Palo Alto Prisma Cloud

App Vendor: Palo Alto Networks

App Category: Network Security

Connector Version: 1.1.0

API Version: 1.0.0

Note

This app is currently released as a beta version.

About App

The Palo Alto Prisma Cloud enables you to engage with Prisma Cloud services programmatically.

The Palo Alto Prisma Cloud app is configured with the Orchestrate application to perform the following actions:

Action Name	Description
Add Access Key	This action adds a new access key for the current user.
Add Cloud Account	This action onboards a new cloud account onto the Prisma Cloud platform
Add IP Address to Allow List	This action adds a named list of CIDRs (IP addresses) that are in the allowed list to access Prisma Cloud.
Add Policies	This action adds a new policy.
Add Network	This action adds a public network.
Alert Info	This action retrieves information about an alert for the specified ID.
Dismiss Alerts	This action dismisses one or more alerts on the Prisma Cloud platform.
Download Report	This action downloads the compliance report with the specified ID.
Filter Event Search Results	This action filters the results of an event log search according to the specified parameters.
Get Account Status	This action retrieves Prisma Cloud Security Capabilities with warning or error statuses for the specified account and provides remediation suggestions.
Get All Compliance Statistics	This action retrieves a breakdown of the passed/failed statistics and associated policies for compliance standards, requirements, and sections.
Get Asset	This action retrieves the information of the specified asset.
Get Asset Inventory Trend View	This action retrieves asset inventory pass/fail trends for the specified time period.
Get Classification Report	This action retrieves a data classification report.
Get Cloud Account	This action retrieves a list of cloud account IDs and names.
Get Cloud Account Information	This action retrieves top-level information about the cloud account.
Get Cloud Audit Logs	This action retrieves audit logs for events that took place on the Prisma Cloud platform.
Get Code Issues from Periodic Scans	This action retrieves code issues from periodic scans.
Get Compliance Statistics for Standard ID	This action retrieves a breakdown of the passed/failed statistics and associated policies for compliance standards, requirements, and sections for the given compliance standard ID.
Get Compliance Trend	This action retrieves a compliance posture summary that describes the passed/failed statistics trend.
Get Dashboard Alerts	This action retrieves counts of total objects, public objects, sensitive objects, and malware.
Get Dashboard Violations	This action lists violations for the dashboard.
Get External Ingest Integrations for Resource	This action retrieves a list of external ingestion integrations for the specified resource.
Get Inventory Resource Details	This action retrieves details for the resource (bucket) with the specified tenant ID and bucket name.
Get Inventory Resource Objects	This action retrieves the objects for the specified bucket.
Get Malware Report	This action retrieves a malware report.
Get Permissions	This action retrieves a list of permissions.
Get Policy	This action retrieves the policy that has the specified policy ID.
Get Raw Event Data	This action retrieves the audit event data for the specified ID as raw metadata.
Get Report Config	This action retrieves the compliance report generation configuration with the specified ID.
Get Resource Lists	This action retrieves all the resource lists for the current customer.
Get User Role Information	This action retrieves the user role information of the specified user.
List Alert Filter Autocomplete Suggestions	This action retrieves autocomplete suggestions for an alert filter key based on a fuzzy search query.
List Alert Filters	This action retrieves an object whose keys are the available policy filters.
List Alert Remediation	This action generates and retrieves a list of remediation commands for the specified alerts and policies.
List Alerts	This action retrieves a list of alerts that match the constraints specified in the query parameters.
List Cloud Account Owners	This action retrieves the email addresses of all owners for the specified cloud account ID.
List Cloud Accounts	This action lists all cloud accounts onboarded onto the Prisma Cloud platform.
List Historical Reports Data	This action retrieves a list of metadata for the scheduled compliance reports for the specified report ID.
List Inventory Filters	This action retrieves an object whose keys are supported asset inventory filters and values contain default recent options
List Inventory Objects	This action lists data for objects.
List IP Addresses Allowed for Login	This action retrieves a list of data objects that contain the CIDRs in the allowed list to access the Prisma Cloud tenant.
List Networks	This action retrieves an array of public networks.
List Policies	This action retrieves system default and custom policies.
List Report Configs	This action retrieves a list of compliance report generation configurations.
List Users	This action lists all users and service accounts for your tenant.
Perform Config Search	This action searches for resources using an RQL config query to identify misconfigurations and policy violations.
Perform Event Search	This action retrieves the results of an RQL (Resource Query Language) audit event query.
Perform Network Search	This action performs a search against flow logs with an RQL (Resource Query Language) query.
Remediate Alert	This action remediates the alert with the specified ID if that alert is associated with a remediable policy.
Reopen Alerts	This action reopens dismissed or snoozed alerts by changing their status to open on the Prisma Cloud platform.
Search Alerts	This action searches for alerts on the Prisma Cloud platform.
Search Alerts by ID	This action retrieves search data to investigate the alert with the specified ID.
Trigger Scan	This action triggers an asynchronous scan to refresh the state of resources.
Update Policy	This action updates the existing policy that has the specified policy ID.
View Asset Inventory	This action retrieves asset inventory pass/fail data for the specified time period.
Generic Action	This is a generic action used to make requests to any Palo Alto Prisma Cloud endpoint.

