Details
Content
Dependencies
Version History

Automate and unify security incident response across your cloud environments, while still giving a degree of control to dedicated cloud teams.

Prisma Cloud

Automate and unify security incident response across your cloud environments, while still giving a degree of control to dedicated cloud teams.
Cloud adoption has expanded the threat surface and created disparate ecosystems that hamper visibility into security vulnerabilities across the network. In addition, cloud provisioning is often managed by multiple teams, making it hard for security teams to keep pace.
The pack includes playbooks that automate Prisma Cloud alert response and custom incident fields, views and layouts to facilitate analyst investigation. The remediation playbooks orchestrate across multiple native cloud integrations (AWS, GCP, Azure) to automate actions like changing policies, revoking access, creating new rules etc.
With this content pack, you can significantly reduce the time your Security Analysts/Cloud Operations team spend on Cloud Security alerts and standardize the way you manage misconfiguration incidents.

What does this pack do?

The playbooks included in this Pack help automate the remediation of alerts generated from the Prisma Cloud platform.

Take action on, remediate, and resolve incidents/ alerts from Prisma Cloud.
Track configuration issues across all your Cloud environments.
Ensure your Cloud environments are compliant and up to date with the latest compliance standards.
Configure your Cloud environments using industry best practices.

As part of this pack, you will also get out-of-the-box Prisma Cloud incident views, segregated alert layouts and playbooks. All of these are easily customizable to suit the needs of your organization.

For more information, visit our Cortex XSOAR Developer Docs

Prisma_Cloud_Remediation_-_GCP_VPC_Network_Misconfiguration

Prisma Cloud

What does this pack do?

The playbooks included in this Pack help automate the remediation of alerts generated from the Prisma Cloud platform.

Take action on, remediate, and resolve incidents/ alerts from Prisma Cloud.
Track configuration issues across all your Cloud environments.
Ensure your Cloud environments are compliant and up to date with the latest compliance standards.
Configure your Cloud environments using industry best practices.

For more information, visit our Cortex XSIAM Developer Docs

Prisma_Cloud_Remediation_-_GCP_VPC_Network_Misconfiguration

This pack includes Cortex XSIAM content.

It supports Prisma Cloud alerts ingestion and modeling.

For additional details regarding Prisma Cloud alerts ingestion & Prisma Cloud Collector configuration, see Ingest Alerts from Prisma Cloud.

Automations

Name	Description
PrismaCloudAttribution	Recursively extracts specified fields from provided list of assets for Prisma Cloud attribution use case.

Classifiers

Name	Description
Prisma Cloud App - Classifier	Classifies incoming Prisma Cloud events that are pushed into Cortex XSOAR through the Prisma Cloud App add-on.
Prisma Cloud - Classifier	Classifies incoming Prisma Cloud alerts that are created through the 'fetch incidents' command in the Prisma Cloud integration.
Prisma Cloud - Incoming Mapper	Maps incoming Prisma Cloud event fields that are created through the 'fetch incidents' command in the Prisma Cloud integration.
User Profile - PrismaCloud (Incoming)	Maps a user data to a User Profile data.
Prisma Cloud App - Incoming Mapper	Maps incoming Prisma Cloud event fields that are pushed into Cortex XSOAR through the Prisma Cloud App add-on.
User Profile - PrismaCloud (Outgoing)	Maps a User Profile data to the PrismaCloudIAM user data.

Dashboards

Name	Description
Prisma Cloud Incidents

Incident Fields

Name	Description
Prisma Cloud - IAM Results
Resource API Name
Subscription Description
Prisma Cloud Reason
Resource Cloud Type
Subscription Name
Subscription Assigned By
Prisma Cloud Rules
RRN
Subscription Updated On
Subscription Created On
Prisma Cloud Time
Prisma Cloud Dismissal Note
Subscription ID
Subscription Type
VPC ID
Subscription Created By
Prisma Cloud ID
Prisma Cloud - Findings Results
System Default
Prisma Cloud Status
Subscription Updated By

Incident Types

Name	Description
Azure Network Misconfiguration
GCP Kubernetes Engine Misconfiguration
AWS EC2 Instance Misconfiguration
Prisma Cloud - VM Alert Prioritization
Azure SQL Misconfiguration
Prisma Cloud
Azure Storage Misconfiguration
Azure AKS Misconfiguration
AWS CloudTrail Misconfiguration
GCP Compute Engine Misconfiguration
AWS IAM Policy Misconfiguration

Integrations

Name	Description
PrismaCloud IAM	The Prisma Cloud IAM API consists of a set of API endpoints that allow customers to perform CRUD operation on their user profiles.
Prisma Cloud (RedLock) (Deprecated)	Deprecated. Use the Prisma Cloud v2 integration instead.
Prisma Cloud v2	Prisma Cloud secures infrastructure, workloads and applications, across the entire cloud-native technology stack.

