--- title: Palo Alto Networks Prisma Cloud slug: connectors/palo-alto-networks-prisma-cloud docTags: createdAt: 2026-06-09T16:29:57.846Z --- ## Prisma Cloud by Palo Alto Networks The Palo Alto Networks Prisma Cloud connector enables seamless integration with Swimlane Turbine, allowing for automated cloud security management and incident response. Palo Alto Networks Prisma Cloud connector provides Swimlane Turbine users with the ability to integrate their security automation workflows with Prisma Cloud's comprehensive cloud security platform. This integration enables users to manage account groups, retrieve asset inventories, and handle alerts efficiently, thereby enhancing their cloud security posture and response capabilities. With this connector, security teams can automate critical tasks, gain better visibility into their cloud environments, and respond to threats with speed and precision. ## Prerequisites Before integrating Palo Alto Networks Prisma Cloud with Swimlane Turbine, ensure you have the following prerequisites: - Access key authentication with the following parameters: - URL: Endpoint URL for Prisma Cloud API access - Access Key ID: Unique identifier for API access - Secret Key: Confidential key for API authentication ## Capabilities This connector provides the following capabilities: - Account Groups - Account Group Info - Add Account Group - Delete Account Group - List Account Groups - List Account Group Names - List Account Group Names by Cloud Type - Update Account Group - Alert Rules - Get Alert Rule by ID - List Alert Rules V2 - Alerts - Alert Info - Create On Demand Notification - Dismiss Alerts - Download Alert CSV - Download Alerts List JSON - Download Policy Alerts JSON - Get Alerts Count By Status - Get Alert CSV Job Status - Get Alerts List Job Status - Get Policy Alert Job Status - Get Alert Count by Policy Groups - Get Alert Evidence Graph - Get Alert Count of Policies - Is Dismissal Note Required *... and so on* - Asset Inventory - Asset Inventory View - Create Asset Inventory Trend View V3 - Delete Saved Asset Inventory Filter - Get Asset Inventory Trend View V3 - Get Asset Inventory View V3 - Get Saved Asset Inventory Filter - List Inventory Dashboard Filter Autocomplete Suggestions V2 - List Inventory Filters V2 - List Saved Asset Inventory Filters - Save Asset Inventory Filter - Update Saved Asset Inventory Filter - Command Center - List Top N assets - List Top Policies - List Top Vulnerabilities - List Total Alerts Based on the Severity - List Total Vulnerable Images and Hosts - Hosts - Get Host Scan Result - IAM - Get Cloud Identity Inventory Related Assets - Get Existing Least Privilege Access for an Asset - Get IAM Query V2 - Get IAM Query - Get Least Privilege Access Metadata of a Resource - Get Least Privilege Access Metadata of an Asset - Get Least Privilege Access Suggestion Resource - Get New Least Privilege Access for a Resource - Get New Least Privilege Access for an Asset - Get Permission Accesses V3 - Get Permission Accesses - Get Permissions Access Next Page - Get Permissions Next Page - Get Permissions Role or Policy Definition V2 *... and so on* - Vulnerabilities Dashboard - Create Remediation Request - Get CVE Details by ID - Get CVE Overview V2 - Get Prioritized Vulnerabilities V3 - Get Remediation Status - Get Top Impacting Vulnerabilities V2 - Get Vulnerabilities Burndown - Get Vulnerabilities by RQL - Get Vulnerability Impact by Stage - Get Vulnerability Overview V2 - Get Vulnerable Assets by CVE - Get Vulnerable Assets by RQL ## Asset Setup To access Prisma `access_key` and `secret_key`are required. ### Alert Info In the response object, field `riskDetail` is deprecated. ### Get Resource Possible values for input `riskFactors` as given below. ```javascript [ CRITICAL_SEVERITY, HIGH_SEVERITY, MEDIUM_SEVERITY, HAS_FIX, REMOTE_EXECUTION, DOS, RECENT_VULNERABILITY,EXPLOIT_EXISTS, ATTACK_COMPLEXITY_LOW, ATTACK_VECTOR_NETWORK, REACHABLE_FROM_THE_INTERNET, LISTENING_PORTS,CONTAINER_IS_RUNNING_AS_ROOT, NO_MANDATORY_SECURITY_PROFILE_APPLIED, RUNNING_AS_PRIVILEGED_CONTAINER, PACKAGE_IN_USE ] ``` ### Asset Inventory View Possible values for input `timeUnit` as given below. ```javascript [minute, hour, day, week, month, year] ``` Possible values for input `scan_status` as given below. ```javascript [all, passed, failed] ``` The response includes an attribute `groupedAggregates`, whose content depends on the `groupBy` query parameter. The following table shows the attributes that `groupedAggregates` will include for the specified `groupBy` query parameter: | groupBy | groupedAggregates Includes | | ------------- | ------------------------------- | | not specified | cloudTypeName | | cloudType | cloudTypeName | | cloud.account | accountName | | cloud.region | regionName, cloudTypeName | | cloud.service | serviceName, cloudTypeName | | resource.type | resourceTypeName, cloudTypeName | If you want to specify `groupBy` multiple times, give comma-separated list of values by to group response items. Example: `cloud.type, cloud.account, cloud.region, cloud.service`. ## Note - The Asset URL for the "Get Host Scan Result" action is the Path to Console. - When using the **Time Range** field in actions, please to refer to the documentation for the various value formats. [API Documentation](https://pan.dev/prisma-cloud/api/cspm/) [Link for Regional URLs](https://pan.dev/prisma-cloud/api/cspm/api-urls/) # Configurations ## Prisma Cloud Asset Authenticates using Access key ID and Secret key. ### Configuration Parameters | **Parameter** | **Description** | **Type** | **Required** | | --------------- | ---------------------------------- | -------- | ------------ | | url | A URL to the target host. | string | Required | | access\_key\_id | Access key ID | string | Required | | secret\_key | Secret key | string | Required | | customer\_name | Customer Name | string | Optional | | prisma\_id | Unique Prisma Identifier | string | Optional | | verify\_ssl | Verify SSL certificate | boolean | Optional | | http\_proxy | A proxy to route requests through. | string | Optional | # Actions ## Account Group Info Retrieve comprehensive details for a specific account group in Palo Alto Networks Prisma Cloud using the provided ID. ### Endpoint - **URL:** `/cloud/group/{{id}}` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------------- | -------- | ------------ | ---------------------------------- | | `parameters.includeAccountInfo` | boolean | Optional | Include cloud account information. | | `path_parameters.id` | string | Required | Account Group ID. | ### Input Example `{"parameters":{"includeAccountInfo":false},"path_parameters":{"id":"59c8256b-835b-4868-9d3e-0c679a2cf421"}}` ### Output | **Parameter** | **Type** | **Description** | | --------------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `id` | string | Unique identifier | | `name` | string | Name of the resource | | `description` | string | Output field: description | | `lastModifiedBy` | string | Output field: lastModifiedBy | | `lastModifiedTs` | number | Output field: lastModifiedTs | | `accountIds` | array | Unique identifier | | `accountIds.file_name` | string | Unique identifier | | `accountIds.file` | string | Unique identifier | | `nonOnboardedCloudAccountIds` | array | Unique identifier | | `nonOnboardedCloudAccountIds.file_name` | string | Unique identifier | | `nonOnboardedCloudAccountIds.file` | string | Unique identifier | | `autoCreated` | boolean | Output field: autoCreated | | `cloudAccountCount` | number | Count value | | `childGroupIds` | array | Unique identifier | | `childGroupIds.file_name` | string | Unique identifier | | `childGroupIds.file` | string | Unique identifier | ### Output Example `{"status_code":200,"response_headers":{"Date":"Mon, 15 Jul 2024 03:44:32 GMT","Content-Type":"application/json;charset=UTF-8","Transfer-Encoding":"chunked","Connection":"keep-alive","X-RateLimit-Remaining":"99","X-RateLimit-Requested-Tokens":"1","X-RateLimit-Burst-Capacity":"100","X-RateLimit-Replenish-Rate":"100","tracer-id":"99bbf424962ea9c77c99e2f38f646c99","X-Content-Type-Options":"nosniff","X-XSS-Protection":"0","Cache-Control":"no-cache, no-store, max-age=0, must-revalidate","Pragma":"no-c...` ## Add Account Group Create a new account group in Palo Alto Networks Prisma Cloud using specified account IDs and group name. ### Endpoint - **URL:** `/cloud/group` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ---------------------------------- | -------- | ------------ | -------------------------------------------------------------------- | | `accountIds` | array | Optional | Cloud Account IDs. | | `cloudAccountInfos` | array | Optional | Cloud account details of account associated with this account group. | | `cloudAccountInfos.accountId` | string | Optional | Account ID | | `cloudAccountInfos.cloudType` | string | Optional | Cloud Type. | | `cloudAccountInfos.lastModifiedBy` | string | Optional | Last Modified By. | | `description` | string | Optional | Description. | | `name` | string | Optional | Name. | ### Input Example `{"json_body":{"accountIds":["workday-prod-svc","consumer-app-int"],"cloudAccountInfos":[{"accountId":"string","cloudType":"AWS","lastModifiedBy":"string"}],"description":"string","name":"BizFunc-BizTech - 642281869570"}}` ### Output | **Parameter** | **Type** | **Description** | | ---------------------------------- | -------- | ---------------------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `accountIds` | array | Unique identifier | | `autoCreated` | boolean | Output field: autoCreated | | `cloudAccountCount` | number | Count value | | `cloudAccountInfos` | array | Output field: cloudAccountInfos | | `cloudAccountInfos.accountId` | string | Unique identifier | | `cloudAccountInfos.cloudType` | string | Type of the resource | | `cloudAccountInfos.lastModifiedBy` | string | Output field: cloudAccountInfos.lastModifiedBy | | `description` | string | Output field: description | | `id` | string | Unique identifier | | `lastModifiedBy` | string | Output field: lastModifiedBy | | `lastModifiedTs` | number | Output field: lastModifiedTs | | `name` | string | Name of the resource | ### Output Example `{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"accountIds":["string"],"autoCreated":true,"cloudAccountCount":0,"cloudAccountInfos":[{}],"description":"string","id":"string","lastModifiedBy":"string","lastModifiedTs":0,"name":"string"}}` ## Alert Info Retrieve detailed information about a specific alert by providing its ID in Palo Alto Networks Prisma Cloud. ### Endpoint - **URL:** `/alert/{{id}}` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | --------------------- | -------- | ------------ | --------------------------- | | `parameters.detailed` | boolean | Optional | Return detailed alert data. | | `path_parameters.id` | string | Required | Alert ID. | ### Input Example `{"parameters":{"detailed":true},"path_parameters":{"id":"P-411652775"}}` ### Output | **Parameter** | **Type** | **Description** | | ----------------------------------------------- | -------- | ---------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `id` | string | Unique identifier | | `status` | string | Status value | | `firstSeen` | number | Output field: firstSeen | | `lastSeen` | number | Output field: lastSeen | | `alertTime` | number | Time value | | `lastUpdated` | number | Output field: lastUpdated | | `saveSearchId` | string | Unique identifier | | `metadata` | object | Response data | | `metadata.saveSearchId` | string | Response data | | `policy` | object | Output field: policy | | `policy.policyId` | string | Unique identifier | | `policy.name` | string | Name of the resource | | `policy.policyType` | string | Type of the resource | | `policy.systemDefault` | boolean | Output field: policy.systemDefault | | `policy.description` | string | Output field: policy.description | | `policy.severity` | string | Output field: policy.severity | | `policy.complianceMetadata` | array | Response data | | `policy.complianceMetadata.standardName` | string | Response data | | `policy.complianceMetadata.standardDescription` | string | Response data | | `policy.complianceMetadata.requirementId` | string | Response data | | `policy.complianceMetadata.requirementName` | string | Response data | | `policy.complianceMetadata.sectionId` | string | Response data | | `policy.complianceMetadata.sectionDescription` | string | Response data | ### Output Example `{"status_code":200,"response_headers":{"Date":"Mon, 15 Jul 2024 05:04:03 GMT","Content-Type":"application/json","Transfer-Encoding":"chunked","Connection":"keep-alive","X-RateLimit-Remaining":"9","X-RateLimit-Requested-Tokens":"1","X-RateLimit-Burst-Capacity":"10","X-RateLimit-Replenish-Rate":"6","Access-Control-Allow-Origin":"*","Access-Control-Allow-Headers":"x-redlock-request-id,x-redlock-auth,rl-json-rule,terraform-version,terraform-012...","Access-Control-Allow-Methods":"POST, PUT, GET, OPT...` ## Asset Inventory View Retrieve compliance status for assets in Palo Alto Networks Prisma Cloud using specified filters. ### Endpoint - **URL:** `/v3/inventory` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ---------------------- | -------- | ------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `headers` | object | Optional | HTTP headers for the request | | `headers.Content-Type` | string | Optional | HTTP headers for the request | | `headers.Accept` | string | Optional | HTTP headers for the request | | `detailed` | boolean | Optional | Detailed. | | `fields` | array | Optional | Array of specific fields to return. | | `filters` | array | Optional | Parameter for Asset Inventory View | | `filters.name` | string | Required | Filter Name. | | `filters.operator` | string | Optional | Operator. | | `filters.value` | string | Optional | Value. | | `groupBy` | array | Optional | Comma-separated list of values by group response items. Valid values are cloud.type, cloud.account, cloud.region, cloud.service, and/or resource.type. Default is cloud.type. | | `limit` | number | Optional | Maximum number of items to return. | | `offset` | number | Optional | The number of items to skip before selecting items to return. | | `pageToken` | string | Optional | Setting this pagination Token to the nextPageToken from a response object returns the next page of data. | | `sortBy` | array | Optional | Array of sort properties. Append \:asc or \:desc to the key to sort by ascending or descending order respectively. | ### Input Example `{"json_body":{"detailed":true,"fields":["yter"],"filters":[{"name":"dwe","operator":"tag:yaml.org,2002:value =","value":"ewr"}],"groupBy":["cloud.type"],"limit":10000,"offset":0,"pageToken":"","sortBy":[""]},"headers":{"Content-Type":"application/json","Accept":"application/json"}}` ### Output | **Parameter** | **Type** | **Description** | | ----------------------------------------------- | -------- | ----------------------------------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `timestamp` | number | Output field: timestamp | | `requestedTimestamp` | number | Output field: requestedTimestamp | | `summary` | object | Output field: summary | | `summary.timestamp` | number | Output field: summary.timestamp | | `summary.failedResources` | number | Output field: summary.failedResources | | `summary.passedResources` | number | Output field: summary.passedResources | | `summary.totalResources` | number | Output field: summary.totalResources | | `summary.highSeverityFailedResources` | number | Output field: summary.highSeverityFailedResources | | `summary.mediumSeverityFailedResources` | number | Output field: summary.mediumSeverityFailedResources | | `summary.lowSeverityFailedResources` | number | Output field: summary.lowSeverityFailedResources | | `summary.criticalSeverityFailedResources` | number | Output field: summary.criticalSeverityFailedResources | | `summary.informationalSeverityFailedResources` | number | Output field: summary.informationalSeverityFailedResources | | `summary.criticalVulnerabilityFailedResources` | number | Output field: summary.criticalVulnerabilityFailedResources | | `summary.highVulnerabilityFailedResources` | number | Output field: summary.highVulnerabilityFailedResources | | `summary.mediumVulnerabilityFailedResources` | number | Output field: summary.mediumVulnerabilityFailedResources | | `summary.lowVulnerabilityFailedResources` | number | Output field: summary.lowVulnerabilityFailedResources | | `summary.totalVulnerabilityFailedResources` | number | Output field: summary.totalVulnerabilityFailedResources | | `groupedAggregates` | array | Output field: groupedAggregates | | `groupedAggregates.cloudTypeName` | string | Name of the resource | | `groupedAggregates.failedResources` | number | Output field: groupedAggregates.failedResources | | `groupedAggregates.passedResources` | number | Output field: groupedAggregates.passedResources | | `groupedAggregates.totalResources` | number | Output field: groupedAggregates.totalResources | | `groupedAggregates.highSeverityFailedResources` | number | Output field: groupedAggregates.highSeverityFailedResources | ### Output Example `{"status_code":200,"response_headers":{"Date":"Wed, 12 Jun 2024 10:00:18 GMT","Content-Type":"application/json","Transfer-Encoding":"chunked","Connection":"keep-alive","Access-Control-Allow-Origin":"*","Access-Control-Allow-Headers":"x-redlock-request-id,x-redlock-auth,rl-json-rule,terraform-version,terraform-012...","Access-Control-Allow-Methods":"POST, PUT, GET, OPTIONS, DELETE, PATCH","Access-Control-Expose-Headers":"x-redlock-auth,x-redlock-request-id,x-redlock-status, x-redlock-fileName,Con...` ## Create Asset Inventory Trend View V3 Generates a trend view of asset inventory pass/fail statistics in Palo Alto Networks Prisma Cloud, requiring a JSON body input. ### Endpoint - **URL:** `v3/inventory/trend` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------ | -------- | ------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `detailed` | boolean | Optional | Detailed. | | `fields` | array | Optional | Array of specific fields to return. | | `groupBy` | array | Optional | For asset or data inventory only. Group returned items by cloud.type, cloud.service, cloud.region, cloud.account, and/or resource.type. | | `filters` | array | Optional | Filtering parameters. | | `filters.name` | string | Optional | Name. | | `filters.value` | string | Optional | Value. | | `filters.operator` | string | Optional | Operator. | | `limit` | number | Optional | Maximum number of items to return. When data is paginated, maximum number of items per page.The maximum cannot exceed 10,000. | | `offset` | number | Optional | The number of items to skip before selecting items to return. | | `pageToken` | string | Optional | Setting this pagination Token to the nextPageToken from a response object returns the next page of data. | | `sortBy` | array | Optional | Array of sort properties. Append \:asc or \:desc to the key to sort by ascending or descending order respectively. Example sort properties are id\:asc and timestamp\:desc. | ### Input Example `{"json_body":{"detailed":true,"fields":["cloud.region"],"groupBy":["cloud.region,cloud.service"],"filters":[{"name":"cloud.region","value":"DynamoDB","operator":"="}],"limit":10,"offset":0,"pageToken":"vda3456fsERTE2345342","sortBy":["cloud.region"]}}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | ### Output Example `{"status_code":200,"response_headers":{"Date":"Mon, 08 Jul 2024 09:07:42 GMT","Content-Type":"application/json","Transfer-Encoding":"chunked","Connection":"keep-alive","Access-Control-Allow-Origin":"*","Access-Control-Allow-Headers":"x-redlock-request-id,x-redlock-auth,rl-json-rule,terraform-version,terraform-012...","Access-Control-Allow-Methods":"POST, PUT, GET, OPTIONS, DELETE, PATCH","Access-Control-Expose-Headers":"x-redlock-auth,x-redlock-request-id,x-redlock-status, x-redlock-fileName,Con...` ## Create On Demand Email Notification Generates an on-demand email notification for a specified alert in Palo Alto Networks Prisma Cloud using alertId and notification configuration. ### Endpoint - **URL:** `/alerts/api/v1/notification/ondemand` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------------------------------- | -------- | ------------ | --------------------------------------------------------------------------------------------------- | | `alertId` | string | Optional | Id of the alert for which Notification needs to be sent. | | `onDemandNotificationConfig` | object | Optional | Parameter for Create On Demand Email Notification | | `onDemandNotificationConfig.id` | string | Optional | Id of the alert for which Notification needs to be sent. | | `onDemandNotificationConfig.clientId` | string | Optional | Id to identify the category of request. For Jira, Email, Slack, it can be CS. | | `onDemandNotificationConfig.generatorType` | string | Optional | For ad-hoc notification, its value should be REALTIME. | | `onDemandNotificationConfig.integrationType` | string | Required | Can be either Jira, Email or Slack. | | `onDemandNotificationConfig.templateId` | string | Optional | Jira template Id. | | `onDemandNotificationConfig.recipients` | array | Required | List of Integration id for jira or email for email or channel for slack etc. | | `onDemandNotificationConfig.recipients.0` | string | Optional | Parameter for Create On Demand Email Notification | | `onDemandNotificationConfig.recipients.1` | string | Optional | Parameter for Create On Demand Email Notification | | `onDemandNotificationConfig.recipients.2` | string | Optional | Parameter for Create On Demand Email Notification | | `translation` | object | Optional | Parameter for Create On Demand Email Notification | | `translation.body` | string | Required | Message Body. Applicable for email and slack. | | `translation.details` | object | Required | Its a map of key-value pair. | | `translation.details.property name*` | string | Optional | Name of the resource | | `translation.attachments` | array | Optional | This field contains the list of paths to the S3 file from where the attachment needs to be fetched. | | `translation.attachments.0` | string | Optional | Parameter for Create On Demand Email Notification | | `translation.attachments.1` | string | Optional | Parameter for Create On Demand Email Notification | ### Input Example `{"json_body":{"alertId":"string","onDemandNotificationConfig":{"id":"string","clientId":"string","generatorType":"string","integrationType":"string","templateId":"string","recipients":[["email1","email2","email3"]]},"translation":{"body":"string","details":{"property name*":"string"},"attachments":[["attachmentUrl1","attachmentUrl2"]]}}}` ### Output | **Parameter** | **Type** | **Description** | | -------------------------------------------- | -------- | ------------------------------------ | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `success` | number | Whether the operation was successful | | `failed` | number | Output field: failed | | `successfulEvents` | array | Whether the operation was successful | | `successfulEvents.recipient` | object | Whether the operation was successful | | `successfulEvents.recipient.generatorType` | string | Type of the resource | | `successfulEvents.recipient.integrationType` | string | Type of the resource | | `successfulEvents.recipient.id` | string | Unique identifier | | `successfulEvents.customerId` | number | Unique identifier | | `successfulEvents.clientId` | string | Unique identifier | | `successfulEvents.id` | string | Unique identifier | | `successfulEvents.notificationId` | string | Unique identifier | | `failedEvents` | object | Output field: failedEvents | ### Output Example `{"status_code":201,"response_headers":{},"reason":"OK","json_body":{"success":1,"failed":0,"successfulEvents":[{}],"failedEvents":{}}}` ## Create On Demand Jira Notification Generates a Jira notification for a specified alert using the provided alertId and onDemandNotificationConfig. ### Endpoint - **URL:** `/alerts/api/v1/notification/ondemand` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------------------------------- | -------- | ------------ | --------------------------------------------------------------------------------------------------- | | `alertId` | string | Optional | Id of the alert for which Notification needs to be sent. | | `onDemandNotificationConfig` | object | Optional | Parameter for Create On Demand Jira Notification | | `onDemandNotificationConfig.id` | string | Optional | Id of the alert for which Notification needs to be sent. | | `onDemandNotificationConfig.clientId` | string | Optional | Id to identify the category of request. For Jira, Email, Slack, it can be CS. | | `onDemandNotificationConfig.generatorType` | string | Optional | For ad-hoc notification, its value should be REALTIME. | | `onDemandNotificationConfig.integrationType` | string | Required | Can be either Jira, Email or Slack. | | `onDemandNotificationConfig.templateId` | string | Required | Jira template Id. | | `onDemandNotificationConfig.recipients` | array | Required | List of Integration id for jira or email for email or channel for slack etc. | | `onDemandNotificationConfig.recipients.0` | string | Optional | Parameter for Create On Demand Jira Notification | | `onDemandNotificationConfig.recipients.1` | string | Optional | Parameter for Create On Demand Jira Notification | | `onDemandNotificationConfig.recipients.2` | string | Optional | Parameter for Create On Demand Jira Notification | | `translation` | object | Optional | Parameter for Create On Demand Jira Notification | | `translation.body` | string | Optional | Message Body. Applicable for email and slack. | | `translation.details` | object | Optional | Its a map of key-value pair. | | `translation.details.property name*` | string | Optional | Name of the resource | | `translation.attachments` | array | Optional | This field contains the list of paths to the S3 file from where the attachment needs to be fetched. | | `translation.attachments.0` | string | Optional | Parameter for Create On Demand Jira Notification | | `translation.attachments.1` | string | Optional | Parameter for Create On Demand Jira Notification | ### Input Example `{"json_body":{"alertId":"string","onDemandNotificationConfig":{"id":"string","clientId":"string","generatorType":"string","integrationType":"string","templateId":"string","recipients":[["email1","email2","email3"]]},"translation":{"body":"string","details":{"property name*":"string"},"attachments":[["attachmentUrl1","attachmentUrl2"]]}}}` ### Output | **Parameter** | **Type** | **Description** | | -------------------------------------------- | -------- | ------------------------------------ | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `success` | number | Whether the operation was successful | | `failed` | number | Output field: failed | | `successfulEvents` | array | Whether the operation was successful | | `successfulEvents.recipient` | object | Whether the operation was successful | | `successfulEvents.recipient.generatorType` | string | Type of the resource | | `successfulEvents.recipient.integrationType` | string | Type of the resource | | `successfulEvents.recipient.id` | string | Unique identifier | | `successfulEvents.customerId` | number | Unique identifier | | `successfulEvents.clientId` | string | Unique identifier | | `successfulEvents.metaData` | object | Response data | | `successfulEvents.metaData.jiraKey` | string | Response data | | `successfulEvents.notificationId` | string | Unique identifier | | `failedEvents` | object | Output field: failedEvents | ### Output Example `{"status_code":201,"response_headers":{},"reason":"OK","json_body":{"success":1,"failed":0,"successfulEvents":[{}],"failedEvents":{}}}` ## Create On Demand Slack Notification Create an on-demand Slack notification for a specific alert in Palo Alto Networks Prisma Cloud using alertId and notification configuration. ### Endpoint - **URL:** `/alerts/api/v1/notification/ondemand` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------------------------------- | -------- | ------------ | --------------------------------------------------------------------------------------------------- | | `alertId` | string | Optional | Id of the alert for which Notification needs to be sent. | | `onDemandNotificationConfig` | object | Optional | Parameter for Create On Demand Slack Notification | | `onDemandNotificationConfig.id` | string | Optional | Id of the alert for which Notification needs to be sent. | | `onDemandNotificationConfig.clientId` | string | Optional | Id to identify the category of request. For Jira, Email, Slack, it can be CS. | | `onDemandNotificationConfig.generatorType` | string | Optional | For ad-hoc notification, its value should be REALTIME. | | `onDemandNotificationConfig.integrationType` | string | Required | Can be either Jira, Email or Slack. | | `onDemandNotificationConfig.templateId` | string | Optional | Jira template Id. | | `onDemandNotificationConfig.recipients` | array | Required | List of Integration id for jira or email for email or channel for slack etc. | | `onDemandNotificationConfig.recipients.0` | string | Optional | Parameter for Create On Demand Slack Notification | | `onDemandNotificationConfig.recipients.1` | string | Optional | Parameter for Create On Demand Slack Notification | | `onDemandNotificationConfig.recipients.2` | string | Optional | Parameter for Create On Demand Slack Notification | | `translation` | object | Optional | Parameter for Create On Demand Slack Notification | | `translation.body` | string | Required | Message Body. Applicable for email and slack. | | `translation.details` | object | Required | Its a map of key-value pair. | | `translation.details.property name*` | string | Optional | Name of the resource | | `translation.attachments` | array | Optional | This field contains the list of paths to the S3 file from where the attachment needs to be fetched. | | `translation.attachments.0` | string | Optional | Parameter for Create On Demand Slack Notification | | `translation.attachments.1` | string | Optional | Parameter for Create On Demand Slack Notification | ### Input Example `{"json_body":{"alertId":"string","onDemandNotificationConfig":{"id":"string","clientId":"string","generatorType":"string","integrationType":"string","templateId":"string","recipients":[["email1","email2","email3"]]},"translation":{"body":"string","details":{"property name*":"string"},"attachments":[["attachmentUrl1","attachmentUrl2"]]}}}` ### Output | **Parameter** | **Type** | **Description** | | -------------------------------------------- | -------- | ------------------------------------ | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `success` | number | Whether the operation was successful | | `failed` | number | Output field: failed | | `successfulEvents` | array | Whether the operation was successful | | `successfulEvents.recipient` | object | Whether the operation was successful | | `successfulEvents.recipient.generatorType` | string | Type of the resource | | `successfulEvents.recipient.integrationType` | string | Type of the resource | | `successfulEvents.recipient.id` | string | Unique identifier | | `successfulEvents.customerId` | number | Unique identifier | | `successfulEvents.clientId` | string | Unique identifier | | `successfulEvents.id` | string | Unique identifier | | `successfulEvents.notificationId` | string | Unique identifier | | `failedEvents` | object | Output field: failedEvents | ### Output Example `{"status_code":201,"response_headers":{},"reason":"OK","json_body":{"success":1,"failed":0,"successfulEvents":[{}],"failedEvents":{}}}` ## Create Remediation Request Initiate remediation for assets in Palo Alto Networks Prisma Cloud by creating tasks, Jira tickets, merge requests, or suppressing vulnerabilities. ### Endpoint - **URL:** `uve/api/v1/remediation/vuln-create-remediation` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | --------------------- | -------- | ------------ | --------------------------------------------------------------- | | `headers` | object | Optional | HTTP headers for the request | | `headers.template-id` | string | Optional | JIRA ID. Required only for createTask remediation action. | | `headers.assignee` | string | Optional | JIRA assignee. Required only for createTask remediation action. | | `cveId` | string | Optional | CVE ID of the vulnerability. | | `prismaId` | string | Optional | Prisma ID of the customer. | | `remediationAction` | string | Optional | Create a JIRA/task, create a PR, or suppress the vulnerability. | | `assetType` | string | Optional | Asset type. Required only for group level remediation. | | `assetId` | array | Optional | Asset IDs. Required only for asset level remediation. | | `assetId.assetType` | string | Optional | Asset type. | | `assetId.assetId` | string | Optional | UAI ID of the asset. | ### Input Example `{"json_body":{"cveId":"CVE-2021-44228","prismaId":"807152287759069184","remediationAction":"createTask","assetType":"iac","assetId":[{"assetType":"iac","assetId":"807152287759069184"}]},"headers":{"template-id":"b17d66dd-2f8c-46f0-be1a-b3e21ba7990c","assignee":"Test"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `message` | string | Response message | | `details` | string | Output field: details | | `timeStamp` | number | Output field: timeStamp | | `request_id` | string | Unique identifier | ### Output Example `{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"message":"ACCEPTED","details":"test","timeStamp":1701778720128,"request_id":"b17d66dd-2f8c-46f0-be1a-b3e21ba7990c"}}` ## Delete Account Group Removes a specified account group from Palo Alto Networks Prisma Cloud using the unique ID provided. ### Endpoint - **URL:** `/cloud/group/{{id}}` - **Method:** `DELETE` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------- | -------- | ------------ | ----------------- | | `path_parameters.id` | string | Required | Account Group ID. | ### Input Example `{"path_parameters":{"id":"59c8256b-835b-4868-9d3e-0c679a2cf421"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | ### Output Example `{"status_code":200,"response_headers":{},"reason":"OK","json_body":{}}` ## Delete Saved Asset Inventory Filter Deletes a specified saved asset inventory filter in Palo Alto Networks Prisma Cloud using the unique ID provided. ### Endpoint - **URL:** `filter/inventory/{{id}}` - **Method:** `DELETE` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------- | -------- | ------------ | ------------------- | | `path_parameters.id` | string | Required | Asset Inventory ID. | ### Input Example `{"path_parameters":{"id":"AWS_ALL_DynamoDB"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | ### Output Example `{"status_code":200,"response_headers":{},"reason":"OK","json_body":{}}` ## Dismiss Alerts Dismiss or snooze alerts on the Prisma Cloud platform based on specified filters and optional time range. ### Endpoint - **URL:** `/alert/dismiss` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------------------- | -------- | ------------ | -------------------------------------------------------------------------------------------------------- | | `alerts` | array | Optional | Alert IDs. | | `dismissalNote` | string | Optional | Reason for dismissal. | | `dismissalTimeRange` | object | Optional | Parameter for Dismiss Alerts | | `dismissalTimeRange.type` | string | Required | Type of the resource | | `dismissalTimeRange.relativeTimeType` | string | Optional | Direction in which to count time. | | `dismissalTimeRange.value` | object | Required | Model for RelativeTimeDuration. | | `dismissalTimeRange.value.amount` | number | Optional | Number of time units. | | `dismissalTimeRange.value.unit` | string | Optional | Time unit. | | `filter` | object | Optional | Model for Filter. | | `filter.detailed` | boolean | Optional | Detailed. | | `filter.fields` | array | Optional | Array of specific fields to return. | | `filter.filters` | array | Optional | Filtering parameters. | | `filter.filters.name` | string | Optional | Name. | | `filter.filters.operator` | string | Optional | Operator. | | `filter.filters.value` | string | Optional | Value. | | `filter.groupBy` | array | Optional | For asset or data inventory only. | | `filter.limit` | number | Optional | Maximum number of items to return. | | `filter.offset` | number | Optional | The number of items to skip before selecting items to return. | | `filter.pageToken` | string | Optional | Setting this pagination Token to the nextPageToken from a response object returns the next page of data. | | `filter.sortBy` | array | Optional | Array of sort properties. | | `filter.timeRange` | object | Required | Parameter for Dismiss Alerts | | `filter.timeRange.relativeTimeType` | string | Optional | Direction in which to count time. | | `filter.timeRange.type` | string | Optional | Type of the resource | | `filter.timeRange.value` | object | Required | Model for RelativeTimeDuration. | | `filter.timeRange.value.amount` | number | Optional | Number of time units. | ### Input Example `{"json_body":{"alerts":["P-411652775"],"dismissalNote":"string","dismissalTimeRange":{"type":"relative","relativeTimeType":"BACKWARD","value":{"amount":0,"unit":"minute"}},"filter":{"detailed":true,"fields":["string"],"filters":[{"name":"string","operator":"=","value":"string"}],"groupBy":["cloud.type"],"limit":0,"offset":0,"pageToken":"string","sortBy":["id:asc","timestamp:desc"],"timeRange":{"relativeTimeType":"BACKWARD","type":"relative","value":{"amount":0,"unit":"minute"}}},"policies":["string"]}}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | ### Output Example `{"status_code":200,"response_headers":{},"reason":"OK","json_body":{}}` ## Download Alert CSV Downloads a CSV file containing the alert list generated by Prisma Cloud for a given job ID. ### Endpoint - **URL:** `/alert/csv/{{id}}/download` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------- | -------- | ------------ | --------------- | | `path_parameters.id` | string | Required | Job ID. | ### Input Example `{"path_parameters":{"id":"937771fea1964b3ab1c768dc62ef6789"}}` ### Output | **Parameter** | **Type** | **Description** | | ---------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `file` | object | Attachment | | `file.file` | string | Output field: file.file | | `file.file_name` | string | Name of the resource | ### Output Example `{"status_code":200,"response_headers":{},"reason":"OK","json_body":{}}` ## Download Alerts List JSON Downloads a JSON-formatted list of alerts for a given job ID from Palo Alto Networks Prisma Cloud. ### Endpoint - **URL:** `/alert/jobs/{{id}}/download` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------- | -------- | ------------ | --------------- | | `path_parameters.id` | string | Required | Job ID. | ### Input Example `{"path_parameters":{"id":"e09b247a62af4e0aafd4bf4c4b12fec7"}}` ### Output | **Parameter** | **Type** | **Description** | | ---------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `file` | object | Attachment | | `file.file` | string | Output field: file.file | | `file.file_name` | string | Name of the resource | ### Output Example `{"status_code":200,"response_headers":{},"reason":"OK","json_body":{}}` ## Download Policy Alerts JSON Downloads policy alerts in JSON format from Palo Alto Networks Prisma Cloud using a specific job ID. ### Endpoint - **URL:** `/alert/policy/jobs/{{id}}/download` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------- | -------- | ------------ | --------------- | | `path_parameters.id` | string | Required | Job ID. | ### Input Example `{"path_parameters":{"id":"b70ac365a19446a59da964785d03142d"}}` ### Output | **Parameter** | **Type** | **Description** | | ---------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `file` | object | Attachment | | `file.file` | string | Output field: file.file | | `file.file_name` | string | Name of the resource | ### Output Example `{"status_code":200,"response_headers":{"Date":"Thu, 11 Jul 2024 05:54:19 GMT","Content-Type":"application/json;charset=utf-8","Content-Length":"22","Connection":"keep-alive","Access-Control-Allow-Origin":"*","Access-Control-Allow-Headers":"x-redlock-request-id,x-redlock-auth,rl-json-rule,terraform-version,terraform-012...","Access-Control-Allow-Methods":"POST, PUT, GET, OPTIONS, DELETE, PATCH","Access-Control-Expose-Headers":"x-redlock-auth,x-redlock-request-id,x-redlock-status, x-redlock-fileNa...` ## Get Alert Count by Policy Groups Retrieve the count of alerts for policy groups in Palo Alto Networks Prisma Cloud within a specified time range. ### Endpoint - **URL:** `/alert/v1/aggregate` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | --------------------------- | -------- | ------------ | ------------------------------------------------------------------------------------------------------ | | `filters` | array | Optional | Filter parameters. | | `filters.name` | string | Optional | Name of the resource | | `filters.value` | string | Optional | Value for the parameter | | `filters.operator` | string | Optional | Parameter for Get Alert Count by Policy Groups | | `sortBy` | array | Optional | Array of sort properties. | | `groupBy` | string | Optional | Group by field. | | `size` | number | Optional | Maximum number of items to return per page when data is paginated. The value cannot exceed 500. | | `nextPageToken` | string | Optional | The nextPageToken value from the previous response object, which is used to get the next page of data. | | `timeRange` | object | Optional | Parameter for Get Alert Count by Policy Groups | | `timeRange.Time type` | string | Optional | Time type. | | `timeRange.Time value` | object | Optional | Value for the parameter | | `timeRange.Field for range` | string | Optional | Field for range. | | `timeRange.type` | string | Required | Type of the resource | | `timeRange.value` | object | Optional | Value for the parameter | | `timeRange.value.startTime` | number | Optional | Value for the parameter | | `timeRange.value.endTime` | number | Optional | Value for the parameter | ### Input Example `{"json_body":{"filters":[{"name":"string","value":"string","operator":"string"}],"sortBy":["string"],"groupBy":"policy.type","size":0,"nextPageToken":"string","timeRange":{"Time type":"to_now,absolute,relative,from_now","Time value":{},"Field for range":"lastStatusChangeTs","type":"string","value":{"startTime":0,"endTime":0}}}}` ### Output | **Parameter** | **Type** | **Description** | | -------------------------------- | -------- | ---------------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `groups` | array | Output field: groups | | `groups.group` | string | Output field: groups.group | | `groups.totalAlerts` | number | Output field: groups.totalAlerts | | `groups.totalPolicies` | number | Output field: groups.totalPolicies | | `groups.criticalAlertCount` | number | Count value | | `groups.highAlertCount` | number | Count value | | `groups.mediumAlertCount` | number | Count value | | `groups.lowAlertCount` | number | Count value | | `groups.informationalAlertCount` | number | Count value | | `groups.buildPolicyCount` | number | Count value | | `groups.runPolicyCount` | number | Count value | | `groups.findingTypes` | array | Type of the resource | | `groups.cloudTypes` | array | Type of the resource | | `groups.policyIds` | array | Unique identifier | | `groupBy` | string | Output field: groupBy | | `countDetails` | object | Output field: countDetails | | `countDetails.totalAlerts` | number | Output field: countDetails.totalAlerts | | `countDetails.totalPolicies` | number | Output field: countDetails.totalPolicies | | `nextPageToken` | string | Output field: nextPageToken | ### Output Example `{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"groups":[{}],"groupBy":"string","countDetails":{"totalAlerts":100,"totalPolicies":30},"nextPageToken":"string"}}` ## Get Alert Count of Policies Retrieve a count of alerts per policy from Palo Alto Networks Prisma Cloud within a specified time range. ### Endpoint - **URL:** `/alert/v1/policy` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | --------------------------- | -------- | ------------ | ------------------------------------------------------------------------------------------------------ | | `filters` | array | Optional | Filter parameters. | | `filters.name` | string | Optional | Name of the resource | | `filters.value` | string | Optional | Value for the parameter | | `filters.operator` | string | Optional | Parameter for Get Alert Count of Policies | | `sortBy` | array | Optional | Array of sort properties. | | `groupBy` | string | Optional | Group by field. | | `size` | number | Optional | Maximum number of items to return per page when data is paginated. The value cannot exceed 500. | | `nextPageToken` | string | Optional | The nextPageToken value from the previous response object, which is used to get the next page of data. | | `timeRange` | object | Optional | Parameter for Get Alert Count of Policies | | `timeRange.Time type` | string | Optional | Time type. | | `timeRange.Time value` | object | Optional | Value for the parameter | | `timeRange.Field for range` | string | Optional | Field for range. | | `timeRange.type` | string | Required | Type of the resource | | `timeRange.value` | object | Optional | Value for the parameter | | `timeRange.value.startTime` | number | Optional | Value for the parameter | | `timeRange.value.endTime` | number | Optional | Value for the parameter | ### Input Example `{"json_body":{"filters":[{"name":"string","value":"string","operator":"string"}],"sortBy":["id:asc"],"groupBy":"policy.type","size":50,"nextPageToken":"string","timeRange":{"Time type":"to_now","Time value":{},"Field for range":"lastStatusChangeTs","type":"string","value":{"startTime":0,"endTime":0}}}}` ### Output | **Parameter** | **Type** | **Description** | | ---------------------------------------------------- | -------- | ----------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `policies` | array | Output field: policies | | `policies.alertCount` | number | Count value | | `policies.policyId` | string | Unique identifier | | `policies.policyName` | string | Name of the resource | | `policies.policyType` | string | Type of the resource | | `policies.severity` | string | Output field: policies.severity | | `policies.policyLabels` | array | Output field: policies.policyLabels | | `policies.complianceMetadata` | array | Response data | | `policies.complianceMetadata.standardName` | string | Response data | | `policies.complianceMetadata.standardDescription` | string | Response data | | `policies.complianceMetadata.requirementId` | string | Response data | | `policies.complianceMetadata.requirementName` | string | Response data | | `policies.complianceMetadata.requirementDescription` | string | Response data | | `policies.complianceMetadata.sectionId` | string | Response data | | `policies.complianceMetadata.sectionDescription` | string | Response data | | `policies.complianceMetadata.policyId` | string | Response data | | `policies.complianceMetadata.complianceId` | string | Response data | | `policies.complianceMetadata.sectionLabel` | string | Response data | | `policies.complianceMetadata.sectionViewOrder` | number | Response data | | `policies.complianceMetadata.requirementViewOrder` | number | Response data | | `policies.complianceMetadata.systemDefault` | boolean | Response data | | `policies.complianceMetadata.policyName` | string | Response data | | `policies.complianceMetadata.customAssigned` | boolean | Response data | ### Output Example `{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"policies":[{}],"countDetails":{"totalAlerts":100,"totalPolicies":30},"nextPageToken":"string"}}` ## Get Alert CSV Job Status Retrieve the current status of a CSV generation job for alerts in Palo Alto Networks Prisma Cloud using the specified job ID. ### Endpoint - **URL:** `/alert/csv/{{id}}/status` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------- | -------- | ------------ | -------------------------------------------------- | | `path_parameters.id` | string | Required | Parameters for the Get Alert CSV Job Status action | ### Input Example `{"path_parameters":{"id":"937771fea1964b3ab1c768dc62ef6789"}}` ### Output | **Parameter** | **Type** | **Description** | | -------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `id` | string | Unique identifier | | `customerId` | number | Unique identifier | | `status` | string | Status value | | `createdBy` | string | Output field: createdBy | | `createdOn` | number | Output field: createdOn | | `lastModified` | number | Output field: lastModified | | `statusUri` | string | Status value | ### Output Example `{"status_code":200,"response_headers":{"Date":"Thu, 11 Jul 2024 05:22:33 GMT","Content-Type":"application/json;charset=utf-8","Transfer-Encoding":"chunked","Connection":"keep-alive","Access-Control-Allow-Origin":"*","Access-Control-Allow-Headers":"x-redlock-request-id,x-redlock-auth,rl-json-rule,terraform-version,terraform-012...","Access-Control-Allow-Methods":"POST, PUT, GET, OPTIONS, DELETE, PATCH","Access-Control-Expose-Headers":"x-redlock-auth,x-redlock-request-id,x-redlock-status, x-redloc...