Configuration Parameters

The following configuration parameters are required for the Palo Alto Prisma Cloud app to communicate with the Palo Alto Prisma Cloud enterprise application. The parameters can be configured by creating instances in the app.

Parameter	Description	Field Type	Required/Optional
Base URL	Enter the base URL to access Prisma Cloud. Example: https://api.prismacloud.io	Text	Required
Access ID	Enter the access ID.	Text	Required
Password	Enter the password.	Password	Required
Customer Name	Enter the customer's name.	Text	Optional
Prisma ID	Enter the Prisma ID.	Text	Optional

Action: Add Access Key

This action adds a new access key for the current user.

Action Input Parameters

Parameter	Description	Field Type	Required/Optional
Access Key Name	Enter the name of the access key.	Text	Required
Expires on	Enter the timestamp in milliseconds when the access key expires.	Integer	Optional
Service Account Name	Enter the service account name.	Text	Optional

Action: Add Cloud Account

This action onboards a new cloud account onto the Prisma Cloud platform.

Action Input Parameters

Parameter	Description	Field Type	Required/Optional	Comments
Account ID	Enter the AWS account ID.	Text	Required
External ID	Enter the AWS account external ID.	Text	Required
Group IDs	Enter the list of account group IDs for this account.	List	Required
Role Arn	Enter the unique identifier for an AWS resource.	Text	Required
Name	Enter the name to be used for the account on the Prisma Cloud platform.	Text	Required
Enabled	Enter yes if the account is enabled.	Boolean	Optional	Default value: no
Protective Mode	Enter the protective mode. Example: "monitor"	Text	Optional
Skip Status Checks	Enter your preference to skip account status checks to improve response time. Example: yes	Boolean	Optional	Default value: no

Action: Add IP Address to Allow List

This action adds a named list of CIDRs (IP addresses) that are in the allow list to access Prisma Cloud.

Action Input Parameters

Parameter	Description	Field Type	Required/Optional	Comments
CIDRs	Enter the list of CIDRs to allow the list for login access.	List	Required	You can include values from 1 to 10 CIDRs.
Name	Enter the unique name for CIDR (IP addresses) allow list.	Text	Required
Description	Enter the description of CIDR (IP addresses) allow list.	Text	Optional

Action: Add Network

This action adds a public network.

Action Input Parameters

Parameter	Description	Field Type	Required/Optional	Comments
Network Name	Enter the network name.	Text	Required

Action: Add Policies

This action adds a new policy.

Action Input Parameters

Parameter	Description	Field Type	Required/Optional	Comments
Policy Name	Enter the policy name.	Text	Required
Policy Type	Enter the policy type. Example: "config"	Text	Required
Criteria	Enter the saved search ID that defines the rule criteria.	Text	Required
Rule Name	Enter the rule name.	Text	Required
Parameter	Enter the parameters. Example: {"savedsearch": "true"}	Key Value	Required
Type	Enter the type. Example: "network"	Text	Required
Severity	Enter the severity. Example: "high"	Text	Required
Extra Parameters	Enter the extra parameters.	Key Value	Optional
Cloud Type	Enter the cloud type. Example: "azure"	Text	Optional	Default value: all
Data Criteria	Enter the data criteria.	Key Value	Optional

Example Request

[
   {
      "policy_type":"config",
      "parameter":{
         "savedsearch":"true"
      },
      "type":"network",
      "severity":"high"
   }
]

Action: Alert Info

This action retrieves information about an alert for the specified ID.

Action Input Parameters

Parameter

Description

Field Type

Required/Optional

Comments

Alert ID

Enter the alert ID.

Text

Required

Detailed

Enter your preference to retrieve detailed alert information.

Example:

yes

Boolean

Optional

Default value:

Action: Dismiss Alerts

This action dismisses one or more alerts on the Prisma Cloud platform.

Action Input Parameters

Parameter	Description	Field Type	Required/Optional
Filters	Enter the filters.	Key Value	Required
Alert IDs	Enter the alert IDs.	List	Optional
Dismissal Note	Enter the dismissal note.	Text	Optional
Time Range	Enter the time range. Example: {"relativetimetype": "backward","type": "relative","value": {"amount": 0,"unit": "minute"}}	Key Value	Optional
Policies	Enter the policy IDs.	List	Optional

Action: Download Report

This action downloads the compliance report with the specified ID.

Action Input Parameters

Parameter

Description

Field Type

Required/Optional

Comments

Report ID

Enter the report ID.

Text

Required

Filename

Enter the filename with its extension to save the downloaded report.

Example:

samplefile.csv

Text

Required

View Response

Choose true to view the response.

Boolean

Optional

Action: Filter Event Search Results

This action filters the results of an event log search according to the specified parameters.

Action Input Parameters

Parameter	Description	Field Type	Required/Optional	Comments
Extra Parameters	Enter the extra parameters.	Key Value	Optional

Action: Get Account Status

This action retrieves Prisma Cloud Security Capabilities with warning or error statuses for the specified account and provides remediation suggestions.

