Skip to main content

Prisma Cloud - Get Owner By Namespace

This Playbook is part of the Prisma Cloud by Palo Alto Networks Pack.#

Supported versions

Supported Cortex XSOAR versions: 6.10.0 and later.

This playbook will retrieve the potential owners of a runtime audit alert. This id done using the "Namespace" value of the incident in order to query associated resource lists and user roles with associated users. Eventually the playbook returns a list of user objects (if found).


This playbook uses the following sub-playbooks, integrations, and scripts.


This playbook does not use any sub-playbooks.






  • prisma-cloud-user-roles-list
  • prisma-cloud-users-list
  • prisma-cloud-resource-list

Playbook Inputs#

NameDescriptionDefault ValueRequired
NamespaceThe namespace that the playbook would search associated users with.Optional
EnrichUsersWhether to enrich found users or not.FalseOptional

Playbook Outputs#

PrismaCloud.UsersThe users which were found by this playbook.unknown
PrismaCloud.Users.emailPrisma Cloud user email.unknown
PrismaCloud.Users.firstNameUser first name.unknown
PrismaCloud.Users.lastNameUser last name.unknown
PrismaCloud.Users.enabledUser enabled.unknown
PrismaCloud.Users.usernameUser username.unknown
PrismaCloud.Users.typeUser type.unknown
PrismaCloud.Users.displayNameUser display name.unknown
PrismaCloud.UserRoles.associatedUsersUser roles associated users.unknown

Playbook Image#

Prisma Cloud - Get Owner By Namespace