` ## Get Alert Evidence Graph Retrieve the alert evidence graph in JSON format for a specific alert ID from Palo Alto Networks Prisma Cloud. ### Endpoint - **URL:** `/alert/v1/{{id}}/graph` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------- | -------- | ------------ | ----------------------------------- | | `path_parameters.id` | string | Required | The alert id of the evidence graph. | ### Input Example `{"path_parameters":{"id":"b70ac365a19446a59da964785d03142d"}}` ### Output | **Parameter** | **Type** | **Description** | | -------------------------------------- | -------- | --------------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `graphs` | array | Output field: graphs | | `graphs.graph` | object | Output field: graphs.graph | | `graphs.graph.nodes` | object | Output field: graphs.graph.nodes | | `graphs.graph.edges` | array | Output field: graphs.graph.edges | | `graphs.graph.edges.id` | string | Unique identifier | | `graphs.graph.edges.source` | string | Output field: graphs.graph.edges.source | | `graphs.graph.edges.target` | string | Output field: graphs.graph.edges.target | | `graphs.graph.edges.metadata` | object | Response data | | `graphs.graph.edges.metadata.severity` | string | Response data | | `nextPageToken` | string | Output field: nextPageToken | ### Output Example `{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"graphs":[{}],"nextPageToken":"string"}}` ## Get Alert Rule by ID Retrieve details for a specific alert rule in Palo Alto Networks Prisma Cloud using the provided ID. ### Endpoint - **URL:** `/alert/rule/{{id}}` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------- | -------- | ------------ | --------------- | | `path_parameters.id` | string | Required | Alert rule ID. | ### Input Example `{"path_parameters":{"id":"01bf3f5b-3f5f-483b-8015-7be30cf280a6"}}` ### Output | **Parameter** | **Type** | **Description** | | ----------------------------------- | -------- | ------------------------------------------ | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `policyScanConfigId` | string | Unique identifier | | `name` | string | Name of the resource | | `description` | string | Output field: description | | `enabled` | boolean | Output field: enabled | | `scanAll` | boolean | Output field: scanAll | | `policies` | array | Output field: policies | | `policyLabels` | array | Output field: policyLabels | | `policyLabels.file_name` | string | Name of the resource | | `policyLabels.file` | string | Output field: policyLabels.file | | `excludedPolicies` | array | Output field: excludedPolicies | | `excludedPolicies.file_name` | string | Name of the resource | | `excludedPolicies.file` | string | Output field: excludedPolicies.file | | `target` | object | Output field: target | | `target.accountGroups` | array | Output field: target.accountGroups | | `target.excludedAccounts` | array | Output field: target.excludedAccounts | | `target.excludedAccounts.file_name` | string | Name of the resource | | `target.excludedAccounts.file` | string | Output field: target.excludedAccounts.file | | `target.regions` | array | Output field: target.regions | | `target.regions.file_name` | string | Name of the resource | | `target.regions.file` | string | Output field: target.regions.file | | `target.tags` | array | Output field: target.tags | | `target.tags.file_name` | string | Name of the resource | | `target.tags.file` | string | Output field: target.tags.file | ### Output Example `{"status_code":200,"response_headers":{"Date":"Mon, 08 Jul 2024 14:34:26 GMT","Content-Type":"application/json;charset=utf-8","Transfer-Encoding":"chunked","Connection":"keep-alive","Access-Control-Allow-Origin":"*","Access-Control-Allow-Headers":"x-redlock-request-id,x-redlock-auth,rl-json-rule,terraform-version,terraform-012...","Access-Control-Allow-Methods":"POST, PUT, GET, OPTIONS, DELETE, PATCH","Access-Control-Expose-Headers":"x-redlock-auth,x-redlock-request-id,x-redlock-status, x-redloc...` ## Get Alerts Count By Status Retrieve the count of Palo Alto Networks Prisma Cloud alerts filtered by a specific status. ### Endpoint - **URL:** `/alert/count/{{status}}` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------ | -------- | ------------ | --------------- | | `path_parameters.status` | string | Required | Alert Status. | ### Input Example `{"path_parameters":{"status":"open"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `count` | number | Count value | ### Output Example `{"status_code":200,"response_headers":{"Date":"Wed, 10 Jul 2024 12:46:53 GMT","Content-Type":"application/json","Transfer-Encoding":"chunked","Connection":"keep-alive","X-RateLimit-Remaining":"9","X-RateLimit-Requested-Tokens":"1","X-RateLimit-Burst-Capacity":"10","X-RateLimit-Replenish-Rate":"3","Access-Control-Allow-Origin":"*","Access-Control-Allow-Headers":"x-redlock-request-id,x-redlock-auth,rl-json-rule,terraform-version,terraform-012...","Access-Control-Allow-Methods":"POST, PUT, GET, OPT...` ## Get Alerts List Job Status Retrieve the current status of a specific alerts list job in Palo Alto Networks Prisma Cloud using the job ID. ### Endpoint - **URL:** `/alert/jobs/{{id}}/status` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------- | -------- | ------------ | ---------------------------------------------------- | | `path_parameters.id` | string | Required | Parameters for the Get Alerts List Job Status action | ### Input Example `{"path_parameters":{"id":"a5bb74f1876d43bd971369d3349fcc07"}}` ### Output | **Parameter** | **Type** | **Description** | | -------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `id` | string | Unique identifier | | `customerId` | number | Unique identifier | | `status` | string | Status value | | `createdBy` | string | Output field: createdBy | | `createdOn` | number | Output field: createdOn | | `lastModified` | number | Output field: lastModified | | `statusUri` | string | Status value | ### Output Example `{"status_code":200,"response_headers":{"Date":"Thu, 11 Jul 2024 04:00:32 GMT","Content-Type":"application/json;charset=utf-8","Transfer-Encoding":"chunked","Connection":"keep-alive","Access-Control-Allow-Origin":"*","Access-Control-Allow-Headers":"x-redlock-request-id,x-redlock-auth,rl-json-rule,terraform-version,terraform-012...","Access-Control-Allow-Methods":"POST, PUT, GET, OPTIONS, DELETE, PATCH","Access-Control-Expose-Headers":"x-redlock-auth,x-redlock-request-id,x-redlock-status, x-redloc...` ## Get Asset Inventory Trend View V3 Retrieve pass/fail trends of asset inventory from Palo Alto Networks Prisma Cloud, based on specified parameters. ### Endpoint - **URL:** `v3/inventory/trend` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------------------------------- | -------- | ------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `parameters.cloud.account` | string | Optional | Cloud account. | | `parameters.account.group` | string | Optional | Account group. | | `parameters.cloud.type` | string | Optional | Cloud type. | | `parameters.cloud.region` | string | Optional | Cloud region. | | `parameters.cloud.service` | string | Optional | Cloud service. | | `parameters.resource.type` | string | Optional | Resource type. | | `parameters.groupBy` | string | Optional | Comma-separated list of values by to group response items. Valid values are cloud.type, cloud.account, cloud.region, cloud.service, and/or resource.type. Default is cloud.type. | | `parameters.scan.status` | string | Optional | Whether or not the resources passed or failed the scan. All includes both scanned and unscanned resources. | | `parameters.policy.complianceStandard` | string | Optional | Policy compliance standard name. | | `parameters.policy.complianceRequirement` | string | Optional | Policy compliance requirement name. | | `parameters.asset.severity` | string | Optional | Policy severity. | | `parameters.vulnerability.severity` | string | Optional | Vulnerability Severity. | ### Input Example `{"parameters":{"cloud.account":"Test","account.group":" group","cloud.type":"gcp","cloud.region":"GCP Global","cloud.service":"Test service","resource.type":"Test Resource Type","groupBy":"cloud.account,cloud.service","scan.status":"all","policy.complianceStandard":"Compliance Standard","policy.complianceRequirement":"Policy Compliance Requirement","asset.severity":"high","vulnerability.severity":"high"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | ### Output Example `[]` ## Get Asset Inventory View V3 Retrieve pass/fail compliance data for assets within Palo Alto Networks Prisma Cloud using specified parameters. ### Endpoint - **URL:** `v3/inventory` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------------------------------- | -------- | ------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `parameters.cloud.account` | string | Optional | Cloud account. | | `parameters.account.group` | string | Optional | Account group. | | `parameters.cloud.type` | string | Optional | Cloud type. | | `parameters.cloud.region` | string | Optional | Cloud region. | | `parameters.cloud.service` | string | Optional | Cloud service. | | `parameters.resource.type` | string | Optional | Resource type. | | `parameters.groupBy` | string | Optional | Comma-separated list of values by to group response items. Valid values are cloud.type, cloud.account, cloud.region, cloud.service, and/or resource.type. Default is cloud.type. | | `parameters.scan.status` | string | Optional | Whether or not the resources passed or failed the scan. All includes both scanned and unscanned resources. | | `parameters.policy.complianceStandard` | string | Optional | Policy compliance standard name. | | `parameters.policy.complianceRequirement` | string | Optional | Policy compliance requirement name. | | `parameters.asset.severity` | string | Optional | Policy severity. | | `parameters.vulnerability.severity` | string | Optional | Vulnerability Severity. | ### Input Example `{"parameters":{"cloud.account":"Test","account.group":" group","cloud.type":"gcp","cloud.region":"GCP Global","cloud.service":"Test service","resource.type":"Test Resource Type","groupBy":"cloud.account,cloud.service","scan.status":"all","policy.complianceStandard":"Compliance Standard","policy.complianceRequirement":"Policy Compliance Requirement","asset.severity":"high","vulnerability.severity":"high"}}` ### Output | **Parameter** | **Type** | **Description** | | ----------------------------------------------- | -------- | ----------------------------------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `timestamp` | number | Output field: timestamp | | `requestedTimestamp` | number | Output field: requestedTimestamp | | `summary` | object | Output field: summary | | `summary.timestamp` | number | Output field: summary.timestamp | | `summary.failedResources` | number | Output field: summary.failedResources | | `summary.passedResources` | number | Output field: summary.passedResources | | `summary.totalResources` | number | Output field: summary.totalResources | | `summary.highSeverityFailedResources` | number | Output field: summary.highSeverityFailedResources | | `summary.mediumSeverityFailedResources` | number | Output field: summary.mediumSeverityFailedResources | | `summary.lowSeverityFailedResources` | number | Output field: summary.lowSeverityFailedResources | | `summary.criticalSeverityFailedResources` | number | Output field: summary.criticalSeverityFailedResources | | `summary.informationalSeverityFailedResources` | number | Output field: summary.informationalSeverityFailedResources | | `summary.criticalVulnerabilityFailedResources` | number | Output field: summary.criticalVulnerabilityFailedResources | | `summary.highVulnerabilityFailedResources` | number | Output field: summary.highVulnerabilityFailedResources | | `summary.mediumVulnerabilityFailedResources` | number | Output field: summary.mediumVulnerabilityFailedResources | | `summary.lowVulnerabilityFailedResources` | number | Output field: summary.lowVulnerabilityFailedResources | | `summary.totalVulnerabilityFailedResources` | number | Output field: summary.totalVulnerabilityFailedResources | | `groupedAggregates` | array | Output field: groupedAggregates | | `groupedAggregates.cloudTypeName` | string | Name of the resource | | `groupedAggregates.failedResources` | number | Output field: groupedAggregates.failedResources | | `groupedAggregates.passedResources` | number | Output field: groupedAggregates.passedResources | | `groupedAggregates.totalResources` | number | Output field: groupedAggregates.totalResources | | `groupedAggregates.highSeverityFailedResources` | number | Output field: groupedAggregates.highSeverityFailedResources | ### Output Example `{"status_code":200,"response_headers":{"Date":"Mon, 08 Jul 2024 06:36:25 GMT","Content-Type":"application/json;charset=utf-8","Transfer-Encoding":"chunked","Connection":"keep-alive","Access-Control-Allow-Origin":"*","Access-Control-Allow-Headers":"x-redlock-request-id,x-redlock-auth,rl-json-rule,terraform-version,terraform-012...","Access-Control-Allow-Methods":"POST, PUT, GET, OPTIONS, DELETE, PATCH","Access-Control-Expose-Headers":"x-redlock-auth,x-redlock-request-id,x-redlock-status, x-redloc...` ## Get Cloud Identity Inventory Related Assets Retrieve assets associated with a specific Cloud Identity Inventory resource by using the provided asset\_id. ### Endpoint - **URL:** `iam/api/v1/asset/{{asset_id}}/related-asset` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------------- | -------- | ------------ | ---------------------------------------------------------------------------- | | `path_parameters.asset_id` | string | Required | The asset UAI where you want to find it related assets. | | `parameters.limit` | number | Optional | Query client records limit, return MAX(0, MIN(client.limit, service.limit)). | | `relationshipType` | string | Optional | Relationship Type. | | `lastAccessFromTime` | number | Optional | Last accessed From epoch (epoch). | | `lastAccessToTime` | number | Optional | Last accessed To epoch (epoch). | | `nextPageToken` | string | Optional | Page Token. | ### Input Example `{"parameters":{"limit":5},"json_body":{"relationshipType":"AWS_POLICY_ROLE","lastAccessFromTime":1678785157,"lastAccessToTime":1678785157,"nextPageToken":"++fdfkjsdlfsdfdFDSFDFSDFdfdssfdFDS"},"path_parameters":{"asset_id":"681390424b288d835f5cd03e7bfb0993"}}` ### Output | **Parameter** | **Type** | **Description** | | ----------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `items` | array | Output field: items | | `items.targetAssetId` | string | Unique identifier | | `items.targetCloudResourceId` | string | Unique identifier | | `items.targetDisplayName` | string | Name of the resource | | `items.targetResourceType` | string | Type of the resource | | `items.lastAccessDate` | string | Date value | | `items.lastAccessStatus` | string | Status value | | `items.grantedByLevelType` | string | Type of the resource | | `nextPageToken` | string | Output field: nextPageToken | | `totalRows` | number | Output field: totalRows | ### Output Example `{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"items":[{}],"nextPageToken":"iam/api/{apiVersion}/{apiPath}?page-token=Q74589g444gg","totalRows":1243}}` ## Get CVE Details by ID Retrieve detailed CVE information and impacted assets from Palo Alto Networks Prisma Cloud in GZIP CSV format, requiring a specific cveId. ### Endpoint - **URL:** `uve/api/v1/vulnerabilities/download` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------- | -------- | ------------ | --------------------- | | `cveId` | string | Optional | CVE ID. | | `riskFactors` | array | Optional | List of risk factors. | | `assetType` | string | Optional | Asset type. | ### Input Example `{"json_body":{"cveId":"CVE-2021-44228","riskFactors":["risk factor"],"assetType":"package"}}` ### Output | **Parameter** | **Type** | **Description** | | ---------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `file` | object | Attachment | | `file.file` | string | Output field: file.file | | `file.file_name` | string | Name of the resource | ### Output Example `{"status_code":200,"response_headers":{},"reason":"OK","file":{}}` ## Get CVE Overview V2 Retrieve detailed information for a given CVE ID, including EPSS, CVSS scores, and exploits from Palo Alto Networks Prisma Cloud. ### Endpoint - **URL:** `uve/api/v1/cve-overview` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------- | -------- | ------------ | --------------- | | `parameters.cve_id` | string | Required | CVE ID. | ### Input Example `{"parameters":{"cve_id":"CVE-2021-44228"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------------------------------------- | -------- | ------------------------------------------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `cveId` | string | Unique identifier | | `cvss` | number | Output field: cvss | | `lifeCycle` | array | Output field: lifeCycle | | `riskFactors` | array | Output field: riskFactors | | `severity` | string | Output field: severity | | `impactedDistrosList` | array | Output field: impactedDistrosList | | `impactedDistrosList.distro` | string | Output field: impactedDistrosList.distro | | `impactedDistrosList.impactCount` | number | Count value | | `impactedDistrosList.highestCVSS` | number | Output field: impactedDistrosList.highestCVSS | | `impactedDistrosList.highestSeverity` | string | Output field: impactedDistrosList.highestSeverity | | `impactedDistrosList.firstPublishedDate` | number | Date value | | `impactedDistrosList.lastModifiedDate` | number | Date value | | `impactedDistrosList.distroDetailsList` | array | Output field: impactedDistrosList.distroDetailsList | | `impactedDistrosList.distroDetailsList.cvss` | number | Output field: impactedDistrosList.distroDetailsList.cvss | | `impactedDistrosList.distroDetailsList.packageName` | string | Name of the resource | | `impactedDistrosList.distroDetailsList.release` | string | Output field: impactedDistrosList.distroDetailsList.release | | `impactedDistrosList.distroDetailsList.severity` | string | Output field: impactedDistrosList.distroDetailsList.severity | | `impactedDistrosList.distroDetailsList.affectedVersion` | string | Output field: impactedDistrosList.distroDetailsList.affectedVersion | | `impactedDistrosList.distroDetailsList.fixedTime` | number | Time value | | `impactedDistrosList.distroDetailsList.publishedDate` | number | Date value | | `impactedDistrosList.distroDetailsList.modifiedDate` | number | Date value | | `impactedAssetsCount` | number | Count value | | `impactedAssetsRuntimeCount` | number | Count value | ### Output Example `{"status_code":200,"response_headers":{"Date":"Sat, 13 Jul 2024 15:55:35 GMT","Content-Type":"application/json","Transfer-Encoding":"chunked","Connection":"keep-alive","X-Content-Type-Options":"nosniff","X-XSS-Protection":"1; mode=block","Cache-Control":"no-cache, no-store, max-age=0, must-revalidate","Pragma":"no-cache","Expires":"0","Strict-Transport-Security":"max-age=31536000 ; includeSubDomains","X-Frame-Options":"DENY","Vary":"Origin, Access-Control-Request-Method, Access-Control-Request-H...