Action Input Parameters

Parameter	Description	Field Type	Required/Optional	Comments
Account ID	Enter the cloud account ID for which you want to retrieve the status.	Text	Required	You can retrieve the account ID using the action Action: List Cloud Accounts.

Action: Get All Compliance Statistics

This action retrieves a breakdown of the passed/failed statistics and associated policies for compliance standards, requirements, and sections.

Action Input Parameters

Parameter	Description	Field Type	Required/Optional
Time Type	Enter the type. Example: "relative"	Text	Required
Duration	Enter the duration. Example: "1"	"Text	Required
Time Unit	Enter the unit. Example: "day"	Text	Required
Extra Parameters	Enter the extra parameters.	Key Value	Optional

Example Request

[
   {
      "timetype":"relative",
      "timeamount":"1",
      "timeunit":"day"
   }
]

Action: Get Asset

This action retrieves the information of the specified asset.

Action Input Parameters

Parameter	Description	Field Type	Required/Optional	Comments
Asset ID	Enter the asset ID or the Restricted Resource Name (RRN) to retrieve asset details. Example: rrn:xxx:xx:xx-xx-x:xxx:xxx:x-xxxx or unified-asset-id	Text	Required
Query Type	Enter the query type for the Asset Domain Service.	Text	Required	Allowed values: external_finding, asset, asset_lite, alerts, alerts_counts, alert_summary, finding_summary, attack_path, attack_path_summary, raw_config, network, timeline, external_integration, asset_data_indicators, relationships, findings, vulnerabilities, permissions, package_info, labels, vulnerability_aggregates, process_info, vulnerabilities_group_by_type, asset_cwp_vulns, app_contexts, attributes, data_security, data_security_summary
Finding Type	Enter the external finding types.	List	Optional	Allowed values for MOD1: COMPLIANCE_CIS, GUARD_DUTY_HOST, GUARD_DUTY_IAM, INSPECTOR_RBA, INSPECTOR_SBP, NETWORK_REACHABILITY, AZURE_SECURITY_CENTER_ALERTS, UNCLASSIFIED, COMMAND_AND_CONTROL, CREDENTIAL_ACCESS, CROSS_ACCOUNT_TRUST, DATA_EXFILTRATION, DEFENSE_EVASION, DISCOVERY, HIGH_PRIVILEGED_ROLE, INITIAL_ACCESS, INTERNET_EXPOSURE, KEYS_AND_SECRETS, LATERAL_MOVEMENT, MALWARE, MFA, MISCONFIGURATION, NETWORK_ANOMALY, PRIVILEGE_ESCALATION, RECONNAISSANCE, RESOURCE_HIJACKING, SSH_BRUTE_FORCE, UNAUTHORIZED_ACCESS, UNENCRYPTED_DATA, UNUSED_PRIVILEGES, USER_ANOMALY, WEAK_PASSWORD, SENSITIVE_DATA_EXPOSURE, INJECTIONS, VULNERABILITY_SCANNING, SHELLSHOCK, KNOWN_BOTS, UNKNOWN_BOTS, VIRTUAL_PATCHES, WEB_ATTACK, BOT_ACTIVITY, WEB_SCRAPING, CUSTOM, VULNERABILITY Allowed values for MOD2: HOST_VULNERABILITY_CVE, CONTAINER_IMAGE_VULNERABILITY_CVE, VIRTUAL_IMAGE_VULNERABILITY_CVE, SERVERLESS_VULNERABILITY, PACKAGE_VULNERABILITY
Risk Factors	Enter the external finding risk factors.	List	Optional	Allowed values: CRITICAL_SEVERITY, HIGH_SEVERITY, MEDIUM_SEVERITY, HAS_FIX, REMOTE_EXECUTION, DOS, RECENT_VULNERABILITY, EXPLOIT_EXISTS, ATTACK_COMPLEXITY_LOW, ATTACK_VECTOR_NETWORK, REACHABLE_FROM_THE_INTERNET, LISTENING_PORTS, CONTAINER_IS_RUNNING_AS_ROOT, NO_MANDATORY_SECURITY_PROFILE_APPLIED, RUNNING_AS_PRIVILEGED_CONTAINER, PACKAGE_IN_USE, DOS_LOW, DOS_HIGH, EXPLOIT_EXISTS_IN_THE_WILD, EXPLOIT_EXISTS_POC, SENSITIVE_INFORMATION, ROOT_MOUNT, RUNTIME_SOCKET, HOST_ACCESS
Extra Fields	Enter the extra fields to make the request.	Key Value	Optional	Allowed keys: timelineItemId, limit, pageToken, alertIds, attackPathIds, permissionType, prismaCloudFindingsOnly, vulnerabilityInfoTypeId, vulnerabilityInfoType, filters

Action: Get Asset Inventory Trend View

This action retrieves asset inventory pass/fail trends for the specified time period.

Action Input Parameters

Parameter	Description	Field Type	Required/Optional
Time Type	Enter the type. Example: "relative'	Text	Required
Duration	Enter the duration. Example: "2"	Text	Required
Time Unit	Enter the unit. Example: "minute"	Text	Required
Extra Parameters	Enter the extra parameters.	Key Value	Optional

Example Request

[
   {
      "timetype":"relative",
      "timeamount":"2",
      "timeunit":"minute"
   }
]

Action: Get Classification Report

This action retrieves a data classification report.

