-scan of all images in Palo Alto Networks Prisma Cloud Workload Protect, providing the scan initiation timestamp. ### Endpoint - **URL:** `/images/scan` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------- | -------- | ------------ | --------------------------------------------- | | `hostname` | string | Optional | Hostname is the optional host name to scan. | | `imageTag` | object | Optional | Parameter for Start Image Scan | | `imageTag.digest` | string | Optional | Image digest (requires V2 or later registry). | | `imageTag.id` | string | Optional | ID of the image. | | `imageTag.registry` | string | Optional | Registry name to which the image belongs. | | `imageTag.repo` | string | Optional | Repository name to which the image belongs. | | `imageTag.tag` | string | Optional | Image tag. | ### Input Example `{"json_body":{"hostname":"","imageTag":{"digest":"","id":"","registry":"","repo":"","tag":""}}}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `status` | string | Status value | ### Output Example `{"status_code":200,"response_headers":{"Date":"Wed, 12 Jun 2024 09:40:11 GMT","Content-Type":"application/json;charset=UTF-8","Transfer-Encoding":"chunked","Connection":"keep-alive"},"reason":"OK","json_body":{"status":"Scanned Images."}}` ## Start VM Image Scan Initiates a re-scan of all VM images in Palo Alto Networks Prisma Cloud and provides the scan initiation timestamp. ### Endpoint - **URL:** `/vms/scan` - **Method:** `POST` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `status` | string | Status value | ### Output Example `{"status_code":200,"response_headers":{"Date":"Wed, 12 Jun 2024 09:40:11 GMT","Content-Type":"application/json;charset=UTF-8","Transfer-Encoding":"chunked","Connection":"keep-alive"},"reason":"OK","json_body":{"status":"Scanned VM Images."}}` ## Stop VM Image Scan Terminate an ongoing VM image scan within Palo Alto Networks Prisma Cloud Workload Protect. ### Endpoint - **URL:** `/vms/stop` - **Method:** `POST` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `status` | string | Status value | ### Output Example `{"status_code":200,"response_headers":{"Date":"Wed, 12 Jun 2024 09:40:11 GMT","Content-Type":"application/json;charset=UTF-8","Transfer-Encoding":"chunked","Connection":"keep-alive"},"reason":"OK","json_body":{"status":"Stopped VM Images Scan."}}` ## Update Group by ID Modifies an existing group in Palo Alto Networks Prisma Cloud Workload Protect using a specified ID. ### Endpoint - **URL:** `/groups/{{id}}` - **Method:** `PUT` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------- | -------- | ------------ | ------------------------------------------------------------------------ | | `path_parameters.id` | string | Required | Parameters for the Update Group by ID action | | `_id` | string | Optional | Group name. | | `groupId` | string | Optional | Group identifier in the Azure SAML identification process. | | `groupName` | string | Optional | Group name | | `lastModified` | string | Optional | Datetime when the group was created or last modified. | | `ldapGroup` | boolean | Optional | Indicates if the group is an LDAP group (true) or not (false). | | `oauthGroup` | boolean | Optional | Indicates if the group is an OAuth group (true) or not (false). | | `oidcGroup` | boolean | Optional | Indicates if the group is an OpenID Connect group (true) or not (false). | | `owner` | string | Optional | User who created or modified the group. | | `permissions` | array | Optional | Parameter for Update Group by ID | | `permissions.collections` | array | Optional | Parameter for Update Group by ID | | `permissions.project` | string | Optional | Parameter for Update Group by ID | | `role` | string | Optional | Role of the group. | | `samlGroup` | boolean | Optional | Indicates if the group is a SAML group (true) or not (false). | | `user` | array | Optional | Parameter for Update Group by ID | | `user.username` | string | Optional | Name of the resource | ### Input Example `{"json_body":{"_id":"","groupId":"","groupName":"","lastModified":"2024-06-14T05:48:06.115Z","ldapGroup":true,"oauthGroup":true,"oidcGroup":true,"owner":"","permissions":[{"collections":[""],"project":""}],"role":"","samlGroup":true,"user":[{"username":""}]},"path_parameters":{"id":"e89f1d5adf"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `status` | string | Status value | ### Output Example `{"status_code":200,"response_headers":{"Date":"Wed, 12 Jun 2024 09:40:11 GMT","Content-Type":"application/json;charset=UTF-8","Transfer-Encoding":"chunked","Connection":"keep-alive"},"reason":"OK","json_body":{"status":"Updated."