Layouts

Name	Description
Prisma Cloud - VM Alert Prioritization
Prisma Cloud Incident
Azure SQL Misconfiguration Incident
Azure Storage Misconfiguration
AWS CloudTrail Misconfiguration Incident
Azure Network Misconfiguration Incident
GCP Compute Engine Misconfiguration Incident
AWS EC2 Instance Misconfiguration Incident
Azure AKS Misconfiguration Incident
AWS IAM Policy Misconfiguration Incident
GCP Kubernetes Engine Misconfiguration

Playbooks

Name	Description
Prisma Cloud Remediation - Azure AKS Cluster Misconfiguration	This playbook remediates the following Prisma Cloud Azure AKS cluster alerts. Prisma Cloud policies remediated: Azure AKS cluster monitoring not enabled Azure AKS cluster HTTP application routing enabled
Prisma Cloud - Find GCP Resource by FQDN v2	Find GCP resources by FQDN using Prisma Cloud inventory. Supported services: Cloud DNS.
Prisma Cloud - Get Account Owner	Retrieves the details of the owner of a given cloud account from the following playbooks: Get Cloud Account Owner - Generic Prisma Cloud - Get Owner By Namespace
Prisma Cloud Remediation - AWS CloudTrail Misconfiguration	Deprecated. Use Prisma Cloud Remediation - AWS CloudTrail Misconfiguration v2 instead. This playbook remediates Prisma Cloud AWS CloudTrail alerts. It calls sub-playbooks that perform the actual remediation steps. Remediation: AWS CloudTrail Trail Log Validation Is Not Enabled In All Regions AWS CloudTrail is not enabled in all regions AWS CloudTrail Trail Is Not Integrated With CloudWatch Logs AWS CloudTrail is not enabled on the account
Prisma Cloud - Find Azure Resource by FQDN v2	Find Azure resources by FQDN using Prisma Cloud inventory. Supported services: Azure VM, Azure Load Balancer, Azure Application Gateway, AKS, Azure Web Apps, Azure Storage.
Prisma Cloud Remediation - AWS EC2 Instance Misconfiguration v2	This playbook remediates Prisma Cloud AWS EC2 alerts. It calls the following sub-playbooks to perform the remediation: AWS Default Security Group Does Not Restrict All Traffic (policy id: 2378dbf4-b104-4bda-9b05-7417affbba3f) AWS Security Group allows all traffic on SSH port (22) (policy id: 617b9138-584b-4e8e-ad15-7fbabafbed1a) AWS Security Groups allow internet traffic from internet to RDP port (3389) (policy id: b82f90ce-ed8b-4b49-970c-2268b0a6c2e5).
Prisma Cloud - Find AWS Resource by FQDN v2	Find AWS resources by FQDN using Prisma Cloud inventory. Supported services: EC2, Application Load Balancer, ECS, Route53, CloudFront, S3, API Gateway.
Prisma Cloud Remediation - GCP Kubernetes Engine Misconfiguration v2	This playbook remediates Prisma Cloud GCP Kubernetes Engine alerts. It calls sub-playbooks that perform the actual remediation steps. Remediation: GCP Kubernetes Engine Clusters Basic Authentication is set to Enabled GCP Kubernetes Engine Clusters have HTTP load balancing disabled GCP Kubernetes Engine Clusters have Legacy Authorization enabled GCP Kubernetes Engine Clusters have Master authorized networks disabled GCP Kubernetes Engine Clusters have Network policy disabled GCP Kubernetes Engine Clusters have Stackdriver Logging disabled GCP Kubernetes Engine Clusters have Stackdriver Monitoring disabled GCP Kubernetes Engine Clusters have binary authorization disabled GCP Kubernetes Engine Clusters web UI/Dashboard is set to Enabled GCP Kubernetes cluster intra-node visibility disabled.
Prisma Cloud Correlate Alerts	Deprecated. Use Prisma Cloud Correlate Alerts v2 instead. Search alerts in Prisma Cloud for a specific asset ID and, if present in XSOAR, link them.
Prisma Cloud - Get Owner By Namespace	This playbook will retrieve the potential owners of a runtime audit alert. This is done using the "Namespace" value of the incident in order to query associated resource lists and user roles with associated users. Eventually the playbook returns a list of user objects (if found).
Prisma Cloud Remediation - AWS CloudTrail Misconfiguration v2	This playbook remediates Prisma Cloud AWS CloudTrail alerts. It calls sub-playbooks that perform the actual remediation steps. Remediation: AWS CloudTrail Trail Log Validation Is Not Enabled In All Regions AWS CloudTrail is not enabled in all regions AWS CloudTrail Trail Is Not Integrated With CloudWatch Logs AWS CloudTrail is not enabled on the account.