Action Input Parameters

Parameter	Description	Field Type	Required/Optional	Comments
Tenant ID	Enter the tenant ID to retrieve the data classification report.	Text	Required
Object ID	Enter the object ID to retrieve the data classification report.	Text	Required

Action: Get Cloud Account

This action retrieves a list of cloud account IDs and names.

Action Input Parameters

Parameter	Description	Field Type	Required/Optional	Comments
Account group IDs	Enter the account group IDs.	List	Required
Cloud Type	Enter the cloud type. Example: "aws"	Text	Required
Only Active	Enter your preference to return the IDs and names of active accounts. Example: yes	Boolean	Optional	Default value: no

Parameter

Description

Field Type

Required/Optional

Comments

Account group IDs

Enter the account group IDs.

List

Required

Cloud Type

Enter the cloud type.

Example:

"aws"

Text

Required

Only Active

Enter your preference to return the IDs and names of active accounts.

Example:

yes

Boolean

Optional

Default value: no

Example Request

[
    {
        "cloud_type": "aws"
    }
]

Action: Get Cloud Account Information

This action retrieves top-level information about the cloud account.

Action Input Parameters

Parameter	Description	Field Type	Required/Optional	Comments
Cloud Type	Enter the cloud type. Example: "aws"	Text	Required
Account ID	Enter the account ID.	Text	Required
Include Group Info	Enter your preference to include account group information. Example: yes	Boolean	Optional	Default value: no

Parameter

Description

Field Type

Required/Optional

Comments

Cloud Type

Enter the cloud type.

Example:

"aws"

Text

Required

Account ID

Enter the account ID.

Text

Required

Include Group Info

Enter your preference to include account group information.

Example:

yes

Boolean

Optional

Default value:

Example Request

[
   {
      "cloud_type":"aws",
      "include_group_info": yes
   }
]

Action: Get Cloud Audit Logs

This action retrieves audit logs for events that took place on the Prisma Cloud platform.

Action Input Parameters

Parameter	Description	Field Type	Required/Optional
Time Type	Enter the type. Example: "relative"	Text	Optional
Duration	Enter the duration. Example: "2"	Text	Optional
Time Unit	Enter the unit. Example: "hour"	Text	Optional

Parameter

Description

Field Type

Required/Optional

Comments

Time Type

Enter the type.

Example:

"relative"

Text

Optional

Duration

Enter the duration.

Example:

"2"

Text

Optional

Time Unit

Enter the unit.

Example:

"hour"

Text

Optional

Example Request

[
   {
      "timetype":"relative",
      "timeamount":"2",
      "timeunit":"hour"
   }
]

Action: Get Code Issues from Periodic Scans

This action retrieves code issues from periodic scans.

Action Input Parameters

Parameter	Description	Field Type	Required/Optional	Comments
Filters	Enter the filters to retrieve selective issues. Example: $JSON[{\"repositories\": [\">= 2\"],\"benchmarks(\": [\"CIS KUBERNETES V1.5\"],\"checkStatus\": \"Error\",\"codeCategories\": [\"IacMisconfiguration\"],\"fileTypes\": [\"build.gradle\"],\"fixableOnly\": true}]	Any	Optional	For allowed values, see Palo Alto Prisma Cloud documentation.
Limit	Enter the number of results to retrieve. Example: 100	Integer	Optional	Maximum allowed value: 10000 Default value: 100
Offset	Enter a number to skip a specific number of items from the start of the results.	Integer	Optional	Default value is 0, which returns results starting from the first issue.
Search After	Enter the opaque cursor for pagination.	List	Optional	If you pass Search After, you must also pass Use Search After Pagination and Limit.
Use Search After Pagination	Choose true to use the Search After parameter for pagination instead of offset.	Boolean	Optional
Search	Enter the fields to search for issues. Example: $JSON[{\"scopes\": [\"IacMisconfiguration\"], \"term\": \"string\"}]	Any	Optional	Allowed keys: scopes, term

Action: Get Compliance Statistics for Standard ID

This action retrieves a breakdown of the passed/failed statistics and associated policies for compliance standards, requirements, and sections for the given compliance standard ID.

Action Input Parameters

Parameter	Description	Field Type	Required/Optional
Compliance ID	Enter the compliance ID.	Text	Required
Time Type	Enter the type. Example: "relative"	Text	Required
Duration	Enter the duration. Example: "1"	Text	Required
Time Unit	Enter the unit. Example: "minute"	Text	Required
Extra Parameters	Enter the extra parameters.	Key Value	Optional

Example Request

[
   {
      "timetype":"relative",
      "timeamount":"2",
      "timeunit":"minute"
   }
]

Action: Get Compliance Trend

This action retrieves a compliance posture summary that describes the passed/failed statistics trend.