` ## Get Existing Least Privilege Access for an Asset Suggests the minimal policies/roles for an asset in Prisma Cloud, considering actions from the past specified days. ### Endpoint - **URL:** `iam/api/v1/assets/{{asset_id}}/existing-least-privileged-access` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------------------------- | -------- | ------------ | --------------------------------------------- | | `path_parameters.asset_id` | string | Required | The UAI asset Id. | | `parameters.output_format` | string | Required | Output format type.Output format type. | | `parameters.lookback_duration_days` | number | Required | Amount of days to look back for used actions. | ### Input Example `{"parameters":{"output_format":"JSON","lookback_duration_days":90},"path_parameters":{"asset_id":"681390424b288d835f5cd03e7bfb0993"}}` ### Output | **Parameter** | **Type** | **Description** | | ----------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `nextPageToken` | string | Output field: nextPageToken | | `permissionsInAssetCount` | number | Count value | | `permissionsInLeastPrivilegedCount` | number | Count value | | `analysis` | array | Output field: analysis | | `analysis.action` | string | Output field: analysis.action | | `analysis.configurationName` | string | Name of the resource | | `analysis.keep` | boolean | Output field: analysis.keep | | `value` | array | Value for the parameter | | `value.iamResourceName` | string | Name of the resource | | `value.iamResourceId` | string | Unique identifier | | `value.iamResourceType` | string | Type of the resource | | `value.formatType` | string | Type of the resource | | `value.snippet` | string | Value for the parameter | ### Output Example `{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"nextPageToken":"++fdfkjsdlfsdfdFDSFDFSDFdfdssfdFDS","permissionsInAssetCount":10,"permissionsInLeastPrivilegedCount":10,"analysis":[{}],"value":[{}]}}` ## Get Host Scan Results Retrieve detailed vulnerability scan reports for specific hosts from Palo Alto Networks Prisma Cloud. ### Endpoint - **URL:** `/api/v32.06/hosts` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------------------ | -------- | ------------ | ------------------------------------------------------------------------------------------------------------------------ | | `parameters.offset` | number | Optional | Offsets the result to a specific report count. Offset starts from 0. | | `parameters.limit` | number | Optional | Limit is the amount to fix. | | `parameters.sort` | string | Optional | Sorts the result using a key. | | `parameters.reverse` | boolean | Optional | Sorts the result in reverse order. | | `parameters.hostname` | array | Optional | Filters the result based on hostnames. | | `parameters.distro` | array | Optional | Filters the result based on OS distribution names. | | `parameters.compact` | boolean | Optional | Provides the minimal image data. Information about vulnerabilities, compliance, and extended image metadata are skipped. | | `parameters.clusters` | array | Optional | Filters the result based on cluster names. | | `parameters.complianceIDs` | array | Optional | Filters the result based on compliance IDs. | | `parameters.complianceIDs.file_name` | string | Required | Parameters for the Get Host Scan Results action | | `parameters.complianceIDs.file` | string | Required | Parameters for the Get Host Scan Results action | | `parameters.complianceRuleName` | string | Optional | Filters the result based on applied compliance rule name. | | `parameters.agentless` | boolean | Optional | Retrieves the host names that were scanned by the agentless scanner. | | `parameters.csa` | boolean | Optional | Filters only images scanned by CSA. | | `parameters.stopped` | boolean | Optional | Retrieves the host names that were skipped during an agentless scan. | | `parameters.normalizedSeverity` | boolean | Optional | Retrieves the result in the normalized form of low, medium, high, and critical based on vulnerability's severity level. | | `parameters.uaiID` | string | Optional | Filters results by uaiID. | | `parameters.issueType` | array | Optional | Filters results by issue type. | ### Input Example `{"parameters":{"offset":123,"limit":123,"sort":"string","reverse":true,"hostname":["string"],"distro":["string"],"compact":true,"clusters":["string"],"complianceIDs":[{"file_name":"Example Name","file":"string"}],"complianceRuleName":"Example Name","agentless":true,"csa":true,"stopped":true,"normalizedSeverity":true,"uaiID":"string","issueType":["string"]}}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | ### Output Example `{"status_code":200,"response_headers":{},"reason":"OK","json_body":[{"Secrets":[],"_id":"string","agentless":true,"aisUUID":"string","allCompliance":{},"appEmbedded":true,"applications":[],"baseImage":"string","binaries":[],"cloudMetadata":{},"clusterType":[],"clusters":[],"collections":[],"complianceDistribution":{},"complianceIssues":[]}]}` ## Get IAM Query Retrieve the IAM query for a given alert ID from Palo Alto Networks Prisma Cloud, requiring an 'alertId' parameter. ### Endpoint - **URL:** `api/v1/permission/alert/search` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------- | -------- | ------------ | --------------- | | `parameters.alertId` | string | Required | Alert Id. | ### Input Example `{"parameters":{"alertId":"P-23213241"}}` ### Output | **Parameter** | **Type** | **Description** | | ----------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `data` | array | Response data | | `query` | string | Output field: query | | `timeRange` | object | Output field: timeRange | | `timeRange.type` | string | Type of the resource | | `timeRange.value` | string | Value for the parameter | ### Output Example `{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"data":["string"],"query":"Query 1","timeRange":{"type":"to_now","value":"epoch"}}}` ## Get IAM Query V2 Retrieves the IAM query for a given alert using the specified alert\_id in Palo Alto Networks Prisma Cloud. ### Endpoint - **URL:** `iam/api/v2/alert/{{alert_id}}/query` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------------- | -------- | ------------ | --------------- | | `path_parameters.alert_id` | string | Required | The alert id. | ### Input Example `{"path_parameters":{"alert_id":"I-34537"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `timeRange` | string | Output field: timeRange | | `query` | string | Output field: query | ### Output Example `{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"timeRange":"{''type': 'relative', 'value': {'unit': 'day', 'amount': 7} }","query":"config from iam where source.cloud.type = 'AWS'"}}` ## Get Least Privilege Access Metadata of a Resource Retrieve metadata for optimizing resource access based on least privilege principles in Palo Alto Networks Prisma Cloud, requiring a resource ID. ### Endpoint - **URL:** `iam/api/v1/resources/{{resource_id}}/over-permissive-metadata` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------------------- | -------- | ------------ | ---------------- | | `path_parameters.resource_id` | string | Required | The resource ID. | ### Input Example `{"path_parameters":{"resource_id":"3fab987adf7c268519219cdfe5a4c4c2d4dc"}}` ### Output | **Parameter** | **Type** | **Description** | | ----------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `nextPageToken` | string | Output field: nextPageToken | | `permissionsInAssetCount` | number | Count value | | `permissionsInLeastPrivilegedCount` | number | Count value | | `analysis` | array | Output field: analysis | | `analysis.action` | string | Output field: analysis.action | | `analysis.configurationName` | string | Name of the resource | | `analysis.keep` | boolean | Output field: analysis.keep | | `value` | array | Value for the parameter | | `value.iamResourceName` | string | Name of the resource | | `value.iamResourceId` | string | Unique identifier | | `value.iamResourceType` | string | Type of the resource | | `value.formatType` | string | Type of the resource | | `value.snippet` | string | Value for the parameter | ### Output Example `{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"nextPageToken":"++fdfkjsdlfsdfdFDSFDFSDFdfdssfdFDS","permissionsInAssetCount":10,"permissionsInLeastPrivilegedCount":10,"analysis":[{}],"value":[{}]}}` ## Get Least Privilege Access Metadata of an Asset Retrieve metadata and suggestions for enhancing an asset's Least Privilege Access in Prisma Cloud using the provided asset\_id. ### Endpoint - **URL:** `iam/api/v1/assets/{{asset_id}}/over-permissive-metadata` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------------- | -------- | ------------ | ----------------- | | `path_parameters.asset_id` | string | Required | The UAI asset Id. | ### Input Example `{"path_parameters":{"asset_id":"681390424b288d835f5cd03e7bfb0993"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------------------ | -------- | ------------------------------------------------ | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `totalIamResourceCount` | number | Count value | | `overPermissiveCount` | number | Count value | | `isCustomLeastPrivilegedSupported` | boolean | Output field: isCustomLeastPrivilegedSupported | | `isExistingLeastPrivilegedSupported` | boolean | Output field: isExistingLeastPrivilegedSupported | | `iamResourceType` | string | Type of the resource | ### Output Example `{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"totalIamResourceCount":15,"overPermissiveCount":10,"isCustomLeastPrivilegedSupported":true,"isExistingLeastPrivilegedSupported":true,"iamResourceType":"AWS IAM Policy"}}` ## Get Least Privilege Access Suggestion Resource Generates least privilege access suggestions for a resource in Palo Alto Networks Prisma Cloud, based on IAM configurations and activity from the specified lookback duration. ### Endpoint - **URL:** `iam/api/v1/resources/{{resource_id}}/existing-least-privileged-access` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------------------------- | -------- | ------------ | --------------------------------------------- | | `parameters.output_format` | string | Required | Output format type.Output format type. | | `parameters.lookback_duration_days` | number | Required | Amount of days to look back for used actions. | | `path_parameters.resource_id` | string | Required | The resource ID. | ### Input Example `{"parameters":{"output_format":"JSON","lookback_duration_days":90},"path_parameters":{"resource_id":"3fab987adf7c268519219cdfe5a4c4c2d4dc"}}` ### Output | **Parameter** | **Type** | **Description** | | ----------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `nextPageToken` | string | Output field: nextPageToken | | `permissionsInAssetCount` | number | Count value | | `permissionsInLeastPrivilegedCount` | number | Count value | | `analysis` | array | Output field: analysis | | `analysis.action` | string | Output field: analysis.action | | `analysis.configurationName` | string | Name of the resource | | `analysis.keep` | boolean | Output field: analysis.keep | | `value` | array | Value for the parameter | | `value.iamResourceName` | string | Name of the resource | | `value.iamResourceId` | string | Unique identifier | | `value.iamResourceType` | string | Type of the resource | | `value.formatType` | string | Type of the resource | | `value.snippet` | string | Value for the parameter | ### Output Example `{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"nextPageToken":"++fdfkjsdlfsdfdFDSFDFSDFdfdssfdFDS","permissionsInAssetCount":10,"permissionsInLeastPrivilegedCount":10,"analysis":[{}],"value":[{}]}}` ## Get New Least Privilege Access for a Resource Generates a custom least privileged access configuration for a resource in Palo Alto Networks Prisma Cloud based on past actions within a specified lookback period. ### Endpoint - **URL:** `iam/api/v1/resources/{{resource_id}}/custom-least-privileged-access` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------------------------- | -------- | ------------ | --------------------------------------------- | | `parameters.output_format` | string | Required | Output format type.Output format type. | | `parameters.lookback_duration_days` | number | Required | Amount of days to look back for used actions. | | `path_parameters.resource_id` | string | Required | The resource ID. | ### Input Example `{"parameters":{"output_format":"JSON","lookback_duration_days":90},"path_parameters":{"resource_id":"3fab987adf7c268519219cdfe5a4c4c2d4dc"}}` ### Output | **Parameter** | **Type** | **Description** | | ----------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `nextPageToken` | string | Output field: nextPageToken | | `permissionsInAssetCount` | number | Count value | | `permissionsInLeastPrivilegedCount` | number | Count value | | `analysis` | array | Output field: analysis | | `analysis.action` | string | Output field: analysis.action | | `analysis.configurationName` | string | Name of the resource | | `analysis.keep` | boolean | Output field: analysis.keep | | `value` | array | Value for the parameter | | `value.formatType` | string | Type of the resource | | `value.snippet` | string | Value for the parameter | ### Output Example `{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"nextPageToken":"++fdfkjsdlfsdfdFDSFDFSDFdfdssfdFDS","permissionsInAssetCount":10,"permissionsInLeastPrivilegedCount":10,"analysis":[{}],"value":[{}]}}` ## Get New Least Privilege Access for an Asset Generates a least privileged access configuration for a specified asset in Palo Alto Networks Prisma Cloud, considering the last X days of activity to optimize policy and role usage. ### Endpoint - **URL:** `iam/api/v1/assets/{{asset_id}}/custom-least-privileged-access` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------------------------- | -------- | ------------ | --------------------------------------------- | | `path_parameters.asset_id` | string | Required | The UAI asset Id. | | `parameters.output_format` | string | Required | Output format type.Output format type. | | `parameters.lookback_duration_days` | number | Required | Amount of days to look back for used actions. | ### Input Example `{"parameters":{"output_format":"JSON","lookback_duration_days":90},"path_parameters":{"asset_id":"681390424b288d835f5cd03e7bfb0993"}}` ### Output | **Parameter** | **Type** | **Description** | | ----------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `nextPageToken` | string | Output field: nextPageToken | | `permissionsInAssetCount` | number | Count value | | `permissionsInLeastPrivilegedCount` | number | Count value | | `analysis` | array | Output field: analysis | | `analysis.action` | string | Output field: analysis.action | | `analysis.configurationName` | string | Name of the resource | | `analysis.keep` | boolean | Output field: analysis.keep | | `value` | array | Value for the parameter | | `value.formatType` | string | Type of the resource | | `value.snippet` | string | Value for the parameter | ### Output Example `{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"nextPageToken":"++fdfkjsdlfsdfdFDSFDFSDFdfdssfdFDS","permissionsInAssetCount":10,"permissionsInLeastPrivilegedCount":10,"analysis":[{}],"value":[{}]}}` ## Get Permission Accesses Retrieve usage data for a specific permission in Palo Alto Networks Prisma Cloud, including last access details and requires permissionId and query. ### Endpoint - **URL:** `api/v1/permission/access` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------- | -------- | ------------ | ------------------------------------------------------ | | `limit` | number | Optional | Maximun number of items to return for the given query. | | `permissionId` | string | Optional | Permission Id. | | `query` | string | Optional | Query string. | ### Input Example `{"json_body":{"limit":5,"permissionId":"111111","query":"config from iam where ..."}}` ### Output | **Parameter** | **Type** | **Description** | | ---------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `data` | object | Response data | | `data.items` | array | Response data | | `data.items.destCloudResourceName` | string | Response data | | `data.items.lastAccessDate` | string | Response data | | `data.nextPageToken` | string | Response data | | `data.totalRows` | number | Response data | ### Output Example `{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"data":{"items":[],"nextPageToken":"++fdfkjsdlfsdfdFDSFDFSDFdfdssfdFDS","totalRows":1243}}}` ## Get Permission Accesses V3 Retrieve a paginated list of the last accesses for a specific permission in Palo Alto Networks Prisma Cloud, including a token for subsequent pages. ### Endpoint - **URL:** `iam/api/v3/permission/{{permission_id}}/list_access` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------------- | -------- | ------------ | --------------------------------------------------------------- | | `path_parameters.permission_id` | string | Required | The permission id. Can be retrieved from search/permission api. | | `parameters.limit` | number | Optional | Query records limit. | | `query` | string | Optional | Query string. | | `nextPageToken` | string | Optional | Page Token. | ### Input Example `{"parameters":{"limit":5},"json_body":{"query":"config from iam where source.cloud.type = 'AWS'","nextPageToken":"++fdfkjsdlfsdfdFDSFDFSDFdfdssfdFDS"},"path_parameters":{"permission_id":"06c3cb4403ac276ff59679139b8e6afca2afe93100c8b39014f033ca0339ff0f"}}` ### Output | **Parameter** | **Type** | **Description** | | ---------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `data` | object | Response data | | `data.items` | array | Response data | | `data.items.destCloudResourceName` | string | Response data | | `data.items.lastAccessDate` | string | Response data | | `data.items.destCloudRegion` | string | Response data | | `data.items.destCloudAccount` | string | Response data | | `data.nextPageToken` | string | Response data | | `data.totalRows` | number | Response data | ### Output Example `{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"data":{"items":[],"nextPageToken":"iam/api/{apiVersion}/{apiPath}?page-token=Q74589g444gg","totalRows":1243}}}` ## Get Permissions Obtain IAM permissions from Palo Alto Networks Prisma Cloud using query parameters with a defined result limit. ### Endpoint - **URL:** `api/v1/permission` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------- | -------- | ------------ | ------------------------------------------------------ | | `id` | string | Optional | Request user Id. | | `limit` | number | Optional | Maximun number of items to return for the given query. | | `query` | string | Optional | IAM RQL query. | ### Input Example `{"json_body":{"id":"123456","limit":5,"query":"config from iam where ..."}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `data` | object | Response data | | `data.items` | array | Response data | | `data.items.accessedResourcesCount` | number | Response data | | `data.items.destCloudAccount` | string | Response data | | `data.items.destCloudRegion` | string | Response data | | `data.items.destCloudResourceRrn` | string | Response data | | `data.items.destCloudServiceName` | string | Response data | | `data.items.destCloudType` | string | Response data | | `data.items.destResourceId` | string | Response data | | `data.items.destResourceName` | string | Response data | | `data.items.destResourceType` | string | Response data | | `data.items.effectiveActionName` | string | Response data | | `data.items.exceptions` | array | Response data | | `data.items.exceptions.messageCode` | string | Response data | | `data.items.grantedByCloudEntityId` | string | Response data | | `data.items.grantedByCloudEntityName` | string | Response data | | `data.items.grantedByCloudEntityRrn` | string | Response data | | `data.items.grantedByCloudEntityType` | string | Response data | | `data.items.grantedByCloudPolicyId` | string | Response data | | `data.items.grantedByCloudPolicyName` | string | Response data | | `data.items.grantedByCloudPolicyRrn` | string | Response data | | `data.items.grantedByCloudPolicyType` | string | Response data | | `data.items.grantedByCloudType` | string | Response data | ### Output Example `{"data":{"items":[{}],"nextPageToken":"string","searchedDestCloudResourceNames":[{}],"totalRows":123},"description":"string","id":"12345678-1234-1234-1234-123456789abc","name":"Example Name","query":"string","saved":true,"searchType":"string","timeRange":{"type":"string","value":"string"}}` ## Get Permissions Access Next Page Retrieve the next page of permissions data from Palo Alto Networks Prisma Cloud using a pageToken. ### Endpoint - **URL:** `api/v1/permission/access/page` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------- | -------- | ------------ | ------------------------------------------------------ | | `limit` | number | Optional | Maximun number of items to return for the given query. | | `pageToken` | string | Optional | Page token | ### Input Example `{"json_body":{"limit":5,"pageToken":"++fdfkjsdlfsdfdFDSFDFSDFdfdssfdFDS"}}` ### Output | **Parameter** | **Type** | **Description** | | ----------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `items` | array | Output field: items | | `items.destCloudResourceName` | string | Name of the resource | | `items.lastAccessDate` | string | Date value | | `nextPageToken` | string | Output field: nextPageToken | | `totalRows` | number | Output field: totalRows | ### Output Example `{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"items":[{}],"nextPageToken":"++fdfkjsdlfsdfdFDSFDFSDFdfdssfdFDS","totalRows":1243}}` ## Get Permissions Next Page Retrieve the next page of permissions from Palo Alto Networks Prisma Cloud with a given pageToken. ### Endpoint - **URL:** `api/v1/permission/page` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------- | -------- | ------------ | ----------------------------------------------------------------------------- | | `limit` | number | Optional | Maximun number of items to return. | | `pageToken` | string | Optional | Page token from the response object of an earlier request to get permissions. | ### Input Example `{"json_body":{"limit":0,"pageToken":"asdfvr3456575432weSDFS24ASSD"}}` ### Output | **Parameter** | **Type** | **Description** | | -------------------------------- | -------- | ------------------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `items` | array | Output field: items | | `items.accessedResourcesCount` | number | Count value | | `items.destCloudAccount` | string | Count value | | `items.destCloudRegion` | string | Output field: items.destCloudRegion | | `items.destCloudResourceRrn` | string | Output field: items.destCloudResourceRrn | | `items.destCloudServiceName` | string | Name of the resource | | `items.destCloudType` | string | Type of the resource | | `items.destResourceId` | string | Unique identifier | | `items.destResourceName` | string | Name of the resource | | `items.destResourceType` | string | Type of the resource | | `items.effectiveActionName` | string | Name of the resource | | `items.exceptions` | array | Output field: items.exceptions | | `items.exceptions.messageCode` | string | Response message | | `items.grantedByCloudEntityId` | string | Unique identifier | | `items.grantedByCloudEntityName` | string | Name of the resource | | `items.grantedByCloudEntityRrn` | string | Output field: items.grantedByCloudEntityRrn | | `items.grantedByCloudEntityType` | string | Type of the resource | | `items.grantedByCloudPolicyId` | string | Unique identifier | | `items.grantedByCloudPolicyName` | string | Name of the resource | | `items.grantedByCloudPolicyRrn` | string | Output field: items.grantedByCloudPolicyRrn | | `items.grantedByCloudPolicyType` | string | Type of the resource | | `items.grantedByCloudType` | string | Type of the resource | | `items.id` | string | Unique identifier | ### Output Example `{"items":[{"accessedResourcesCount":123,"destCloudAccount":"string","destCloudRegion":"string","destCloudResourceRrn":"string","destCloudServiceName":"Example Name","destCloudType":"string","destResourceId":"string","destResourceName":"Example Name","destResourceType":"string","effectiveActionName":"Example Name","exceptions":[],"grantedByCloudEntityId":"string","grantedByCloudEntityName":"Example Name","grantedByCloudEntityRrn":"string","grantedByCloudEntityType":"string"}],"nextPageToken":"str...