}}` ## Upgrade a Defender Upgrades the Defender component on a specified host using its ID in Palo Alto Networks Prisma Cloud Workload Protection. ### Endpoint - **URL:** `/defenders/{{id}}/upgrade` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------- | -------- | ------------ | -------------------------------------------- | | `path_parameters.id` | string | Required | Parameters for the Upgrade a Defender action | ### Input Example `{"path_parameters":{"id":"1297"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | ------------------------------------ | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `success` | boolean | Whether the operation was successful | ### Output Example `{"status_code":200,"response_headers":{"Date":"Wed, 12 Jun 2024 09:40:11 GMT","Content-Type":"application/json;charset=UTF-8","Transfer-Encoding":"chunked","Connection":"keep-alive"},"reason":"OK","json_body":{"success":true}}` ## WAAS OpenAPI Scans Generates a detailed OpenAPI specifications report, identifying errors and security issues using Palo Alto Prisma. ### Endpoint - **URL:** `/waas/openapi-scans` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------------- | -------- | ------------ | --------------- | | `form_data` | object | Required | Response data | | `form_data.file` | array | Required | Response data | | `form_data.file.file_name` | string | Required | Response data | | `form_data.file.file` | string | Required | Response data | ### Input Example `{"form_data":{"file":[{"file_name":"TEST_IMPORT.json","file":"TEST_IMPORT.json"}]}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------------ | -------- | ----------------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `_id` | string | Unique identifier | | `issueResults` | array | Result of the operation | | `issueResults._id` | number | Unique identifier | | `issueResults.category` | string | Result of the operation | | `issueResults.descriptionText` | string | Result of the operation | | `issueResults.descriptionUrl` | string | URL endpoint for the request | | `issueResults.id` | string | Unique identifier | | `issueResults.override` | object | Unique identifier | | `issueResults.queryName` | string | Name of the resource | | `issueResults.searchKey` | string | Result of the operation | | `issueResults.severity` | array | Result of the operation | | `issueResults.status` | string | Status value | | `scanInfo` | object | Output field: scanInfo | | `scanInfo.appID` | string | Unique identifier | | `scanInfo.policyType` | array | Type of the resource | | `scanInfo.ruleID` | string | Unique identifier | | `scanInfo.source` | array | Output field: scanInfo.source | | `scanStartTime` | string | Time value | | `severityDistribution` | object | Output field: severityDistribution | | `severityDistribution.high` | number | Output field: severityDistribution.high | | `severityDistribution.info` | number | Output field: severityDistribution.info | | `severityDistribution.low` | number | Output field: severityDistribution.low | | `severityDistribution.medium` | number | Output field: severityDistribution.medium | ### Output Example `{"status_code":200,"response_headers":{"Date":"Wed, 12 Jun 2024 09:40:11 GMT","Content-Type":"application/json;charset=UTF-8","Transfer-Encoding":"chunked","Connection":"keep-alive"},"reason":"OK","json_body":{"_id":"string","issueResults":[{}],"scanInfo":{"appID":"string","policyType":[],"ruleID":"string","source":[]},"scanStartTime":"2024-06-14T05:48:05.260Z","severityDistribution":{"high":0,"info":0,"low":0,"medium":0},"specInfo":{"content":[],"contentType":"string","fileName":"string"}}}` # Response Headers | **Header** | **Description** | **Example** | | ----------------- | ----------------------------------------------------- | ------------------------------ | | Connection | HTTP response header: Connection | keep-alive | | Content-Type | The media type of the resource | application/json;charset=UTF-8 | | Date | The date and time at which the message was originated | Thu, 01 Jan 2024 00:00:00 GMT | | Transfer-Encoding | HTTP response header: Transfer-Encoding | chunked |