Action Input Parameters

Parameter	Description	Field Type	Required/Optional
Time Type	Enter the type. Example: "relative"	Text	Required
Duration	Enter the duration. Example: "1"	Text	Required
Time Unit	Enter the unit. Example: "minute"	Text	Required
Extra Parameters	Enter the extra parameters.	Key Value	Optional

Example Request

[
   {
      "timetype":"relative",
      "timeamount":"1",
      "timeunit":"minute"
   }
]

Action: Get Dashboard Alerts

This action retrieves counts of total objects, public objects, sensitive objects, and malware.

Action Input Parameters

Parameter	Description	Field Type	Required/Optional
Account group IDs	Enter the list of cloud account group IDs.	List	Required
Account Group Names	Enter the list of AWS account group names.	List	Required
Account IDs	Enter the list of cloud account IDs.	List	Required
Classifications	Enter the list of data classifications.	List	Required
Limit	Enter the limit of the records returned.	Integer	Required
Time Range	Enter the time range. Example: {"relativetimetype": "backward","type": "relative","value": {"amount": 0,"unit": "minute"}}	Key Value	Required

Example Request

[
   {
      "timerange":{
         "relativetimetype":"backward",
         "type":"relative",
         "value":{
            "amount":0,
            "unit":"minute"
         }
      }
   }
]

Action: Get Dashboard Violations

This action list violations for the dashboard.

Action Input Parameters

Parameter	Description	Field Type	Required/Optional
Account Group IDs	Enter the list of cloud account group IDs.	List	Required
Account Group Names	Enter the list of AWS account group names.	List	Required
Account IDs	Enter the list of cloud account IDs.	List	Required
Classifications	Enter the list of data classifications.	List	Required
Limit	Enter a value to limit the records returned.	Integer	Required
Time Range	Enter the time range. Example: {"relativetimetype": "backward","type": "relative","value": {"amount": 0,"unit": "minute"}}	Key Value	Required

Example Request

[
   {
      "timerange":{
         "relativetimetype":"backward",
         "type":"relative",
         "value":{
            "amount":0,
            "unit":"minute"
         }
      }
   }
]

Action: Get External Ingest Integrations for Resource

This action retrieves a list of external ingestion integrations for the specified resource.

Action Input Parameters

Parameter	Description	Field Type	Required/Optional	Comments
Exclude Severity List	Enter the external finding severities to exclude from the results.	List	Optional
Finding Type	Enter the external finding types.	List	Optional
Risk Factors	Enter the external finding risk factors. Allowed values are CRITICAL_SEVERITY, HIGH_SEVERITY, MEDIUM_SEVERITY, and more.	List	Optional	Allowed values: CRITICAL_SEVERITY, HIGH_SEVERITY, MEDIUM_SEVERITY, HAS_FIX, REMOTE_EXECUTION, DOS, RECENT_VULNERABILITY, EXPLOIT_EXISTS, ATTACK_COMPLEXITY_LOW, ATTACK_VECTOR_NETWORK, REACHABLE_FROM_THE_INTERNET, LISTENING_PORTS, CONTAINER_IS_RUNNING_AS_ROOT, NO_MANDATORY_SECURITY_PROFILE_APPLIED, RUNNING_AS_PRIVILEGED_CONTAINER, PACKAGE_IN_USE
Restricted Resource Name	Enter the restricted resource name (RRN) to filter the result. Example: rrn:xxx:xx:xx-xx-x:xxx:xxx:x-xxxx	Text	Optional
RRN List	Enter a list of restricted resource names (RRN) to filter the response. Example: $LIST[\"rrn:xxx:xx:xx-xx-x:xxx:xxx:x-xxxx\"]	List	Optional
Timeline Item ID	Enter the ID of the timeline item.	Text	Optional

Action: Get Inventory Resource Details

This action retrieves details for the resource (bucket) with the specified tenant ID and bucket name.

Action Input Parameters

Parameter	Description	Field Type	Required/Optional	Comments
Tenant ID	Enter the tenant ID.	Text	Required
Object ID	Enter the object ID.	Text	Required

Action: Get Inventory Resource Objects

This action retrieves the objects for the specified bucket.

Action Input Parameters

Parameter	Description	Field Type	Required/Optional	Comments
Tenant ID	Enter the tenant ID.	Text	Required
Object ID	Enter the object ID.	Text	Required

Action: Get Malware Report

This action retrieves a malware report.

Action Input Parameters

Parameter	Description	Field Type	Required/Optional
Tenant ID	Enter the tenant ID.	Text	Required
Object ID	Enter the object ID.	Text	Required
File Hash	Enter the file hash value.	Text	Required

Action: Get Permissions

This action retrieves a list of permissions.

Action Input Parameters

Parameter	Description	Field Type	Required/Optional	Comments
RQL Query	Enter the Resource Query Language (RQL) to retrieve permissions. Example: config from iam where dest.cloud.type='AWS'	Text	Required
Limit	Enter the number of results to retrieve on each page. Example: 100	Integer	Optional
Search ID	Enter the ID of the saved search. Example: ff4fcb80-03f6-41dd-8bd8-6179fd46b3a4	Text	Optional
Next Page Token	Enter the page token to retrieve the next page of results. Example: ++fdfkjsdlfsdfdFDSFDFSDFdfdssfdFDS	Text	Optional
Group by Fields	Enter the fields to group the results. Example: $LIST["source","sourceCloudAccount"]	List	Optional	Allowed values: source, sourceCloudAccount, grantedByEntity, entityCloudAccount, grantedByPolicy, policyCloudAccount, grantedByLevel, action, destination, destCloudAccount, lastAccess

Action: Get Policy

This action retrieves the policy that has the specified policy ID.