` ## Get Permissions Role or Policy Definition V2 Retrieve configuration details for a specific permission ID in Palo Alto Networks Prisma Cloud. ### Endpoint - **URL:** `iam/api/v2/search/iam_config` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------- | -------- | ------------ | ----------------------------------------------------------------------------------------- | | `permissionId` | string | Optional | PermissionId to get the raw config for. Can be obtain form calling search/permission API. | ### Input Example `{"json_body":{"permissionId":"06c3cb4403ac276ff59679139b8e6afca2afe93100c8b39014f033ca0339ff0f"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `raw` | string | Output field: raw | ### Output Example `{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"raw":"test raw"}}` ## Get Permissions V4 Retrieves permissions grouped by fields and provides a page token for subsequent queries in Palo Alto Networks Prisma Cloud. Requires a 'query' JSON body input. ### Endpoint - **URL:** `iam/api/v4/search/permission` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------ | -------- | ------------ | --------------------------------------------------------------------------------------------------------------- | | `parameters.limit` | number | Optional | Query records limit. | | `query` | string | Optional | RQL query. | | `searchId` | string | Optional | Saved search id. | | `nextPageToken` | string | Optional | Page Token. | | `groupByFields` | array | Optional | Fields to group results by. Empty or missing array is considered the same as an array with all possible fields. | ### Input Example `{"parameters":{"limit":5},"json_body":{"query":"config from iam where dest.cloud.type='AWS'","searchId":"ff4fcb80-03f6-41dd-8bd8-6179fd46b3a4","nextPageToken":"++fdfkjsdlfsdfdFDSFDFSDFdfdssfdFDS","groupByFields":["source","sourceCloudAccount","grantedByEntity","entityCloudAccount","grantedByPolicy","policyCloudAccount","grantedByLevel","action","destination","destCloudAccount","lastAccess"]}}` ### Output | **Parameter** | **Type** | **Description** | | ----------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `data` | object | Response data | | `data.items` | array | Response data | | `data.items.id` | string | Response data | | `data.items.sourcePublic` | boolean | Response data | | `data.items.sourceCloudType` | string | Response data | | `data.items.sourceCloudAccount` | string | Response data | | `data.items.sourceCloudRegion` | string | Response data | | `data.items.sourceCloudServiceName` | string | Response data | | `data.items.sourceResourceName` | string | Response data | | `data.items.sourceResourceType` | string | Response data | | `data.items.sourceResourceId` | string | Response data | | `data.items.sourceCloudResourceUai` | string | Response data | | `data.items.sourceIdpService` | string | Response data | | `data.items.sourceIdpDomain` | string | Response data | | `data.items.sourceIdpEmail` | string | Response data | | `data.items.sourceIdpUserId` | string | Response data | | `data.items.sourceIdpUsername` | string | Response data | | `data.items.sourceIdpGroup` | string | Response data | | `data.items.sourceIdpUai` | string | Response data | | `data.items.destCloudType` | string | Response data | | `data.items.destCloudAccount` | string | Response data | | `data.items.destCloudRegion` | string | Response data | | `data.items.destCloudServiceName` | string | Response data | ### Output Example `{"data":{"items":[{}],"nextPageToken":"string","totalRows":123,"searchedDestCloudResourceNames":[{}]},"query":"string","id":"12345678-1234-1234-1234-123456789abc","saved":true,"name":"Example Name","timeRange":"string","searchType":"string","description":"string","cloudType":"string"}` ## Get Policy Alert Job Status Retrieves the current status of a policy alert job in Palo Alto Networks Prisma Cloud using the provided job ID. ### Endpoint - **URL:** `/alert/policy/jobs/{{id}}/status` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------- | -------- | ------------ | --------------- | | `path_parameters.id` | string | Required | Job ID. | ### Input Example `{"path_parameters":{"id":"b70ac365a19446a59da964785d03142d"}}` ### Output | **Parameter** | **Type** | **Description** | | -------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `id` | string | Unique identifier | | `customerId` | number | Unique identifier | | `status` | string | Status value | | `createdBy` | string | Output field: createdBy | | `createdOn` | number | Output field: createdOn | | `lastModified` | number | Output field: lastModified | | `timeTaken` | number | Output field: timeTaken | | `recordCount` | number | Count value | | `statusUri` | string | Status value | | `downloadUri` | string | Output field: downloadUri | ### Output Example `{"status_code":200,"response_headers":{"Date":"Thu, 11 Jul 2024 05:48:19 GMT","Content-Type":"application/json;charset=utf-8","Transfer-Encoding":"chunked","Connection":"keep-alive","Access-Control-Allow-Origin":"*","Access-Control-Allow-Headers":"x-redlock-request-id,x-redlock-auth,rl-json-rule,terraform-version,terraform-012...","Access-Control-Allow-Methods":"POST, PUT, GET, OPTIONS, DELETE, PATCH","Access-Control-Expose-Headers":"x-redlock-auth,x-redlock-request-id,x-redlock-status, x-redloc...` ## Get Prioritized Vulnerabilities V3 Retrieve top-priority vulnerabilities from Palo Alto Networks Prisma Cloud, categorized by urgency and exploitability, including asset impact. ### Endpoint - **URL:** `uve/api/v3/dashboard/vulnerabilities/prioritised` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------------- | -------- | ------------ | ----------------- | | `parameters.asset_type` | string | Required | Type of Asset. | | `parameters.life_cycle` | string | Required | Life Cycle stage. | ### Input Example `{"parameters":{"asset_type":"iac","life_cycle":"code"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------------------ | -------- | ---------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `lastUpdatedDateTime` | number | Time value | | `totalVulnerabilities` | number | Output field: totalVulnerabilities | | `urgent` | object | Output field: urgent | | `urgent.vulnerabilityCount` | number | Count value | | `urgent.assetCount` | number | Count value | | `patchable` | object | Output field: patchable | | `patchable.vulnerabilityCount` | number | Count value | | `patchable.assetCount` | number | Count value | | `exploitable` | object | Output field: exploitable | | `exploitable.vulnerabilityCount` | number | Count value | | `exploitable.assetCount` | number | Count value | | `internetExposed` | object | Output field: internetExposed | | `internetExposed.vulnerabilityCount` | number | Count value | | `internetExposed.assetCount` | number | Count value | | `packageInUse` | object | Output field: packageInUse | | `packageInUse.vulnerabilityCount` | number | Count value | | `packageInUse.assetCount` | number | Count value | ### Output Example `{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"lastUpdatedDateTime":0,"totalVulnerabilities":0,"urgent":{"vulnerabilityCount":0,"assetCount":0},"patchable":{"vulnerabilityCount":0,"assetCount":0},"exploitable":{"vulnerabilityCount":0,"assetCount":0},"internetExposed":{"vulnerabilityCount":0,"assetCount":0},"packageInUse":{"vulnerabilityCount":0,"assetCount":0}}}` ## Get Query Suggestions Provides auto-complete suggestions and validity checks for partial IAM queries in Palo Alto Networks Prisma Cloud. ### Endpoint - **URL:** `api/v1/suggest` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------- | -------- | ------------ | ------------------ | | `query` | string | Optional | Query to validate. | ### Input Example `{"json_body":{"query":"config from iam where dest.cloud.type='AWS'"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `needsOffsetUpdate` | boolean | Date value | | `offset` | number | Output field: offset | | `suggestions` | array | Output field: suggestions | | `translate` | boolean | Output field: translate | | `valid` | boolean | Unique identifier | ### Output Example `{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"needsOffsetUpdate":true,"offset":43,"suggestions":["AND"],"translate":false,"valid":true}}` ## Get Query Suggestions V2 Offers auto-completion suggestions and syntax validation for RQL queries in Palo Alto Networks Prisma Cloud. ### Endpoint - **URL:** `iam/api/v2/suggestion` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------- | -------- | ------------ | ------------------ | | `query` | string | Optional | Query to validate. | ### Input Example `{"json_body":{"query":"config from iam where dest.cloud.type = 'AWS'"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `valid` | boolean | Unique identifier | | `suggestions` | array | Output field: suggestions | | `translate` | boolean | Output field: translate | | `needsOffsetUpdate` | boolean | Date value | | `offset` | number | Output field: offset | ### Output Example `{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"valid":true,"suggestions":["AND"],"translate":false,"needsOffsetUpdate":true,"offset":43}}` ## Get Remediation Retrieve a list of remediation actions for specified alert IDs in Palo Alto Networks Prisma Cloud. ### Endpoint - **URL:** `api/v1/permission/alert/remediation` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------- | -------- | ------------ | ------------------------ | | `alerts` | array | Optional | List of relevant alerts. | ### Input Example `{"json_body":{"alerts":["I-1234","I-1235"]}}` ### Output | **Parameter** | **Type** | **Description** | | --------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `alertIdVsCliScript` | object | Unique identifier | | `alertIdVsCliScript.I-1234` | string | Unique identifier | | `alertIdVsCliScript.I-1235` | string | Unique identifier | | `cliDescription` | string | Unique identifier | ### Output Example `{"status_code":200,"response_headers":{"Date":"Sat, 13 Jul 2024 11:00:15 GMT","Content-Type":"application/json","Transfer-Encoding":"chunked","Connection":"keep-alive","X-RateLimit-Remaining":"49","X-RateLimit-Requested-Tokens":"1","X-RateLimit-Burst-Capacity":"50","X-RateLimit-Replenish-Rate":"50","Vary":"Origin, Access-Control-Request-Method, Access-Control-Request-Headers, x-redlock...","X-Xss-Protection":"1; mode=block","Strict-Transport-Security":"max-age=31536000; includeSubDomains","X-Fra...` ## Get Remediation Command Retrieve a specific remediation command for an alert by using the unique alert\_id in Palo Alto Networks Prisma Cloud. ### Endpoint - **URL:** `iam/api/v2/alert/{{alert_id}}/remediation_command` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------------- | -------- | ------------ | --------------- | | `path_parameters.alert_id` | string | Required | The alert id. | ### Input Example `{"path_parameters":{"alert_id":"I-34537"}}` ### Output | **Parameter** | **Type** | **Description** | | ---------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `cliCommand` | string | Output field: cliCommand | | `cliDescription` | string | Unique identifier | ### Output Example `{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"cliCommand":"cli command","cliDescription":"The following are CLI command is required for remediation. Successful execution ..."}}` ## Get Remediation Status Retrieve remediation action statuses for assets in Palo Alto Networks Prisma Cloud using cveId, prismaId, and assetType. ### Endpoint - **URL:** `uve/api/v1/remediation/vuln-remediation-status` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------- | -------- | ------------ | ------------------------------------ | | `cveId` | string | Optional | CVE ID of the vulnerability. | | `prismaId` | string | Optional | Prisma ID allocated to the customer. | | `assetType` | string | Optional | Asset type. | | `assetId` | array | Optional | List of asset UAI IDs. | ### Input Example `{"json_body":{"cveId":"CVE-2021-44228","prismaId":"807152287759069184","assetType":"iac","assetId":["80715228775906918412312"]}}` ### Output | **Parameter** | **Type** | **Description** | | --------------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `values` | array | Value for the parameter | | `values.prismaId` | string | Unique identifier | | `values.unifiedAssetId` | string | Unique identifier | | `values.assetType` | string | Type of the resource | | `values.assetLifecycle` | string | Value for the parameter | | `values.cveId` | string | Unique identifier | | `values.source` | string | Value for the parameter | | `values.remediationAction` | array | Value for the parameter | | `values.remediationAction.action` | string | Value for the parameter | | `values.remediationAction.status` | string | Status value | | `values.remediationAction.actionResult` | string | Value for the parameter | | `values.remediationAction.message` | string | Value for the parameter | | `values.lastUpdatedTimestamp` | number | Value for the parameter | ### Output Example `{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"values":[{}]}}` ## Get Saved Asset Inventory Filter Retrieves a saved asset inventory filter by ID from Palo Alto Networks Prisma Cloud, enabling targeted asset management. ### Endpoint - **URL:** `filter/inventory/{{id}}` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------- | -------- | ------------ | ------------------- | | `path_parameters.id` | string | Required | Asset Inventory ID. | ### Input Example `{"path_parameters":{"id":"AWS_ALL_DynamoDB"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------ | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `customerId` | number | Unique identifier | | `filterId` | string | Unique identifier | | `name` | string | Name of the resource | | `description` | string | Output field: description | | `createdBy` | string | Output field: createdBy | | `lastModifiedBy` | string | Output field: lastModifiedBy | | `createdOn` | number | Output field: createdOn | | `filterTarget` | string | Output field: filterTarget | | `filters` | array | Output field: filters | | `filters.name` | string | Name of the resource | | `filters.value` | string | Value for the parameter | | `filters.operator` | string | Output field: filters.operator | ### Output Example `{"status_code":200,"response_headers":{"Date":"Mon, 08 Jul 2024 04:14:44 GMT","Content-Type":"application/json;charset=utf-8","Transfer-Encoding":"chunked","Connection":"keep-alive","Access-Control-Allow-Origin":"*","Access-Control-Allow-Headers":"x-redlock-request-id,x-redlock-auth,rl-json-rule,terraform-version,terraform-012...","Access-Control-Allow-Methods":"POST, PUT, GET, OPTIONS, DELETE, PATCH","Access-Control-Expose-Headers":"x-redlock-auth,x-redlock-request-id,x-redlock-status, x-redloc...` ## Get Top Impacting Vulnerabilities V2 Retrieve critical vulnerabilities with risk scores, severity, CVSS, and impacted assets from Palo Alto Networks Prisma Cloud. Requires 'life\_cycle' and 'top' parameters. ### Endpoint - **URL:** `uve/api/v2/dashboard/vulnerabilities/prioritised-vuln` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------------- | -------- | ------------ | --------------------------------- | | `parameters.life_cycle` | string | Required | Life Cycle stage. | | `parameters.top` | number | Required | Number of results to be returned. | ### Input Example `{"parameters":{"life_cycle":"code","top":5}}` ### Output | **Parameter** | **Type** | **Description** | | --------------------------------- | -------- | ----------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `lastUpdatedDateTime` | number | Time value | | `cve` | array | Output field: cve | | `cve.id` | string | Unique identifier | | `cve.cvssScore` | number | Score value | | `cve.epssScore` | number | Score value | | `cve.completeEpssScore` | number | Score value | | `cve.epssScorePrevious` | number | Output field: cve.epssScorePrevious | | `cve.severity` | string | Output field: cve.severity | | `cve.riskFactors` | array | Output field: cve.riskFactors | | `cve.assetsImpacted` | object | Output field: cve.assetsImpacted | | `cve.assetsImpacted.codeCount` | number | Count value | | `cve.assetsImpacted.buildCount` | number | Count value | | `cve.assetsImpacted.deployCount` | number | Count value | | `cve.assetsImpacted.runtimeCount` | number | Count value | | `cve.assetsAtRisk` | number | Output field: cve.assetsAtRisk | ### Output Example `{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"lastUpdatedDateTime":0,"cve":[{}]}}` ## Get Vulnerabilities Burndown Retrieve vulnerability burndown data for specified asset types, life cycles, and severities in Palo Alto Networks Prisma Cloud. ### Endpoint - **URL:** `uve/api/v2/dashboard/vulnerabilities/burndown` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------------- | -------- | ------------ | ----------------- | | `parameters.asset_type` | string | Required | Type of Asset. | | `parameters.life_cycle` | string | Required | Life Cycle stage. | | `parameters.severities` | string | Required | Severity. | ### Input Example `{"parameters":{"asset_type":"iac","life_cycle":"code","severities":"medium"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | ### Output Example `{"status_code":200,"response_headers":{},"reason":"OK","json_body":[{"dayNum":0,"totalCount":0,"remediatedCount":0,"epochTimestamp":0}]}` ## Get Vulnerabilities by RQL Retrieve a detailed list of vulnerabilities from Palo Alto Networks Prisma Cloud using an RQL query. Requires a 'query' in the JSON body. ### Endpoint - **URL:** `uve/api/v1/vulnerabilities/search` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------------- | -------- | ------------ | --------------------- | | `parameters.page_token` | string | Optional | Token for pagination. | | `query` | string | Optional | Search query. | | `id` | string | Optional | saved search ID. | ### Input Example `{"parameters":{"page_token":"324234t5SFEWEFGE32412343"},"json_body":{"query":"vulnerability where age > 30 days","id":"234134345423423"}}` ### Output | **Parameter** | **Type** | **Description** | | -------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `id` | string | Unique identifier | | `name` | string | Name of the resource | | `description` | string | Output field: description | | `searchType` | string | Type of the resource | | `saved` | boolean | Output field: saved | | `timeRange` | object | Output field: timeRange | | `timeRange.type` | string | Type of the resource | | `timeRange.value` | string | Value for the parameter | | `query` | string | Output field: query | | `data` | object | Response data | | `data.totalRows` | number | Response data | | `data.totalVulnerabilities` | number | Response data | | `data.totalAssets` | number | Response data | | `data.items` | array | Response data | | `data.items.cveId` | string | Response data | | `data.items.name` | string | Response data | | `data.items.cvssScore` | number | Response data | | `data.items.epssScore` | number | Response data | | `data.items.epssScorePrevious` | number | Response data | | `data.items.completeEpssScore` | number | Response data | | `data.items.totalImpactedAssets` | number | Response data | | `data.items.riskFactors` | array | Response data | | `data.items.code` | object | Response data | ### Output Example `{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"id":"string","name":"string","description":"string","searchType":"string","saved":true,"timeRange":{"type":"string","value":"string"},"query":"string","data":{"totalRows":0,"totalVulnerabilities":0,"totalAssets":0,"items":[],"nextPageToken":"string"}}}` ## Get Vulnerability Impact by Stage Provides a summary of vulnerabilities by application stage in Palo Alto Networks Prisma Cloud, segmented by lifecycle and severity. ### Endpoint - **URL:** `uve/api/v1/dashboard/vulnerabilities/impact-stage` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------------- | -------- | ------------ | ----------------- | | `parameters.asset_type` | string | Required | Type of Asset. | | `parameters.life_cycle` | string | Required | Life Cycle stage. | | `parameters.severities` | string | Required | Severity. | ### Input Example `{"parameters":{"asset_type":"iac","life_cycle":"code","severities":"medium"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------------ | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `value` | object | Value for the parameter | | `value.code` | object | Value for the parameter | | `value.code.package` | number | Value for the parameter | | `value.code.iac` | number | Value for the parameter | | `value.build` | object | Value for the parameter | | `value.run` | object | Value for the parameter | | `value.run.serverlessFunction` | number | Value for the parameter | | `value.run.host` | number | Value for the parameter | | `value.run.deployedImage` | number | Value for the parameter | | `value.deploy` | object | Value for the parameter | | `value.deploy.registryImage` | number | Value for the parameter | | `value.deploy.vmImage` | number | Value for the parameter | ### Output Example `{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"value":{"code":{},"build":{},"run":{},"deploy":{}}}}` ## Get Vulnerability Overview V2 Provides a categorized summary of total runtime vulnerabilities by asset and remediation status in Palo Alto Networks Prisma Cloud. ### Endpoint - **URL:** `uve/api/v2/dashboard/vulnerabilities/overview` - **Method:** `GET` ### Output | **Parameter** | **Type** | **Description** | | ---------------------------------------------------------------------- | -------- | ---------------------------------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `overviewSummary` | object | Output field: overviewSummary | | `overviewSummary.totalVulnerableRuntimeAssets` | object | Output field: overviewSummary.totalVulnerableRuntimeAssets | | `overviewSummary.totalVulnerableRuntimeAssets.totalCount` | number | Count value | | `overviewSummary.totalVulnerableRuntimeAssets.deployedImageCount` | number | Count value | | `overviewSummary.totalVulnerableRuntimeAssets.serverlessFunctionCount` | number | Count value | | `overviewSummary.totalVulnerableRuntimeAssets.hostCount` | number | Count value | | `overviewSummary.totalVulnerabilitiesinRuntime` | object | Time value | | `overviewSummary.totalVulnerabilitiesinRuntime.totalCount` | number | Count value | | `overviewSummary.totalVulnerabilitiesinRuntime.criticalCount` | number | Count value | | `overviewSummary.totalVulnerabilitiesinRuntime.highCount` | number | Count value | | `overviewSummary.totalVulnerabilitiesinRuntime.mediumCount` | number | Count value | | `overviewSummary.totalVulnerabilitiesinRuntime.lowCount` | number | Count value | | `overviewSummary.totalRemediatedinRuntime` | object | Time value | | `overviewSummary.totalRemediatedinRuntime.totalCount` | number | Count value | | `overviewSummary.totalRemediatedinRuntime.criticalCount` | number | Count value | | `overviewSummary.totalRemediatedinRuntime.highCount` | number | Count value | | `overviewSummary.totalRemediatedinRuntime.mediumCount` | number | Count value | | `overviewSummary.totalRemediatedinRuntime.lowCount` | number | Count value | | `values` | array | Value for the parameter | | `values.lastUpdatedDateTime` | number | Value for the parameter | | `values.totalVulnerabilityCount` | number | Value for the parameter | | `values.totalVulnerableAsset` | number | Value for the parameter | | `values.totalRemediationCount` | number | Value for the parameter | ### Output Example `{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"overviewSummary":{"totalVulnerableRuntimeAssets":{},"totalVulnerabilitiesinRuntime":{},"totalRemediatedinRuntime":{}},"values":[{}]}}` ## Get Vulnerable Assets by CVE Retrieve a list of assets impacted by a specified CVE ID from Palo Alto Networks Prisma Cloud, requiring the cve\_id. ### Endpoint - **URL:** `uve/api/v1/dashboard/vulnerabilities/vuln-assets` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------- | -------- | ------------ | ------------------------------------------ | | `query` | string | Optional | Parameter for Get Vulnerable Assets by CVE | | `cve_id` | string | Optional | Unique identifier | | `risk_factors` | array | Optional | Parameter for Get Vulnerable Assets by CVE | | `sort_by` | string | Optional | Parameter for Get Vulnerable Assets by CVE | | `asset_type` | string | Optional | Type of the resource | | `page_offset` | number | Optional | Parameter for Get Vulnerable Assets by CVE | | `page_size` | number | Optional | Parameter for Get Vulnerable Assets by CVE | | `filter_suppressed` | boolean | Optional | Parameter for Get Vulnerable Assets by CVE | ### Input Example `{"json_body":{"query":"query","cve_id":"CVE-2021-44228","risk_factors":["attack vector: network","critical severity"],"sort_by":"cvssScore","asset_type":"iac","page_offset":0,"page_size":0,"filter_suppressed":true}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------------------------------------------ | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `value` | object | Value for the parameter | | `value.severity` | array | Value for the parameter | | `value.riskFactors` | array | Value for the parameter | | `value.serverlessFunction` | object | Value for the parameter | | `value.serverlessFunction.count` | number | Value for the parameter | | `value.serverlessFunction.repositorycount` | number | Value for the parameter | | `value.serverlessFunction.fixImpact` | object | Value for the parameter | | `value.serverlessFunction.fixImpact.percentageVulns` | number | Value for the parameter | | `value.serverlessFunction.fixImpact.across` | number | Value for the parameter | | `value.serverlessFunction.remediationAvailable` | array | Value for the parameter | | `value.serverlessFunction.remediationAvailable.action` | string | Value for the parameter | | `value.serverlessFunction.remediationAvailable.status` | string | Status value | | `value.serverlessFunction.remediationAvailable.actionResult` | object | Value for the parameter | | `value.serverlessFunction.remediationAvailable.message` | object | Value for the parameter | | `value.cvssScore` | number | Value for the parameter | | `value.cveId` | string | Unique identifier | | `value.host` | object | Value for the parameter | | `value.host.count` | number | Value for the parameter | | `value.host.repositorycount` | number | Value for the parameter | | `value.host.fixImpact` | object | Value for the parameter | | `value.host.fixImpact.percentageVulns` | number | Value for the parameter | | `value.host.fixImpact.across` | number | Value for the parameter | | `value.host.remediationAvailable` | array | Value for the parameter | ### Output Example `{"status_code":200,"response_headers":{"Date":"Sat, 13 Jul 2024 16:25:53 GMT","Content-Type":"application/json","Transfer-Encoding":"chunked","Connection":"keep-alive","X-Content-Type-Options":"nosniff","X-XSS-Protection":"1; mode=block","Cache-Control":"no-cache, no-store, max-age=0, must-revalidate","Pragma":"no-cache","Expires":"0","Strict-Transport-Security":"max-age=31536000 ; includeSubDomains","X-Frame-Options":"DENY","Vary":"Origin, Access-Control-Request-Method, Access-Control-Request-H...