Skip to main content

PrismaCloudComputeParseCloudDiscoveryAlert

This Script is part of the Prisma Cloud Compute by Palo Alto Networks Pack.#

Parse Cloud Discovery alert raw JSON data

Script Data#


NameDescription
Script Typepython3
TagsPrisma Cloud Compute
Cortex XSOAR Version5.0.0

Used In#


This script is used in the following playbooks and scripts.

  • Prisma Cloud Compute - Cloud Discovery Alert

Inputs#


Argument NameDescription
alert_raw_jsonThe compliance alert raw JSON

Outputs#


PathDescriptionType
PrismaCloudCompute.CloudDiscoveryAlert.timeTime represents the alert creation timestampDate
PrismaCloudCompute.CloudDiscoveryAlert.credentialIdCredentialID is the id reference of the credential usedString
PrismaCloudCompute.CloudDiscoveryAlert.providerProvider is the cloud provider for example: AWS, GCPString
PrismaCloudCompute.CloudDiscoveryAlert.serviceTypeServiceType is the cloud service type for example: ECR, GCRString
PrismaCloudCompute.CloudDiscoveryAlert.regionRegion is the region that was scanned, for example: GCP - "us-east-1", Azure - "westus"String
PrismaCloudCompute.CloudDiscoveryAlert.projectProject is the GCP project that was scannedString
PrismaCloudCompute.CloudDiscoveryAlert.registryRegistry is the Azure registry that was scanned, for example: testcloudscanregistry.azurecr.ioString
PrismaCloudCompute.CloudDiscoveryAlert.protectedProtected is the number of protected entities (registries, functions, clusters)Number
PrismaCloudCompute.CloudDiscoveryAlert.totalTotal is total number of entities found in cloud scanNumber
PrismaCloudCompute.CloudDiscoveryAlert.errErr holds any error found during a scanString
PrismaCloudCompute.CloudDiscoveryAlert.entities.nameName is the name of the entityString
PrismaCloudCompute.CloudDiscoveryAlert.entities.protectedProtected indicates if the entity is protectedNumber
PrismaCloudCompute.CloudDiscoveryAlert.entities.lastModifiedLastModified is the modification time of the functionDate
PrismaCloudCompute.CloudDiscoveryAlert.entities.runtimeRuntime is runtime environment for the function, e.g. nodejsString
PrismaCloudCompute.CloudDiscoveryAlert.entities.versionVersion is the version of the entityString
PrismaCloudCompute.CloudDiscoveryAlert.entities.arnThe Amazon Resource Name (ARN) assigned to the entityString
PrismaCloudCompute.CloudDiscoveryAlert.entities.statusStatus is the current status of entityString
PrismaCloudCompute.CloudDiscoveryAlert.entities.runningTasksCountRunningTasksCount is the number of running tasks in ecs clusterNumber
PrismaCloudCompute.CloudDiscoveryAlert.entities.activeServicesCountActiveServicesCount is the number of active services in ecs clusterNumber
PrismaCloudCompute.CloudDiscoveryAlert.entities.createdAtCreatedAt is the time when the entity was createdDate
PrismaCloudCompute.CloudDiscoveryAlert.entities.nodesCountNodesCount is the number of nodes in the cluster (aks, gke)Number
PrismaCloudCompute.CloudDiscoveryAlert.entities.resourceGroupResourceGroup is the the azure resource group containing the entityString
PrismaCloudCompute.CloudDiscoveryAlert.entities.containerGroupContainerGroup is the azure aci container group the container belongs toString
PrismaCloudCompute.CloudDiscoveryAlert.entities.imageImage is the image of an aci containerString
PrismaCloudCompute.CloudDiscoveryAlert.collectionsCollections are the matched result collectionsString
PrismaCloudCompute.CloudDiscoveryAlert.accountIDAccountID is the cloud account IDDate