Action Input Parameters

Parameter	Description	Field Type	Required/Optional	Comments
Policy ID	Enter the policy ID.	Text	Required

Action: Get Raw Event Data

This action retrieves the audit event data for the specified ID as raw metadata.

Action Input Parameters

Parameter	Description	Field Type	Required/Optional	Comments
Audit Event ID	Enter the audit event ID.	Text	Required

Action: Get Report Config

This action retrieves the compliance report generation configuration with the specified ID.

Action Input Parameters

Parameter	Description	Field Type	Required/Optional	Comments
Report ID	Enter the report ID.	Text	Required

Action: Get Resource Lists

This action retrieves all the resource lists for the current customer.

Action Input Parameters

Parameter	Description	Field Type	Required/Optional	Comments
Resource List Type	Enter the type of the resource list.	Text	Required	Allowed value: TAG

Parameter

Description

Field Type

Required/Optional

Comments

Resource List Type

Enter the type of the resource list.

Text

Required

Allowed value:

TAG

Action: Get User Role Information

This action retrieves the user role information of the specified user.

Action Input Parameters

Parameter	Description	Field Type	Required/Optional	Comments
User ID	Enter the ID of the user to retrieve information.	Text	Required	You can retrieve the user ID using the action Action: List Users.

Action: List Alert Filter Autocomplete Suggestions

This action retrieves autocomplete suggestions for an alert filter key based on a fuzzy search query.

Action Input Parameters

Parameter	Description	Field Type	Required/Optional	Comments
Filter Name	Enter the name of the alert filter key.	Text	Required
Filter Query	Enter a fuzzy search query to match items.	Text	Optional

Action: List Alert Filters

This action retrieves an object whose keys are the available policy filters.

Action Input Parameters

There are no input parameters required for this action.

Action: List Alert Remediation

This action generates and retrieves a list of remediation commands for the specified alerts and policies.

Action Input Parameters

Parameter	Description	Field Type	Required/Optional
Filters	Enter the filters.	Key Value	Required
Alert IDs	Enter the alert IDs	List	Optional
Policies	Enter the policy IDs.	List	Optional

Action: List Alerts

This action retrieves a list of alerts that match the constraints specified in the query parameters.

Action Input Parameters

Parameter	Description	Field Type	Required/Optional
Use V2	Enter your preference to use V2. Example: yes	Boolean	Required
Time Type	Enter the time type. Example: "relative"	Text	Required
Duration	Enter the duration. Example: "2"	Text	Required
Time Unit	Enter the unit. Example: "minute"	Text	Required
Detailed	Enter your preference to retrieve the detailed result. Example: yes	Boolean	Required
Filters	Enter the filters to narrow down the result.	Key Value	Optional

Example Request

[
    {
        "use_v2": yes,
        "timetype":"relative",
        "timeamount": "2",
        "timeunit": "minute",
        "detailed": yes
    }
]

Action: List Cloud Account Owners

This action retrieves the email addresses of all owners for the specified cloud account ID.

Action Input Parameters

Parameter	Description	Field Type	Required/Optional	Comments
Account ID	Enter the cloud account ID for which you want to retrieve the list of owners.	Text	Required	You can retrieve the account ID using the action Action: List Cloud Accounts.

Action: List Cloud Accounts

This action lists all cloud accounts onboarded onto the Prisma Cloud platform.

Action Input Parameters

Parameter	Description	Field Type	Required/Optional	Comments
Exclude Account Group Details	Enter your preference to exclude account group details. Example: yes	Boolean	Optional	Default value: no
Include Pending Accounts	Choose true to include pending accounts in the response.	Boolean	Optional

Parameter

Description

Field Type

Required/Optional

Comments

Exclude Account Group Details

Enter your preference to exclude account group details.

Example:

yes

Boolean

Optional

Default value:

Include Pending Accounts

Choose true to include pending accounts in the response.

Boolean

Optional

Action: List Historical Reports Data

This action retrieves a list of metadata for the scheduled compliance reports that have been run for the specified report ID.

Action Input Parameters

Parameter	Description	Field Type	Required/Optional	Comments
Report ID	Enter the report ID.	Text	Required

Action: List Inventory Filters

This action retrieves an object whose keys are supported asset inventory filters and values containing default recent options.

Action Input Parameters

This action does not require any input parameters.

Action: List Inventory Objects

This action lists data for objects.

Action Input Parameters

Parameter	Description	Field Type	Required/Optional	Comments
Table Level	Enter the table level. Example: 4	Integer	Required	The response data depends on the table level you specify in the request body parameters.
Extra Parameters	Enter the extra parameters.	Key Value	Optional	Supported parameters: "detailed" "fields" "groupby" "limit" "sortby"

Parameter

Description

Field Type

Required/Optional

Comments

Table Level

Enter the table level.