` ## Get Vulnerable Assets by RQL Retrieve a list of assets vulnerable to specific CVEs using an RQL query in Palo Alto Networks Prisma Cloud, including asset IDs, lifecycle, and type. ### Endpoint - **URL:** `uve/api/v1/vulnerabilities/search/asset` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------------- | -------- | ------------ | --------------------- | | `parameters.page_token` | string | Optional | Token for pagination. | | `query` | string | Optional | Search query. | | `cveId` | string | Optional | CVE ID. | | `assetLifecycle` | string | Optional | Asset Lifecycle. | | `assetType` | string | Optional | Asset type. | ### Input Example `{"parameters":{"page_token":"3456234532456234"},"json_body":{"query":"vulnerability where age > 30 days","cveId":"CVE-2021-44228","assetLifecycle":"code","assetType":"package"}}` ### Output | **Parameter** | **Type** | **Description** | | ----------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `value` | array | Value for the parameter | | `value.id` | string | Unique identifier | | `value.name` | string | Name of the resource | | `value.atRisk` | boolean | Value for the parameter | | `value.internetExposed` | boolean | Value for the parameter | | `nextPageToken` | string | Output field: nextPageToken | ### Output Example `{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"value":[{}],"nextPageToken":"string"}}` ## Is Dismissal Note Required Determines if a dismissal note is mandatory when dismissing an alert in Palo Alto Networks Prisma Cloud. ### Endpoint - **URL:** `/alert/dismiss/require_dismissal_note` - **Method:** `GET` ### Output | **Parameter** | **Type** | **Description** | | ---------------------- | -------- | ---------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `requireDismissalNote` | boolean | Output field: requireDismissalNote | ### Output Example `{"status_code":200,"response_headers":{"Date":"Wed, 10 Jul 2024 12:11:19 GMT","Content-Type":"application/json","Transfer-Encoding":"chunked","Connection":"keep-alive","Access-Control-Allow-Origin":"*","Access-Control-Allow-Headers":"x-redlock-request-id,x-redlock-auth,rl-json-rule,terraform-version,terraform-012...","Access-Control-Allow-Methods":"POST, PUT, GET, OPTIONS, DELETE, PATCH","Access-Control-Expose-Headers":"x-redlock-auth,x-redlock-request-id,x-redlock-status, x-redlock-fileName,Con...` ## List Account Group Names Retrieve a list of account group names, their IDs, and auto-creation status from Palo Alto Networks Prisma Cloud. ### Endpoint - **URL:** `/cloud/group/name` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | --------------------------------- | -------- | ------------ | ------------------------------------------------------------------------------- | | `parameters.include_auto_created` | boolean | Optional | Include account groups that were automatically created during cloud onboarding. | ### Input Example `{"parameters":{"include_auto_created":true}}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | ### Output Example `{"status_code":200,"response_headers":{"Date":"Mon, 08 Jul 2024 12:56:50 GMT","Content-Type":"application/json;charset=UTF-8","Transfer-Encoding":"chunked","Connection":"keep-alive","X-RateLimit-Remaining":"39","X-RateLimit-Requested-Tokens":"1","X-RateLimit-Burst-Capacity":"40","X-RateLimit-Replenish-Rate":"40","tracer-id":"e6d3dfc7310e5d8cb9529097fb0ccf7d","X-Content-Type-Options":"nosniff","X-XSS-Protection":"0","Cache-Control":"no-cache, no-store, max-age=0, must-revalidate","Pragma":"no-cac...` ## List Account Group Names by Cloud Type Retrieve account group IDs and names from Palo Alto Networks Prisma Cloud, filtered by specified cloud type. ### Endpoint - **URL:** `/cloud/group/name/{{cloud_type}}` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ---------------------------- | -------- | ------------ | --------------- | | `path_parameters.cloud_type` | string | Required | Cloud Type. | ### Input Example `{"path_parameters":{"cloud_type":"aws"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | ### Output Example `{"status_code":200,"response_headers":{"Date":"Mon, 08 Jul 2024 13:30:19 GMT","Content-Type":"application/json;charset=UTF-8","Transfer-Encoding":"chunked","Connection":"keep-alive","X-RateLimit-Remaining":"4","X-RateLimit-Requested-Tokens":"1","X-RateLimit-Burst-Capacity":"5","X-RateLimit-Replenish-Rate":"5","tracer-id":"0b2c8db9ce63fd1aa372abf3419c7533","X-Content-Type-Options":"nosniff","X-XSS-Protection":"0","Cache-Control":"no-cache, no-store, max-age=0, must-revalidate","Pragma":"no-cache"...` ## List Account Groups Retrieve an array of account groups the user has access to within Palo Alto Networks Prisma Cloud. ### Endpoint - **URL:** `/cloud/group` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | --------------------------------------- | -------- | ------------ | ------------------------------ | | `parameters.excludeCloudAccountDetails` | boolean | Optional | Exclude cloud account details. | ### Input Example `{"parameters":{"excludeCloudAccountDetails":true}}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | ### Output Example `{"status_code":200,"response_headers":{"Date":"Mon, 08 Jul 2024 09:08:24 GMT","Content-Type":"application/json;charset=UTF-8","Transfer-Encoding":"chunked","Connection":"keep-alive","X-RateLimit-Remaining":"39","X-RateLimit-Requested-Tokens":"1","X-RateLimit-Burst-Capacity":"40","X-RateLimit-Replenish-Rate":"40","tracer-id":"c43e70f1ed7ee27df8f577f2b78ceb50","X-Content-Type-Options":"nosniff","X-XSS-Protection":"0","Cache-Control":"no-cache, no-store, max-age=0, must-revalidate","Pragma":"no-cac...` ## List Alert Counts By Policy - GET Retrieve alert counts categorized by policy from Palo Alto Networks Prisma Cloud, with optional query filters. ### Endpoint - **URL:** `/alert/policy` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------------------------------- | -------- | ------------ | ----------------------------------- | | `parameters.alert.id` | string | Optional | Alert ID. | | `parameters.alert.status` | string | Optional | Alert status. | | `parameters.cloud.account` | string | Optional | Cloud account. | | `parameters.cloud.accountId` | string | Optional | Cloud account Id. | | `parameters.account.group` | string | Optional | Account group. | | `parameters.cloud.type` | string | Optional | Cloud type. | | `parameters.cloud.region` | string | Optional | Cloud region. | | `parameters.cloud.service` | string | Optional | Cloud service. - string | | `parameters.policy.id` | string | Optional | Policy ID. | | `parameters.policy.name` | string | Optional | Policy name. | | `parameters.policy.severity` | string | Optional | Policy severity. | | `parameters.policy.label` | string | Optional | Policy label. | | `parameters.policy.type` | string | Optional | Policy type. | | `parameters.policy.complianceStandard` | string | Optional | Policy compliance standard name. | | `parameters.policy.complianceRequirement` | string | Optional | Policy compliance requirement name. | | `parameters.policy.complianceSection` | string | Optional | Policy compliance section ID. | | `parameters.policy.remediable` | string | Optional | Policy is remediable. | | `parameters.alertRule.name` | string | Optional | Alert rule name. | | `parameters.resource.id` | string | Optional | Resource ID. | | `parameters.resource.name` | string | Optional | Resource name. | | `parameters.resource.type` | string | Optional | Resource TYPE. | ### Input Example `{"parameters":{"alert.id":"string","alert.status":"open","cloud.account":"string","cloud.accountId":"string","account.group":"string","cloud.type":"string","cloud.region":"string","cloud.service":"string","policy.id":"string","policy.name":"string","policy.severity":"critical","policy.label":"string","policy.type":"config","policy.complianceStandard":"string","policy.complianceRequirement":"string","policy.complianceSection":"string","policy.remediable":"true","alertRule.name":"string","resource.id":"string","resource.name":"string","resource.type":"string"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | ### Output Example `{"status_code":200,"response_headers":{"Date":"Tue, 09 Jul 2024 14:16:44 GMT","Content-Type":"application/json","Transfer-Encoding":"chunked","Connection":"keep-alive","X-RateLimit-Remaining":"4","X-RateLimit-Requested-Tokens":"1","X-RateLimit-Burst-Capacity":"5","X-RateLimit-Replenish-Rate":"2","Access-Control-Allow-Origin":"*","Access-Control-Allow-Headers":"x-redlock-request-id,x-redlock-auth,rl-json-rule,terraform-version,terraform-012...","Access-Control-Allow-Methods":"POST, PUT, GET, OPTI...` ## List Alert Counts By Policy - POST Retrieve alert counts categorized by policy within a specified time range in Palo Alto Networks Prisma Cloud. ### Endpoint - **URL:** `/alert/policy` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ---------------------------- | -------- | ------------ | -------------------------------------------------------------------------------------------------------- | | `parameters.detailed` | boolean | Optional | Return detailed alert data. | | `detailed` | boolean | Optional | Detailed. | | `fields` | array | Optional | Array of specific fields to return. | | `filters` | array | Optional | Filtering parameters. | | `filters.name` | string | Optional | Name of the resource | | `filters.operator` | string | Optional | Parameter for List Alert Counts By Policy - POST | | `filters.value` | string | Optional | Value for the parameter | | `groupBy` | array | Optional | For asset or data inventory only. | | `limit` | number | Optional | Maximum number of items to return. | | `offset` | number | Optional | The number of items to skip before selecting items to return. | | `pageToken` | string | Optional | Setting this pagination Token to the nextPageToken from a response object returns the next page of data. | | `sortBy` | array | Optional | Array of sort properties. | | `timeRange` | object | Optional | Parameter for List Alert Counts By Policy - POST | | `timeRange.relativeTimeType` | string | Optional | Direction in which to count time. | | `timeRange.type` | string | Optional | Type of the resource | | `timeRange.value` | object | Required | Model for RelativeTimeDuration. | | `timeRange.value.amount` | number | Optional | Number of time units. | | `timeRange.value.unit` | string | Optional | Time unit. | ### Input Example `{"parameters":{"detailed":false},"json_body":{"detailed":true,"fields":["string"],"filters":[{"name":"string","operator":"=","value":"string"}],"groupBy":["cloud.type"],"limit":0,"offset":0,"pageToken":"string","sortBy":["id:asc","timestamp:desc"],"timeRange":{"relativeTimeType":"BACKWARD","type":"relative","value":{"amount":0,"unit":"minute"}}}}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | ### Output Example `{"status_code":200,"response_headers":{"Date":"Mon, 15 Jul 2024 04:53:02 GMT","Content-Type":"application/json","Transfer-Encoding":"chunked","Connection":"keep-alive","X-RateLimit-Remaining":"4","X-RateLimit-Requested-Tokens":"1","X-RateLimit-Burst-Capacity":"5","X-RateLimit-Replenish-Rate":"2","Access-Control-Allow-Origin":"*","Access-Control-Allow-Headers":"x-redlock-request-id,x-redlock-auth,rl-json-rule,terraform-version,terraform-012...","Access-Control-Allow-Methods":"POST, PUT, GET, OPTI...` ## List Alert Filter Autocomplete Suggestions Retrieve available autocomplete suggestions for an alert filter key in Palo Alto Networks Prisma Cloud. ### Endpoint - **URL:** `/filter/alert/suggest` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------- | -------- | ------------ | -------------------------------------------------- | | `filterName` | string | Optional | Filter name. | | `query` | string | Optional | Case-insensitive fuzzy search autocomplete filter. | ### Input Example `{"json_body":{"filterName":"string","query":"string"}}` ### Output | **Parameter** | **Type** | **Description** | | ----------------------------- | -------- | -------------------------------------------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `completeParameters` | array | Parameters for the List Alert Filter Autocomplete Suggestions action | | `completeParameters.name` | string | Parameters for the List Alert Filter Autocomplete Suggestions action | | `completeParameters.operator` | string | Parameters for the List Alert Filter Autocomplete Suggestions action | | `completeParameters.value` | string | Parameters for the List Alert Filter Autocomplete Suggestions action | | `links` | string | Output field: links | | `needsOffsetUpdate` | boolean | Date value | | `offset` | number | Output field: offset | | `queryRemainder` | string | Output field: queryRemainder | | `suggestions` | array | Output field: suggestions | | `translate` | boolean | Output field: translate | | `valid` | boolean | Unique identifier | ### Output Example `{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"completeParameters":[{}],"links":"string","needsOffsetUpdate":true,"offset":0,"queryRemainder":"string","suggestions":["string"],"translate":true,"valid":true}}` ## List Alert Filters Retrieve a list of available policy filters from Palo Alto Networks Prisma Cloud. ### Endpoint - **URL:** `/filter/alert/suggest` - **Method:** `GET` ### Output | **Parameter** | **Type** | **Description** | | ---------------------------------- | -------- | ------------------------------------------ | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `policy.name` | object | Name of the resource | | `policy.name.options` | array | Name of the resource | | `policy.name.options.file_name` | string | Name of the resource | | `policy.name.options.file` | string | Name of the resource | | `policy.name.staticFilter` | boolean | Name of the resource | | `policy.type` | object | Type of the resource | | `policy.type.staticFilter` | boolean | Type of the resource | | `policy.label` | object | Output field: policy.label | | `policy.label.options` | array | Output field: policy.label.options | | `policy.label.options.file_name` | string | Name of the resource | | `policy.label.options.file` | string | Output field: policy.label.options.file | | `policy.label.staticFilter` | boolean | Output field: policy.label.staticFilter | | `policy.severity` | object | Output field: policy.severity | | `policy.severity.staticFilter` | boolean | Output field: policy.severity.staticFilter | | `alertRule.name` | object | Name of the resource | | `alertRule.name.options` | array | Name of the resource | | `alertRule.name.options.file_name` | string | Name of the resource | | `alertRule.name.options.file` | string | Name of the resource | | `alertRule.name.staticFilter` | boolean | Name of the resource | | `resource.id` | object | Unique identifier | | `resource.id.options` | array | Unique identifier | | `resource.id.options.file_name` | string | Unique identifier | | `resource.id.options.file` | string | Unique identifier | ### Output Example `{"status_code":200,"response_headers":{"Date":"Mon, 08 Jul 2024 15:20:26 GMT","Content-Type":"application/json;charset=utf-8","Transfer-Encoding":"chunked","Connection":"keep-alive","Access-Control-Allow-Origin":"*","Access-Control-Allow-Headers":"x-redlock-request-id,x-redlock-auth,rl-json-rule,terraform-version,terraform-012...","Access-Control-Allow-Methods":"POST, PUT, GET, OPTIONS, DELETE, PATCH","Access-Control-Expose-Headers":"x-redlock-auth,x-redlock-request-id,x-redlock-status, x-redloc...` ## List Alert Remediation Commands Generates a list of specific remediation commands for alerts and policies in Palo Alto Networks Prisma Cloud, requiring a filter. ### Endpoint - **URL:** `/alert/remediation` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------------------------- | -------- | ------------ | ------------------------------------------------------------------------------------------------------------------- | | `alerts` | array | Optional | List of alert IDs. One or more alert IDs associated with a single policy are required if no policies are specified. | | `filter` | object | Optional | Model for Filter. | | `filter.detailed` | boolean | Optional | Detailed. | | `filter.fields` | array | Optional | Array of specific fields to return. | | `filter.filters` | array | Optional | Filtering parameters. | | `filter.filters.name` | string | Optional | Name. | | `filter.filters.operator` | string | Optional | Operator. | | `filter.filters.value` | string | Optional | Value. | | `filter.groupBy` | array | Optional | For asset or data inventory only. | | `filter.limit` | number | Optional | Maximum number of items to return. | | `filter.offset` | number | Optional | The number of items to skip before selecting items to return. | | `filter.pageToken` | string | Optional | Setting this pagination Token to the nextPageToken from a response object returns the next page of data. | | `filter.sortBy` | array | Optional | Array of sort properties. | | `filter.timeRange` | object | Required | Parameter for List Alert Remediation Commands | | `filter.timeRange.relativeTimeType` | string | Optional | Direction in which to count time. | | `filter.timeRange.type` | string | Optional | Type of the resource | | `filter.timeRange.value` | object | Required | Model for RelativeTimeDuration. | | `filter.timeRange.value.amount` | number | Optional | Number of time units. | | `filter.timeRange.value.unit` | string | Optional | Time unit. | | `policies` | array | Optional | List of policy IDs. A single policy ID is required if no alerts are specified. | ### Input Example `{"json_body":{"alerts":["string"],"filter":{"detailed":true,"fields":["string"],"filters":[{"name":"string","operator":"=","value":"string"}],"groupBy":["string"],"limit":0,"offset":0,"pageToken":"string","sortBy":["string"],"timeRange":{"relativeTimeType":"BACKWARD","type":"relative","value":{"amount":0,"unit":"minute"}}},"policies":["string"]}}` ### Output | **Parameter** | **Type** | **Description** | | -------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `alertIdVsCliScript` | object | Unique identifier | | `cliDescription` | string | Unique identifier | | `cliScript` | string | Output field: cliScript | | `scriptImpact` | string | Output field: scriptImpact | ### Output Example `{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"alertIdVsCliScript":{},"cliDescription":"string","cliScript":"string","scriptImpact":"string"}}` ## List Alert Rules V2 Retrieve all alert rules available to your user role in Palo Alto Networks Prisma Cloud, excluding open alerts count. ### Endpoint - **URL:** `/v2/alert/rule` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------- | -------- | ------------ | --------------------------------- | | `parameters.enabled` | boolean | Optional | Process only enabled alert rules. | ### Input Example `{"parameters":{"enabled":true}}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | ### Output Example `{"status_code":200,"response_headers":{"Date":"Mon, 08 Jul 2024 14:08:08 GMT","Content-Type":"application/json;charset=utf-8","Transfer-Encoding":"chunked","Connection":"keep-alive","Access-Control-Allow-Origin":"*","Access-Control-Allow-Headers":"x-redlock-request-id,x-redlock-auth,rl-json-rule,terraform-version,terraform-012...","Access-Control-Allow-Methods":"POST, PUT, GET, OPTIONS, DELETE, PATCH","Access-Control-Expose-Headers":"x-redlock-auth,x-redlock-request-id,x-redlock-status, x-redloc...