Example:

Integer

Required

The response data depends on the table level you specify in the request body parameters.

Extra Parameters

Enter the extra parameters.

Key Value

Optional

Supported parameters:

"detailed"
"fields"
"groupby"
"limit"
"sortby"

Example Request

[
   {
      "table_level": 4
   }
]

Action: List Networks

This action returns an array of public networks.

Action Input Parameters

There are no input parameters required for this action.

Action: List Policies

This action retrieves all available policies, both system default, and custom.

Action Input Parameters

Parameter	Description	Field Type	Required/Optional	Comments
Filters	Enter the filters to narrow down the returned policy list.	Key Value	Optional	You can apply filters to narrow the returned policy list to a subset of policies or potentially to a specific policy.

Action: List Report Configs

This action retrieves a list of compliance report generation configurations, including the ID for each configuration.

Action Input Parameters

Parameter	Description	Field Type	Required/Optional	Comments
Extra Parameters	Enter the extra parameters to narrow down the returned policy list.	Key Value	Optional	Accepts query parameters to narrow the list.

Action: List Users

This action lists all users and service accounts for your tenant.

Parameter	Description	Field Type	Required/Optional	Comments
API Version	Enter the API version to make the request. Example: v2	Text	Optional	Default value: v3

Parameter

Description

Field Type

Required/Optional

Comments

API Version

Enter the API version to make the request.

Example:

Text

Optional

Default value:

Action: Perform Config Search

This action searches for resources using an RQL config query to identify misconfigurations and policy violations.

Action Input Parameters

Parameter	Description	Field Type	Required/Optional	Comments
RQL Query	Enter the Resource Query Language (RQL) to search config.	Text	Required
Limit	Enter the number of results to retrieve on each page.	Integer	Optional
Include Resource JSON	Choose true to include resource JSON in the response.	Boolean	Optional	Default value: false
Start Time	Enter the start time to define the beginning of the config search. The end time is automatically set to the current system time.	Integer	Optional
Skip Result	Choose true to skip the search results and only return metadata.	Boolean	Optional
Sort by	Specify the order to sort the response. For example, $JSON[[{"field": "ID", "direction": "asc"}]]	Any	Optional	Allowed keys: field, direction
Next Page Token	Enter the page token to retrieve the next page of results.	Text	Optional

Action: Perform Event Search

This action retrieves the results of an RQL (Resource Query Language) audit event query.

Action Input Parameters

Parameter	Description	Field Type	Required/Optional	Comments
Extra Parameters	Enter the extra parameters.	Key Value	Optional

Action: Perform Network Search

This action performs a search against flow logs with an RQL (Resource Query Language) query.

Action Input Parameters

Parameter	Description	Field Type	Required/Optional
Query	Enter the RQL query.	Text	Required
Time Range	Enter the time range. Example: {"relativetimetype": "backward","type": "relative","value": {"amount": 0,"unit": "minute"}}	Key Value	Required
Extra Parameters	Enter the extra parameters.	Key Value	Optional

Parameter

Description

Field Type

Required/Optional

Comments

Query

Enter the RQL query.

Text

Required

Time Range

Enter the time range.

Example:

{"relativetimetype": "backward","type": "relative","value": {"amount": 0,"unit": "minute"}}

Key Value

Required

Extra Parameters

Enter the extra parameters.

Key Value

Optional

Example Request

[
   {
      "timerange":{
         "relativetimetype":"backward",
         "type":"relative",
         "value":{
            "amount":0,
            "unit":"minute"
         }
      }
   }
]

Action: Remediate Alert

This action remediates the alert with the specified ID if that alert is associated with a remediable policy.

Action Input Parameters

Parameter	Description	Field Type	Required/Optional	Comments
Alert ID	Enter the alert ID.	Text	Required
Finding ID	Enter the finding ID.	Text	Optional

Action: Reopen Alerts

This action reopens dismissed or snoozed alerts by changing their status to open on the Prisma Cloud platform.

Action Input Parameters

Parameter	Description	Field Type	Required/Optional	Comments
Alert IDs	Enter one or more alert IDs to reopen.	List	Optional	You can retrieve the alert IDs using the action Action: List Alerts.
Extra Params	Enter the extra fields to reopen alerts.	Key value	Optional
Filter	Enter the filters to select alerts. Example: $JSON["detailed": "True", "groupBy": ["string"], "limit": 0]	Any	Optional	Allowed keys: detailed, fields, groupBy, limit, offset, pageToken, sortBy, timeRange
Policy IDs	Enter the policy IDs associated with the alerts.	List	Optional	You can retrieve the policy IDs using the action Action: List Policies.

Action: Search Alerts

This action searches for alerts on the Prisma Cloud platform.

Action Input Parameters

Parameter	Description	Field Type	Required/Optional	Comments
Use V2	Choose true if you want to use V2.	Boolean	Optional	Default value: true
Detailed	Choose true to include detailed alert data in the response.	Boolean	Optional	Default value: false
Fields	Enter the fields to retrieve in the response. Example: $LIST[alert.id]	List	Optional
Filters	Enter the filters to search for alerts. Example: $JSON[[{"name": "string","operator": "=", "value": "string"}]]	Any	Optional	Allowed keys: name, operator, value
Group By	Enter the attributes to group the returned items. Example: $LIST[cloud.type]	List	Optional	Allowed values: cloud.type, cloud.service, cloud.region, cloud.account, resource.type
Extra Fields	Enter the extra fields to search for alerts.	Key-Value	Optional	Allowed keys: limit, offset, pageToken, sortBy, timeRange

Action: Search Alerts by ID

This action retrieves search data that can be used to investigate the alert with the specified ID.

Action Input Parameters

Parameter	Description	Field Type	Required/Optional	Comments
Alert ID	Enter the alert ID.	Text	Required

Action: Trigger Scan

This action triggers an asynchronous scan to refresh the state of resources.

Action Input Parameters

Parameter	Description	Field Type	Required/Optional	Comments
Is Executed	Choose true to indicate if the scan was executed before.	Boolean	Required
Message	Enter a message providing additional information about the request.	Text	Required

Action: Update Policy

This action updates the existing policy that has the specified policy ID.

Action Input Parameters

Parameter	Description	Field Type	Required/Optional	Comments
Policy ID	Enter the policy ID.	Text	Required
Policy Name	Enter the policy name.	Text	Required
Policy Type	Enter the policy type. Example: "config"	Text	Required
Criteria	Enter the saved search ID that defines the rule criteria.	Text	Required
Rule Name	Enter the rule name.	Text	Required
Parameter	Enter the parameters. Example: {"savedsearch": "true"}	Key Value	Required
Type	Enter the type. Example: "auditevent"	Text	Required
Severity	Enter the severity. Example: "medium"	Text	Required
Extra Parameters	Enter the extra parameters.	Key Value	Optional
Cloud Type	Enter the cloud type. Example: "aws"	Text	Optional	Default value:all
Data Criteria	Enter the data criteria.	Key Value	Optional

Example Request

[
   {
      "policy_type":"config",
      "parameter":{
         "savedsearch":"true"
      },
      "type":"network",
      "severity":"high"
   }
]

Action: View Asset Inventory

This action retrieves asset inventory pass/fail data for the specified time period.

Action Input Parameters

Parameter	Description	Field Type	Required/Optional
Time Type	Enter the type. Example: "relative"	Text	Required
Duration	Enter the duration. Example: "2"	Text	Required
Time unit	Enter the unit. Example: "minute"	Text	Required
Extra parameters	Enter the extra parameters.	Key Value	Optional

Example Request

[
   {
      "timetype":"relative",
      "timeamount":"2",
      "timeunit":"minute"
   }
]

Action: Generic Action

This is a generic action used to make requests to any Palo Alto Prisma Cloud endpoint.

Action Input Parameters

Parameter	Description	Field Type	Required/Optional	Comments
Method	Enter the HTTP method to make the request.	Text	Required	Allowed values: GET, PUT, POST, DELETE
Endpoint	Enter the endpoint to make the request to. Example: dlp/api/v1/inventory/resource/objects	Text	Required
Query Params	Enter the query parameters to pass to the API.	Key Value	Optional
Payload	Enter the payload to pass to the API.	Any	Optional
Extra Fields	Enter the extra fields to pass to the API.	Key Value	Optional	Allowed keys: headers, payload_json, download, files, filename, retry_wait, retry_count, custom_output, response_type

Cyware Orchestrate

Palo Alto Prisma Cloud

Note

About App

Configuration Parameters

Action: Add Access Key

Action: Add Cloud Account

Action: Add IP Address to Allow List

Action: Add Network

Action: Add Policies

Action: Alert Info

Action: Dismiss Alerts

Action: Download Report

Action: Filter Event Search Results

Action: Get Account Status

Action: Get All Compliance Statistics

Action: Get Asset

Action: Get Asset Inventory Trend View

Action: Get Classification Report

Action: Get Cloud Account

Action: Get Cloud Account Information

Action: Get Cloud Audit Logs

Action: Get Code Issues from Periodic Scans

Action: Get Compliance Statistics for Standard ID

Action: Get Compliance Trend

Action: Get Dashboard Alerts

Action: Get Dashboard Violations

Action: Get External Ingest Integrations for Resource

Action: Get Inventory Resource Details

Action: Get Inventory Resource Objects

Action: Get Malware Report

Action: Get Permissions

Action: Get Policy

Action: Get Raw Event Data

Action: Get Report Config

Action: Get Resource Lists

Action: Get User Role Information

Action: List Alert Filter Autocomplete Suggestions

Action: List Alert Filters

Action: List Alert Remediation

Action: List Alerts

Action: List Cloud Account Owners

Action: List Cloud Accounts

Action: List Historical Reports Data

Action: List Inventory Filters

Action: List Inventory Objects

Action: List IP Addresses Allowed for Login

Action: List Networks

Action: List Policies

Action: List Report Configs

Action: List Users

Action: Perform Config Search

Action: Perform Event Search

Action: Perform Network Search

Action: Remediate Alert

Action: Reopen Alerts

Action: Search Alerts

Action: Search Alerts by ID

Action: Trigger Scan

Action: Update Policy

Action: View Asset Inventory

Action: Generic Action

Search results