` ## List Alerts V2 - GET Retrieve a paginated list of alerts based on time filters from the Prisma Cloud platform, requiring timeType, timeAmount, and timeUnit parameters. ### Endpoint - **URL:** `/v2/alert` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------------------------------- | -------- | ------------ | ------------------------------------------------------------------ | | `parameters.timeType` | string | Required | Time Type. | | `parameters.timeAmount` | string | Required | Number of timeUnits. | | `parameters.timeUnit` | string | Required | Time Unit | | `parameters.detailed` | boolean | Required | Return detailed alert data. | | `parameters.fields` | string | Optional | Array of specific fields to return. | | `parameters.sortBy` | string | Optional | Response object property by which to sort response list. | | `parameters.limit` | number | Optional | The maximum number of items that will be returned in one response. | | `parameters.pageToken` | string | Optional | Token that identifies the required page of data. | | `parameters.alert.id` | string | Optional | Alert ID | | `parameters.alert.status` | string | Optional | Alert status. | | `parameters.cloud.account` | string | Optional | Cloud account. | | `parameters.cloud.accountId` | string | Optional | Cloud account Id. | | `parameters.account.group` | string | Optional | Account group. | | `parameters.cloud.type` | string | Optional | Cloud type. | | `parameters.cloud.region` | string | Optional | Cloud region. | | `parameters.cloud.service` | string | Optional | Cloud service. | | `parameters.policy.id` | string | Optional | Policy ID. | | `parameters.policy.name` | string | Optional | Policy name. | | `parameters.policy.severity` | string | Optional | Policy severity. | | `parameters.policy.label` | string | Optional | Policy label. | | `parameters.policy.type` | string | Optional | Policy type. | | `parameters.policy.complianceStandard` | string | Optional | Policy compliance standard name. | | `parameters.policy.complianceRequirement` | string | Optional | Policy compliance requirement name. | | `parameters.policy.complianceSection` | string | Optional | Policy compliance section ID. | | `parameters.policy.remediable` | string | Optional | Policy is remediable. | ### Input Example `{"parameters":{"timeType":"relative","timeAmount":"5","timeUnit":"minute","detailed":true,"fields":"alert.id","sortBy":"sortBy=id:desc&sortBy=firstseen:asc,lastseen:desc","limit":10000,"pageToken":"","alert.id":"","alert.status":"open","cloud.account":"","cloud.accountId":"","account.group":"","cloud.type":"","cloud.region":"","cloud.service":"","policy.id":"","policy.name":"","policy.severity":"critical","policy.label":"","policy.type":"config","policy.complianceStandard":"","policy.complianceRequirement":"","policy.complianceSection":"","policy.remediable":"true","alertRule.name":"","resource.id":"","resource.name":"","resource.type":""}}` ### Output | **Parameter** | **Type** | **Description** | | ----------------------------------- | -------- | ------------------------------------------ | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `dynamicColumns` | array | Output field: dynamicColumns | | `infoMsg` | string | Output field: infoMsg | | `items` | array | Output field: items | | `items.alertAdditionalInfo` | object | Output field: items.alertAdditionalInfo | | `items.alertAttribution` | object | Output field: items.alertAttribution | | `items.alertCount` | number | Count value | | `items.alertRules` | array | Output field: items.alertRules | | `items.alertRules.file_name` | string | Name of the resource | | `items.alertRules.file` | string | Output field: items.alertRules.file | | `items.alertTime` | number | Time value | | `items.appMetadata` | array | Response data | | `items.connectionDetails` | array | Output field: items.connectionDetails | | `items.connectionDetails.file_name` | string | Name of the resource | | `items.connectionDetails.file` | string | Output field: items.connectionDetails.file | | `items.dismissalDuration` | string | Output field: items.dismissalDuration | | `items.dismissalNote` | string | Output field: items.dismissalNote | | `items.dismissalUntilTs` | number | Output field: items.dismissalUntilTs | | `items.dismissedBy` | string | Output field: items.dismissedBy | | `items.eventOccurred` | number | Output field: items.eventOccurred | | `items.firstSeen` | number | Output field: items.firstSeen | | `items.history` | array | Output field: items.history | | `items.history.file_name` | string | Name of the resource | | `items.history.file` | string | Output field: items.history.file | ### Output Example `{"status_code":200,"response_headers":{"Date":"Mon, 15 Jul 2024 04:32:38 GMT","Content-Type":"application/json","Transfer-Encoding":"chunked","Connection":"keep-alive","X-RateLimit-Remaining":"9","X-RateLimit-Requested-Tokens":"1","X-RateLimit-Burst-Capacity":"10","X-RateLimit-Replenish-Rate":"3","Access-Control-Allow-Origin":"*","Access-Control-Allow-Headers":"x-redlock-request-id,x-redlock-auth,rl-json-rule,terraform-version,terraform-012...","Access-Control-Allow-Methods":"POST, PUT, GET, OPT...` ## List Alerts V2 - POST Retrieve a paginated list of Prisma Cloud alerts within a specified time range. Requires 'timeRange' in the JSON body. ### Endpoint - **URL:** `/v2/alert` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ---------------------------- | -------- | ------------ | -------------------------------------------------------------------------------------------------------- | | `parameters.detailed` | boolean | Optional | Return detailed alert data. | | `detailed` | boolean | Optional | Detailed. | | `fields` | array | Optional | Array of specific fields to return. | | `filters` | array | Optional | Filtering parameters. | | `filters.name` | string | Optional | Name of the resource | | `filters.operator` | string | Optional | Parameter for List Alerts V2 - POST | | `filters.value` | string | Optional | Value for the parameter | | `groupBy` | array | Optional | For asset or data inventory only. | | `limit` | number | Optional | Maximum number of items to return. | | `offset` | number | Optional | The number of items to skip before selecting items to return. | | `pageToken` | string | Optional | Setting this pagination Token to the nextPageToken from a response object returns the next page of data. | | `sortBy` | array | Optional | Array of sort properties. | | `timeRange` | object | Optional | Parameter for List Alerts V2 - POST | | `timeRange.relativeTimeType` | string | Optional | Direction in which to count time. | | `timeRange.type` | string | Optional | Type of the resource | | `timeRange.value` | object | Required | Model for RelativeTimeDuration. | | `timeRange.value.amount` | number | Optional | Number of time units. | | `timeRange.value.unit` | string | Optional | Time unit | ### Input Example `{"parameters":{"detailed":false},"json_body":{"detailed":true,"fields":["string"],"filters":[{"name":"string","operator":"=","value":"string"}],"groupBy":["cloud.type"],"limit":0,"offset":0,"pageToken":"string","sortBy":["id:asc","timestamp:desc"],"timeRange":{"relativeTimeType":"BACKWARD","type":"relative","value":{"amount":0,"unit":"minute"}}}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------------------------------------- | -------- | -------------------------------------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `dynamicColumns` | array | Output field: dynamicColumns | | `infoMsg` | string | Output field: infoMsg | | `items` | array | Output field: items | | `items.alertAdditionalInfo` | object | Output field: items.alertAdditionalInfo | | `items.alertAttribution` | object | Output field: items.alertAttribution | | `items.alertAttribution.attributionEventList` | array | Output field: items.alertAttribution.attributionEventList | | `items.alertAttribution.attributionEventList.file_name` | string | Name of the resource | | `items.alertAttribution.attributionEventList.file` | string | Output field: items.alertAttribution.attributionEventList.file | | `items.alertAttribution.resourceCreatedBy` | string | Output field: items.alertAttribution.resourceCreatedBy | | `items.alertAttribution.resourceCreatedOn` | number | Output field: items.alertAttribution.resourceCreatedOn | | `items.alertCount` | number | Count value | | `items.alertRules` | array | Output field: items.alertRules | | `items.alertRules.file_name` | string | Name of the resource | | `items.alertRules.file` | string | Output field: items.alertRules.file | | `items.alertTime` | number | Time value | | `items.appMetadata` | array | Response data | | `items.connectionDetails` | array | Output field: items.connectionDetails | | `items.connectionDetails.file_name` | string | Name of the resource | | `items.connectionDetails.file` | string | Output field: items.connectionDetails.file | | `items.dismissalDuration` | string | Output field: items.dismissalDuration | | `items.dismissalNote` | string | Output field: items.dismissalNote | | `items.dismissalUntilTs` | number | Output field: items.dismissalUntilTs | | `items.dismissedBy` | string | Output field: items.dismissedBy | ### Output Example `{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"dynamicColumns":["string"],"infoMsg":"string","items":[{}],"nextPageToken":"string","sortAllowedColumns":["string"],"totalRows":0}}` ## List Inventory Dashboard Filter Retrieve autocomplete suggestions for inventory dashboard filters in Palo Alto Networks Prisma Cloud, requiring a 'filterName'. ### Endpoint - **URL:** `/filter/v2/inventory/suggest` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------- | -------- | ------------ | ------------------------------------------------------------------------------------------------------------- | | `filterName` | string | Optional | Filter name. | | `query` | string | Optional | Case-insensitive fuzzy search autocomplete filter. Includes only items that contain the query as a substring. | ### Input Example `{"json_body":{"filterName":"cloud.service","query":"string"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------------ | -------- | --------------------------------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `valid` | boolean | Unique identifier | | `offset` | number | Output field: offset | | `suggestions` | array | Output field: suggestions | | `translate` | boolean | Output field: translate | | `needsOffsetUpdate` | boolean | Date value | | `queryRemainder` | string | Output field: queryRemainder | | `completeParameters` | array | Parameters for the List Inventory Dashboard Filter action | | `completeParameters.file_name` | string | Parameters for the List Inventory Dashboard Filter action | | `completeParameters.file` | string | Parameters for the List Inventory Dashboard Filter action | ### Output Example `{"status_code":200,"response_headers":{"Date":"Fri, 12 Jul 2024 05:41:28 GMT","Content-Type":"application/json;charset=utf-8","Transfer-Encoding":"chunked","Connection":"keep-alive","Access-Control-Allow-Origin":"*","Access-Control-Allow-Headers":"x-redlock-request-id,x-redlock-auth,rl-json-rule,terraform-version,terraform-012...","Access-Control-Allow-Methods":"POST, PUT, GET, OPTIONS, DELETE, PATCH","Access-Control-Expose-Headers":"x-redlock-auth,x-redlock-request-id,x-redlock-status, x-redloc...` ## List Inventory Filters V2 Retrieve an object listing supported asset inventory filters with default options in Palo Alto Networks Prisma Cloud. ### Endpoint - **URL:** `/filter/v2/inventory/suggest` - **Method:** `GET` ### Output | **Parameter** | **Type** | **Description** | | --------------------------------- | -------- | ---------------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `account.group` | object | Output field: account.group | | `account.group.options` | array | Output field: account.group.options | | `account.group.options.file_name` | string | Name of the resource | | `account.group.options.file` | string | Output field: account.group.options.file | | `account.group.staticFilter` | boolean | Output field: account.group.staticFilter | | `cloud.account` | object | Count value | | `cloud.account.options` | array | Output field: cloud.account.options | | `cloud.account.options.file_name` | string | Name of the resource | | `cloud.account.options.file` | string | Output field: cloud.account.options.file | | `cloud.account.staticFilter` | boolean | Output field: cloud.account.staticFilter | | `cloud.region` | object | Output field: cloud.region | | `cloud.region.options` | array | Output field: cloud.region.options | | `cloud.region.staticFilter` | boolean | Output field: cloud.region.staticFilter | | `cloud.service` | object | Output field: cloud.service | | `cloud.service.options` | array | Output field: cloud.service.options | | `cloud.service.options.file_name` | string | Name of the resource | | `cloud.service.options.file` | string | Output field: cloud.service.options.file | | `cloud.service.staticFilter` | boolean | Output field: cloud.service.staticFilter | | `resource.type` | object | Type of the resource | | `resource.type.options` | array | Type of the resource | | `resource.type.options.file_name` | string | Name of the resource | | `resource.type.options.file` | string | Type of the resource | | `resource.type.staticFilter` | boolean | Type of the resource | ### Output Example `{"status_code":200,"response_headers":{"Date":"Fri, 12 Jul 2024 05:23:03 GMT","Content-Type":"application/json;charset=utf-8","Transfer-Encoding":"chunked","Connection":"keep-alive","Access-Control-Allow-Origin":"*","Access-Control-Allow-Headers":"x-redlock-request-id,x-redlock-auth,rl-json-rule,terraform-version,terraform-012...","Access-Control-Allow-Methods":"POST, PUT, GET, OPTIONS, DELETE, PATCH","Access-Control-Expose-Headers":"x-redlock-auth,x-redlock-request-id,x-redlock-status, x-redloc...` ## List Saved Asset Inventory Filters Retrieve a list of saved asset inventory filters from Palo Alto Networks Prisma Cloud. ### Endpoint - **URL:** `/filter/inventory` - **Method:** `GET` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | ### Output Example `{"status_code":200,"response_headers":{"Date":"Fri, 12 Jul 2024 05:37:46 GMT","Content-Type":"application/json;charset=utf-8","Transfer-Encoding":"chunked","Connection":"keep-alive","Access-Control-Allow-Origin":"*","Access-Control-Allow-Headers":"x-redlock-request-id,x-redlock-auth,rl-json-rule,terraform-version,terraform-012...","Access-Control-Allow-Methods":"POST, PUT, GET, OPTIONS, DELETE, PATCH","Access-Control-Expose-Headers":"x-redlock-auth,x-redlock-request-id,x-redlock-status, x-redloc...` ## List Top N assets Retrieves the top N assets with the highest alert counts over the last 30 days, filtered by swimlane type and time range. ### Endpoint - **URL:** `api/v1/top-assets/{{swimlane_type}}` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------------- | -------- | ------------ | ------------------------------------------------------------------------------------------ | | `path_parameters.swimlane_type` | string | Required | Type of the swimlane. | | `filters` | array | Optional | List of filters that can be applied for the API. | | `filters.name` | string | Optional | FilterType. | | `filters.operator` | string | Optional | Only allowed operator for the filter is '='. | | `filters.value` | string | Optional | Value for the applied filter. | | `timeRange` | object | Optional | Parameter for List Top N assets | | `timeRange.type` | string | Optional | Type of time ranges. | | `timeRange.value` | object | Optional | Absolute Time containing start and end time. Maximum time range supported is last 30 days. | | `timeRange.value.startTime` | number | Optional | Value for the parameter | | `timeRange.value.endTime` | number | Optional | Value for the parameter | | `limit` | number | Optional | Limit on the number of resources requested. supported values >= 1 and \<= 10 | ### Input Example `{"json_body":{"filters":[{"name":"account.group","operator":"=","value":"test"}],"timeRange":{"type":"absolute","value":{"startTime":0,"endTime":0}}},"path_parameters":{"swimlane_type":"misconfigurations"}}` ### Output | **Parameter** | **Type** | **Description** | | -------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `value` | array | Value for the parameter | | `value.externalResourceId` | string | Unique identifier | | `value.resourceName` | string | Name of the resource | | `value.cloudName` | string | Name of the resource | | `value.serviceName` | string | Name of the resource | | `value.accountName` | string | Name of the resource | | `value.alertCount` | number | Value for the parameter | | `value.criticalAlertCount` | number | Value for the parameter | | `value.highAlertCount` | number | Value for the parameter | | `startTime` | number | Time value | | `endTime` | number | Time value | | `swimlaneType` | string | Type of the resource | | `lastScanTs` | number | Output field: lastScanTs | ### Output Example `{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"value":[{}],"startTime":0,"endTime":0,"swimlaneType":"misconfigurations","lastScanTs":0}}` ## List Top Policies Retrieve the top policies with the most alerts from Palo Alto Networks Prisma Cloud, specifying time range, accounts, and swimlane type. ### Endpoint - **URL:** `api/v1/top-policies/{{swimlane_type}}` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------------- | -------- | ------------ | ------------------------------------------------------------------------------------------ | | `path_parameters.swimlane_type` | string | Required | Type of the swimlane. | | `filters` | array | Optional | List of filters that can be applied for the API. | | `filters.name` | string | Optional | FilterType. | | `filters.operator` | string | Optional | Only allowed operator for the filter is '='. | | `filters.value` | string | Optional | Value for the applied filter. | | `timeRange` | object | Optional | Parameter for List Top Policies | | `timeRange.type` | string | Optional | Type of time ranges. | | `timeRange.value` | object | Optional | Absolute Time containing start and end time. Maximum time range supported is last 30 days. | | `timeRange.value.startTime` | number | Optional | Value for the parameter | | `timeRange.value.endTime` | number | Optional | Value for the parameter | | `limit` | number | Optional | Limit on the number of resources requested. supported values >= 1 and \<= 10 | ### Input Example `{"json_body":{"filters":[{"name":"account.group","operator":"=","value":"test"}],"timeRange":{"type":"absolute","value":{"startTime":0,"endTime":0}}},"path_parameters":{"swimlane_type":"misconfigurations"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `value` | array | Value for the parameter | | `value.policyId` | string | Unique identifier | | `value.policyName` | string | Name of the resource | | `value.policyType` | string | Type of the resource | | `value.severity` | string | Value for the parameter | | `value.alertCount` | number | Value for the parameter | | `value.policyDescription` | string | Value for the parameter | | `startTime` | number | Time value | | `endTime` | number | Time value | | `swimlaneType` | string | Type of the resource | | `lastScanTs` | number | Output field: lastScanTs | ### Output Example `{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"value":[{}],"startTime":0,"endTime":0,"swimlaneType":"misconfigurations","lastScanTs":0}}` ## List Top Vulnerabilities Retrieve the top 5 hosts and images with the most vulnerabilities from Palo Alto Networks Prisma Cloud, filterable by type, time, accounts, and groups. ### Endpoint - **URL:** `v1/top-vulnerabilities` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | --------------------------- | -------- | ------------ | ------------------------------------------------------------------------------------------ | | `parameters.limit` | number | Optional | Parameters for the List Top Vulnerabilities action | | `parameters.type` | string | Optional | Parameters for the List Top Vulnerabilities action | | `filters` | array | Optional | List of filters that can be applied for the API. | | `filters.name` | string | Optional | FilterType. | | `filters.operator` | string | Optional | Only allowed operator for the filter is '='. | | `filters.value` | string | Optional | Value for the applied filter. | | `timeRange` | object | Optional | Parameter for List Top Vulnerabilities | | `timeRange.type` | string | Optional | Type of time ranges. | | `timeRange.value` | object | Optional | Absolute Time containing start and end time. Maximum time range supported is last 30 days. | | `timeRange.value.startTime` | number | Optional | Value for the parameter | | `timeRange.value.endTime` | number | Optional | Value for the parameter | ### Input Example `{"parameters":{"limit":5,"type":"type"},"json_body":{"filters":[{"name":"account.group","operator":"=","value":"test"}],"timeRange":{"type":"absolute","value":{"startTime":0,"endTime":0}}}}` ### Output | **Parameter** | **Type** | **Description** | | ---------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `value` | array | Value for the parameter | | `value.unifiedAssetId` | string | Unique identifier | | `value.resourceName` | string | Name of the resource | | `value.numCriticalVulnerabilities` | number | Value for the parameter | | `value.numHighVulnerabilities` | number | Value for the parameter | | `value.totalVulnerabilities` | number | Value for the parameter | | `date` | string | Date value | | `ts` | number | Output field: ts | | `lastScanTs` | number | Output field: lastScanTs | ### Output Example `{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"value":[{}],"date":"11-04-2024","ts":0,"lastScanTs":0}}` ## List Total Alerts Based on the Severity Retrieve a count of Prisma Cloud alerts by severity over a specified time range, requiring account and group details. ### Endpoint - **URL:** `api/v1/summary/{{swimlane_type}}` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------------- | -------- | ------------ | ------------------------------------------------------------------------------------------ | | `path_parameters.swimlane_type` | string | Required | Type of the swimlane. | | `filters` | array | Optional | List of filters that can be applied for the API. | | `filters.name` | string | Optional | FilterType. | | `filters.operator` | string | Optional | Only allowed operator for the filter is '='. | | `filters.value` | string | Optional | Value for the applied filter. | | `timeRange` | object | Optional | Parameter for List Total Alerts Based on the Severity | | `timeRange.type` | string | Optional | Type of time ranges. | | `timeRange.value` | object | Optional | Absolute Time containing start and end time. Maximum time range supported is last 30 days. | | `timeRange.value.startTime` | number | Optional | Value for the parameter | | `timeRange.value.endTime` | number | Optional | Value for the parameter | ### Input Example `{"json_body":{"filters":[{"name":"account.group","operator":"=","value":"test"}],"timeRange":{"type":"absolute","value":{"startTime":0,"endTime":0}}},"path_parameters":{"swimlane_type":"misconfigurations"}}` ### Output | **Parameter** | **Type** | **Description** | | --------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `value` | object | Value for the parameter | | `value.totalCriticalAlerts` | number | Value for the parameter | | `value.totalHighAlerts` | number | Value for the parameter | | `startTime` | number | Time value | | `endTime` | number | Time value | | `swimlaneType` | string | Type of the resource | | `lastScanTs` | number | Output field: lastScanTs | ### Output Example `{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"value":{"totalCriticalAlerts":0,"totalHighAlerts":0},"startTime":0,"endTime":0,"swimlaneType":"misconfigurations","lastScanTs":0}}` ## List Total Vulnerable Images and Hosts Retrieve a summary of all vulnerable images and hosts within specified time, accounts, and account groups in Palo Alto Networks Prisma Cloud. ### Endpoint - **URL:** `v1/vulnerabilities/summary` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | --------------------------- | -------- | ------------ | ------------------------------------------------------------------------------------------ | | `parameters.prismaId` | string | Optional | Parameters for the List Total Vulnerable Images and Hosts action | | `filters` | array | Optional | List of filters that can be applied for the API. | | `filters.name` | string | Optional | FilterType. | | `filters.operator` | string | Optional | Only allowed operator for the filter is '='. | | `filters.value` | string | Optional | Value for the applied filter. | | `timeRange` | object | Optional | Parameter for List Total Vulnerable Images and Hosts | | `timeRange.type` | string | Optional | Type of time ranges. | | `timeRange.value` | object | Optional | Absolute Time containing start and end time. Maximum time range supported is last 30 days. | | `timeRange.value.startTime` | number | Optional | Value for the parameter | | `timeRange.value.endTime` | number | Optional | Value for the parameter | ### Input Example `{"parameters":{"prismaId":"807152287759069184"},"json_body":{"filters":[{"name":"account.group","operator":"=","value":"test"}],"timeRange":{"type":"absolute","value":{"startTime":0,"endTime":0}}}}` ### Output | **Parameter** | **Type** | **Description** | | ---------------------------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `value` | object | Value for the parameter | | `value.images` | object | Value for the parameter | | `value.images.totalCriticalVulnerabilities` | number | Value for the parameter | | `value.images.totalHighVulnerabilities` | number | Value for the parameter | | `value.hosts` | object | Value for the parameter | | `value.hosts.totalCriticalVulnerabilities` | number | Value for the parameter | | `value.hosts.totalHighVulnerabilities` | number | Value for the parameter | | `value.totalBySeverity` | object | Value for the parameter | | `value.totalBySeverity.totalCriticalVulnerabilities` | number | Value for the parameter | | `value.totalBySeverity.totalHighVulnerabilities` | number | Value for the parameter | | `date` | string | Date value | | `ts` | number | Output field: ts | | `lastScanTs` | number | Output field: lastScanTs | ### Output Example `{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"value":{"images":{},"hosts":{},"totalBySeverity":{}},"date":"11-04-2024","ts":0,"lastScanTs":0}}` ## Remediate Alert Remediates a specified alert in Palo Alto Networks Prisma Cloud when associated with a remediable policy, requiring an alert ID. ### Endpoint - **URL:** `/alert/remediation/{{id}}` - **Method:** `PATCH` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ---------------------- | -------- | ------------ | ----------------------------------------- | | `parameters.findingId` | string | Optional | Parameters for the Remediate Alert action | | `path_parameters.id` | string | Required | Alert ID. | ### Input Example `{"parameters":{"findingId":"string"},"path_parameters":{"id":"cbb0bcc7-7835-4e24-a73d-f2ca65c8f8d7"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | ### Output Example `{"status_code":200,"response_headers":{},"reason":"OK","json_body":{}}` ## Reopen Alerts Reopens dismissed or snoozed alerts in Palo Alto Networks Prisma Cloud using specified filters and time range. ### Endpoint - **URL:** `/alert/reopen` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------------------- | -------- | ------------ | -------------------------------------------------------------------------------------------------------- | | `alerts` | array | Optional | Alert IDs. | | `dismissalNote` | string | Optional | Reason for dismissal. | | `dismissalTimeRange` | object | Optional | Parameter for Reopen Alerts | | `dismissalTimeRange.type` | string | Required | Type of the resource | | `dismissalTimeRange.relativeTimeType` | string | Optional | Direction in which to count time. | | `dismissalTimeRange.value` | object | Required | Model for RelativeTimeDuration. | | `dismissalTimeRange.value.amount` | number | Optional | Number of time units. | | `dismissalTimeRange.value.unit` | string | Optional | Time unit | | `filter` | object | Optional | Model for Filter | | `filter.detailed` | boolean | Optional | Detailed. | | `filter.fields` | array | Optional | Array of specific fields to return. | | `filter.filters` | array | Optional | Filtering parameters. | | `filter.filters.name` | string | Optional | Name. | | `filter.filters.operator` | string | Optional | Operator. | | `filter.filters.value` | string | Optional | Value. | | `filter.groupBy` | array | Optional | For asset or data inventory only. | | `filter.limit` | number | Optional | Maximum number of items to return. | | `filter.offset` | number | Optional | The number of items to skip before selecting items to return. | | `filter.pageToken` | string | Optional | Setting this pagination Token to the nextPageToken from a response object returns the next page of data. | | `filter.sortBy` | array | Optional | Array of sort properties. | | `filter.timeRange` | object | Required | Parameter for Reopen Alerts | | `filter.timeRange.relativeTimeType` | string | Optional | Direction in which to count time. | | `filter.timeRange.type` | string | Optional | Type of the resource | | `filter.timeRange.value` | object | Required | Model for RelativeTimeDuration. | | `filter.timeRange.value.amount` | number | Optional | Number of time units. | ### Input Example `{"json_body":{"alerts":["P-411652775"],"dismissalNote":"string","dismissalTimeRange":{"type":"relative","relativeTimeType":"BACKWARD","value":{"amount":0,"unit":"minute"}},"filter":{"detailed":true,"fields":["string"],"filters":[{"name":"string","operator":"=","value":"string"}],"groupBy":["cloud.type"],"limit":0,"offset":0,"pageToken":"string","sortBy":["id:asc","timestamp:desc"],"timeRange":{"relativeTimeType":"BACKWARD","type":"relative","value":{"amount":0,"unit":"minute"}}},"policies":["string"]}}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | ### Output Example `{"status_code":200,"response_headers":{},"reason":"OK","json_body":{}}` ## Save Asset Inventory Filter Saves a specified asset inventory filter in Palo Alto Networks Prisma Cloud with a defined time range. ### Endpoint - **URL:** `/filter/inventory` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ---------------------------- | -------- | ------------ | -------------------------------------------------------------------------------------------------------------------------------------- | | `detailed` | boolean | Optional | Detailed. | | `fields` | array | Optional | Array of specific fields to return. | | `filters` | array | Optional | Filtering parameters. | | `filters.name` | string | Optional | Name. | | `filters.operator` | string | Optional | Operator. | | `filters.value` | string | Optional | Value. | | `groupBy` | array | Optional | For asset or data inventory only. Group returned items by cloud.type, cloud.service, cloud.region, cloud.account, and/or resource.type | | `limit` | number | Optional | Maximum number of items to return. | | `offset` | number | Optional | The number of items to skip before selecting items to return. | | `pageToken` | string | Optional | Setting this pagination Token to the nextPageToken from a response object returns the next page of data. | | `sortBy` | array | Optional | Array of sort properties. | | `timeRange` | object | Optional | Parameter for Save Asset Inventory Filter | | `timeRange.relativeTimeType` | string | Optional | Direction in which to count time. | | `timeRange.type` | string | Optional | Type of the resource | | `timeRange.value` | object | Required | Value for the parameter | | `timeRange.value.amount` | number | Optional | Number of time units. | | `timeRange.value.unit` | string | Optional | Time unit | ### Input Example `{"json_body":{"detailed":true,"fields":["string"],"filters":[{"name":"string","operator":"tag:yaml.org,2002:value =","value":"string"}],"groupBy":["cloud.type"],"limit":0,"offset":0,"pageToken":"string","sortBy":["id:asc","timestamp:desc"],"timeRange":{"relativeTimeType":"BACKWARD","type":"relative","value":{"amount":0,"unit":"minute"}}}}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | ### Output Example `{"status_code":200,"response_headers":{},"reason":"OK","json_body":{}}` ## Submit Alert CSV Generation Job Submits a job to generate a downloadable CSV file of alerts within the specified time range. Returns job ID and status. ### Endpoint - **URL:** `/alert/csv` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ---------------------------- | -------- | ------------ | -------------------------------------------------------------------------------------------------------- | | `parameters.detailed` | boolean | Optional | Return detailed alert data. | | `detailed` | boolean | Optional | Detailed. | | `fields` | array | Optional | Array of specific fields to return. | | `filters` | array | Optional | Filtering parameters. | | `filters.name` | string | Optional | Name. | | `filters.operator` | string | Optional | Operator. | | `filters.value` | string | Optional | Value. | | `groupBy` | array | Optional | For asset or data inventory only. | | `limit` | number | Optional | Maximum number of items to return. | | `offset` | number | Optional | The number of items to skip before selecting items to return. | | `pageToken` | string | Optional | Setting this pagination Token to the nextPageToken from a response object returns the next page of data. | | `sortBy` | array | Optional | Array of sort properties. | | `timeRange` | object | Optional | Parameter for Submit Alert CSV Generation Job | | `timeRange.relativeTimeType` | string | Optional | Direction in which to count time. | | `timeRange.type` | string | Optional | Type of the resource | | `timeRange.value` | object | Required | Model for RelativeTimeDuration. | | `timeRange.value.amount` | number | Optional | Number of time units. | | `timeRange.value.unit` | string | Optional | Time unit. | ### Input Example `{"parameters":{"detailed":"true"},"json_body":{"detailed":true,"fields":["string"],"filters":[{"name":"string","operator":"=","value":"string"}],"groupBy":["cloud.type"],"limit":0,"offset":0,"pageToken":"string","sortBy":["id:asc","timestamp:desc"],"timeRange":{"relativeTimeType":"BACKWARD","type":"relative","value":{"amount":0,"unit":"minute"}}}}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `id` | string | Unique identifier | | `customerId` | number | Unique identifier | | `status` | string | Status value | | `createdBy` | string | Output field: createdBy | | `createdOn` | number | Output field: createdOn | | `statusUri` | string | Status value | ### Output Example `{"status_code":200,"response_headers":{"Date":"Thu, 11 Jul 2024 04:51:46 GMT","Content-Type":"application/json;charset=utf-8","Transfer-Encoding":"chunked","Connection":"keep-alive","Access-Control-Allow-Origin":"*","Access-Control-Allow-Headers":"x-redlock-request-id,x-redlock-auth,rl-json-rule,terraform-version,terraform-012...","Access-Control-Allow-Methods":"POST, PUT, GET, OPTIONS, DELETE, PATCH","Access-Control-Expose-Headers":"x-redlock-auth,x-redlock-request-id,x-redlock-status, x-redloc...` ## Submit Job to List Alerts Submits a job to Palo Alto Networks Prisma Cloud to generate a list of alerts within a specified time range, providing a job ID and status. ### Endpoint - **URL:** `/alert/jobs` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ---------------------------- | -------- | ------------ | -------------------------------------------------------------------------------------------------------- | | `detailed` | boolean | Optional | Detailed. | | `fields` | array | Optional | Array of specific fields to return. | | `filters` | array | Optional | Filtering parameters. | | `filters.name` | string | Optional | Name of the resource | | `filters.operator` | string | Optional | Parameter for Submit Job to List Alerts | | `filters.value` | string | Optional | Value for the parameter | | `groupBy` | array | Optional | For asset or data inventory only. | | `limit` | number | Optional | Maximum number of items to return. | | `offset` | number | Optional | The number of items to skip before selecting items to return. | | `pageToken` | string | Optional | Setting this pagination Token to the nextPageToken from a response object returns the next page of data. | | `sortBy` | array | Optional | Array of sort properties. | | `timeRange` | object | Optional | Parameter for Submit Job to List Alerts | | `timeRange.relativeTimeType` | string | Optional | Direction in which to count time. | | `timeRange.type` | string | Optional | Type of the resource | | `timeRange.value` | object | Required | Model for RelativeTimeDuration. | | `timeRange.value.amount` | number | Optional | Number of time units. | | `timeRange.value.unit` | string | Optional | Time unit. | ### Input Example `{"json_body":{"detailed":true,"fields":["string"],"filters":[{"name":"string","operator":"=","value":"string"}],"groupBy":["string"],"limit":0,"offset":0,"pageToken":"string","sortBy":["string"],"timeRange":{"relativeTimeType":"BACKWARD","type":"relative","value":{"amount":0,"unit":"minute"}}}}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `id` | string | Unique identifier | | `customerId` | number | Unique identifier | | `status` | string | Status value | | `createdBy` | string | Output field: createdBy | | `createdOn` | number | Output field: createdOn | | `statusUri` | string | Status value | ### Output Example `{"status_code":200,"response_headers":{"Date":"Thu, 11 Jul 2024 04:15:19 GMT","Content-Type":"application/json;charset=utf-8","Transfer-Encoding":"chunked","Connection":"keep-alive","Access-Control-Allow-Origin":"*","Access-Control-Allow-Headers":"x-redlock-request-id,x-redlock-auth,rl-json-rule,terraform-version,terraform-012...","Access-Control-Allow-Methods":"POST, PUT, GET, OPTIONS, DELETE, PATCH","Access-Control-Expose-Headers":"x-redlock-auth,x-redlock-request-id,x-redlock-status, x-redloc...` ## Submit Job to List Alerts By Policy Submits a job to Prisma Cloud to generate alerts grouped by policy violation, returning job ID and status. Requires a 'timeRange' in the JSON body. ### Endpoint - **URL:** `/alert/policy/jobs` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ---------------------------- | -------- | ------------ | -------------------------------------------------------------------------------------------------------- | | `detailed` | boolean | Optional | Detailed. | | `fields` | array | Optional | Array of specific fields to return. | | `filters` | array | Optional | Filtering parameters. | | `filters.name` | string | Optional | Name of the resource | | `filters.operator` | string | Optional | Parameter for Submit Job to List Alerts By Policy | | `filters.value` | string | Optional | Value for the parameter | | `groupBy` | array | Optional | For asset or data inventory only. | | `limit` | number | Optional | Maximum number of items to return. | | `offset` | number | Optional | The number of items to skip before selecting items to return. | | `pageToken` | string | Optional | Setting this pagination Token to the nextPageToken from a response object returns the next page of data. | | `sortBy` | array | Optional | Array of sort properties. | | `timeRange` | object | Optional | Parameter for Submit Job to List Alerts By Policy | | `timeRange.relativeTimeType` | string | Optional | Direction in which to count time. | | `timeRange.type` | string | Optional | Type of the resource | | `timeRange.value` | object | Required | Model for RelativeTimeDuration. | | `timeRange.value.amount` | number | Optional | Number of time units. | | `timeRange.value.unit` | string | Optional | Time unit. | ### Input Example `{"json_body":{"detailed":true,"fields":["string"],"filters":[{"name":"string","operator":"=","value":"string"}],"groupBy":["cloud.type"],"limit":0,"offset":0,"pageToken":"string","sortBy":["id:asc","timestamp:desc"],"timeRange":{"relativeTimeType":"BACKWARD","type":"relative","value":{"amount":0,"unit":"minute"}}}}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `id` | string | Unique identifier | | `customerId` | number | Unique identifier | | `status` | string | Status value | | `createdBy` | string | Output field: createdBy | | `createdOn` | number | Output field: createdOn | | `statusUri` | string | Status value | ### Output Example `{"status_code":200,"response_headers":{"Date":"Thu, 11 Jul 2024 05:42:59 GMT","Content-Type":"application/json","Transfer-Encoding":"chunked","Connection":"keep-alive","Access-Control-Allow-Origin":"*","Access-Control-Allow-Headers":"x-redlock-request-id,x-redlock-auth,rl-json-rule,terraform-version,terraform-012...","Access-Control-Allow-Methods":"POST, PUT, GET, OPTIONS, DELETE, PATCH","Access-Control-Expose-Headers":"x-redlock-auth,x-redlock-request-id,x-redlock-status, x-redlock-fileName,Con...` ## Update Account Group Updates an existing account group in Palo Alto Networks Prisma Cloud using the specified 'id', 'accountIds', and 'name'. ### Endpoint - **URL:** `/cloud/group/{{id}}` - **Method:** `PUT` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ---------------------------------- | -------- | ------------ | -------------------------------------------------------------------- | | `path_parameters.id` | string | Required | Account Group ID. | | `accountIds` | array | Optional | Cloud Account IDs. | | `cloudAccountInfos` | array | Optional | Cloud account details of account associated with this account group. | | `cloudAccountInfos.accountId` | string | Optional | Account ID. | | `cloudAccountInfos.cloudType` | string | Optional | Cloud Type. | | `cloudAccountInfos.lastModifiedBy` | string | Optional | Last Modified By. | | `description` | string | Optional | Description. | | `name` | string | Optional | Name. | ### Input Example `{"json_body":{"accountIds":[""],"cloudAccountInfos":[{"accountId":"string","cloudType":"AWS","lastModifiedBy":"string"}],"description":"string","name":"string"},"path_parameters":{"id":"59c8256b-835b-4868-9d3e-0c679a2cf421"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | ### Output Example `{"status_code":200,"response_headers":{},"reason":"OK","json_body":{}}` ## Update Dismissal Note Requirement Enforces or waives the requirement for a dismissal note when an alert is dismissed in Palo Alto Networks Prisma Cloud. ### Endpoint - **URL:** `/alert/dismiss/require_dismissal_note` - **Method:** `PUT` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ---------------------- | -------- | ------------ | ----------------------- | | `requireDismissalNote` | boolean | Optional | Require Dismissal Note. | ### Input Example `{"json_body":{"requireDismissalNote":true}}` ### Output | **Parameter** | **Type** | **Description** | | --------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `response_text` | string | Output field: response\_text | ### Output Example `{"status_code":200,"response_headers":{"Date":"Wed, 10 Jul 2024 11:52:44 GMT","Content-Length":"0","Connection":"keep-alive","Access-Control-Allow-Origin":"*","Access-Control-Allow-Headers":"x-redlock-request-id,x-redlock-auth,rl-json-rule,terraform-version,terraform-012...","Access-Control-Allow-Methods":"POST, PUT, GET, OPTIONS, DELETE, PATCH","Access-Control-Expose-Headers":"x-redlock-auth,x-redlock-request-id,x-redlock-status, x-redlock-fileName,Content...","Access-Control-Max-Age":"60","Str...` ## Update Saved Asset Inventory Filter Updates an existing saved asset inventory filter in Palo Alto Networks Prisma Cloud with a specific ID and time range. ### Endpoint - **URL:** `filter/inventory/{{id}}` - **Method:** `PUT` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ---------------------------- | -------- | ------------ | --------------------------------------------------------------------------------------------------------------------------------------- | | `path_parameters.id` | string | Required | Asset Inventory ID. | | `detailed` | boolean | Optional | Detailed. | | `fields` | array | Optional | Array of specific fields to return. | | `filters` | array | Optional | Parameter for Update Saved Asset Inventory Filter | | `filters.name` | string | Optional | Name. | | `filters.value` | string | Optional | Value for the parameter | | `filters.operator` | string | Optional | Operator. | | `groupBy` | array | Optional | For asset or data inventory only. Group returned items by cloud.type, cloud.service, cloud.region, cloud.account, and/or resource.type. | | `limit` | number | Optional | Maximum number of items to return. When data is paginated, maximum number of items per page.The maximum cannot exceed 10,000. | | `offset` | number | Optional | The number of items to skip before selecting items to return. | | `pageToken` | string | Optional | Setting this pagination Token to the nextPageToken from a response object returns the next page of data. | | `sortBy` | array | Optional | Array of sort properties. Append \:asc or \:desc to the key to sort by ascending or descending order respectively. | | `timeRange` | object | Optional | Parameter for Update Saved Asset Inventory Filter | | `timeRange.relativeTimeType` | string | Optional | Direction in which to count time. | | `timeRange.type` | string | Optional | Type of the resource | | `timeRange.value` | object | Required | Value for the parameter | | `timeRange.value.amount` | number | Optional | Number of time units. | | `timeRange.value.unit` | string | Optional | Time unit. | ### Input Example `{"json_body":{"detailed":true,"fields":["cloud.type"],"filters":[{"name":"cloud.service","value":"DynamoDB","operator":"="}],"groupBy":["cloud.type"],"limit":0,"offset":0,"pageToken":"++fwefvsfcasbds23451452","sortBy":["cloud.type"],"timeRange":{"relativeTimeType":"BACKWARD","type":"relative","value":{"amount":0,"unit":"minute"}}},"path_parameters":{"id":"AWS_ALL_DynamoDB"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | ### Output Example `{"status_code":200,"response_headers":{"Date":"Mon, 08 Jul 2024 05:22:32 GMT","Content-Length":"0","Connection":"keep-alive","Access-Control-Allow-Origin":"*","Access-Control-Allow-Headers":"x-redlock-request-id,x-redlock-auth,rl-json-rule,terraform-version,terraform-012...","Access-Control-Allow-Methods":"POST, PUT, GET, OPTIONS, DELETE, PATCH","Access-Control-Expose-Headers":"x-redlock-auth,x-redlock-request-id,x-redlock-status, x-redlock-fileName,Content...","Access-Control-Max-Age":"60","Str...` # Response Headers | **Header** | **Description** | **Example** | | --------------------------------- | ----------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Access-Control-Allow-Headers | HTTP response header: Access-Control-Allow-Headers | x-redlock-request-id,x-redlock-auth,rl-json-rule,terraform-version,terraform-012-parameters,rl-variable-file-names,rl-parameters,Content-Type,x-b3-traceid,x-b3-spanid,sentry-trace | | Access-Control-Allow-Methods | HTTP response header: Access-Control-Allow-Methods | POST, PUT, GET, OPTIONS, DELETE, PATCH | | Access-Control-Allow-Origin | HTTP response header: Access-Control-Allow-Origin | \* | | Access-Control-Expose-Headers | HTTP response header: Access-Control-Expose-Headers | x-redlock-auth,x-redlock-request-id,x-redlock-status, x-redlock-fileName,Content-Disposition,x-record-count | | Access-Control-Max-Age | HTTP response header: Access-Control-Max-Age | 60 | | Cache-Control | Directives for caching mechanisms | no-cache, no-store, max-age=0, must-revalidate | | Connection | HTTP response header: Connection | keep-alive | | Content-Encoding | HTTP response header: Content-Encoding | gzip | | Content-Length | The length of the response body in bytes | 22 | | Content-Security-Policy | HTTP response header: Content-Security-Policy | default-src 'self' | | Content-Type | The media type of the resource | application/json | | Date | The date and time at which the message was originated | Wed, 10 Jul 2024 11:52:44 GMT | | Expires | The date/time after which the response is considered stale | 0 | | Pragma | HTTP response header: Pragma | no-cache | | Referrer-Policy | HTTP response header: Referrer-Policy | no-referrer | | Strict-Transport-Security | HTTP response header: Strict-Transport-Security | max-age=31536000; includeSubDomains | | tracer-id | HTTP response header: tracer-id | e6d3dfc7310e5d8cb9529097fb0ccf7d | | Transfer-Encoding | HTTP response header: Transfer-Encoding | chunked | | Vary | HTTP response header: Vary | Origin, Access-Control-Request-Method, Access-Control-Request-Headers, x-redlock-auth, Origin | | X-Content-Type-Options | HTTP response header: X-Content-Type-Options | nosniff | | X-Download-Options | HTTP response header: X-Download-Options | noopen | | X-Frame-Options | HTTP response header: X-Frame-Options | DENY | | X-Permitted-Cross-Domain-Policies | HTTP response header: X-Permitted-Cross-Domain-Policies | none | | X-RateLimit-Burst-Capacity | HTTP response header: X-RateLimit-Burst-Capacity | 5 | | X-RateLimit-Remaining | The number of requests remaining in the current rate limit window | 99 | | X-RateLimit-Replenish-Rate | HTTP response header: X-RateLimit-Replenish-Rate | 50 | | X-RateLimit-Requested-Tokens | HTTP response header: X-RateLimit-Requested-Tokens | 1 | | x-redlock-request-id | HTTP response header: x-redlock-request-id | 2aa8e79f6a024809857ca34323dfb8e3 | | x-redlock-status | HTTP response header: x-redlock-status | \[\{"i18nKey":"missing\_filter\_target","severity":"error","subject"\:null}] | | X-Xss-Protection | HTTP response header: X-Xss-Protection | 1; mode=block |