Prisma Cloud Remediation - AWS EC2 Security Group Misconfiguration	This playbook remediates the Prisma Cloud AWS EC2 alerts generated by the following policies: AWS Default Security Group Does Not Restrict All Traffic AWS Security Group allows all traffic on SSH port (22).
Prisma Cloud - Find AWS Resource by FQDN	Deprecated. Use Prisma Cloud - Find AWS Resource by FQDN v2 instead. Find AWS resources by FQDN using Prisma Cloud inventory. Supported services: EC2, Application Load Balancer, ECS, Route53, CloudFront, S3, API Gateway.
Prisma Cloud Remediation - Azure SQL Misconfiguration v2	This playbook remediates Prisma Cloud Azure SQL alerts. It calls sub-playbooks that perform the actual remediation steps. Remediation: Azure SQL database auditing is disabled Azure SQL Database with Auditing Retention less than 90 days Azure Threat Detection on SQL databases is set to Off Azure SQL Database with Threat Retention less than or equals to 90 days
Prisma Cloud - Find AWS Resource by Public IP	Deprecated. Use Prisma Cloud - Find AWS Resource by Public IP v2 instead. Find AWS resources by Public IP using Prisma Cloud inventory. Supported services: EC2, Network Load Balancer, ECS, Route53.
Prisma Cloud Remediation - Azure SQL Misconfiguration	Deprecated. Use Prisma Cloud Remediation - Azure SQL Misconfiguration v2 instead. This playbook remediates Prisma Cloud Azure SQL alerts. It calls sub-playbooks that perform the actual remediation steps. Remediation: Azure SQL database auditing is disabled Azure SQL Database with Auditing Retention less than 90 days Azure Threat Detection on SQL databases is set to Off Azure SQL Database with Threat Retention less than or equals to 90 days
Prisma Cloud Remediation - GCP VPC Network Misconfiguration	Deprecated. Use Prisma Cloud Remediation - GCP VPC Network Misconfiguration v2 instead. This playbook remediates Prisma Cloud GCP VPC Network alerts. It calls sub-playbooks that perform the actual remediation steps. Remediation: GCP project is using the default network GCP Firewall rule allows internet traffic to FTP port (21) GCP Firewall rule allows internet traffic to HTTP port (80) GCP Firewall rule allows internet traffic to MongoDB port (27017) GCP Firewall rule allows internet traffic to MySQL DB port (3306) GCP Firewall rule allows internet traffic to Oracle DB port (1521) GCP Firewall rule allows internet traffic to PostgreSQL port (5432) GCP Firewall rule allows internet traffic to RDP port (3389) GCP Firewall rule allows internet traffic to SSH port (22) GCP Firewall rule allows internet traffic to Telnet port (23) GCP Firewall rule allows internet traffic to DNS port (53) GCP Firewall rule allows internet traffic to Microsoft-DS port (445) GCP Firewall rule allows internet traffic to NetBIOS-SSN port (139) GCP Firewall rule allows internet traffic to POP3 port (110) GCP Firewall rule allows internet traffic to SMTP port (25) GCP Default Firewall rule should not have any rules (except http and https) GCP Firewall with Inbound rule overly permissive to All Traffic
Prisma Cloud Remediation - Azure Network Misconfiguration	Deprecated. Use Prisma Cloud Remediation - Azure Network Misconfiguration v2 instead. This playbook remediates Prisma Cloud Azure Network alerts. It calls sub-playbooks that perform the actual remediation steps. Remediation: Azure Network Security Group (NSG) having Inbound rule overly permissive to allow all traffic from any source on any protocol Azure Network Security Group (NSG) having Inbound rule overly permissive to allow all traffic from any source on TCP protocol Azure Network Security Group (NSG) having Inbound rule overly permissive to allow all traffic from any source on UDP protocol Azure Network Security Group (NSG) allows SSH traffic from internet on port 22 Azure Network Security Group (NSG) allows traffic from internet on port 3389 Azure Network Security Group allows DNS (TCP Port 53) Azure Network Security Group allows FTP (TCP Port 21) Azure Network Security Group allows FTP-Data (TCP Port 20) Azure Network Security Group allows MSQL (TCP Port 4333) Azure Network Security Group allows MySQL (TCP Port 3306) Azure Network Security Group allows Windows RPC (TCP Port 135) Azure Network Security Group allows Windows SMB (TCP Port 445) Azure Network Security Group allows PostgreSQL (TCP Port 5432) Azure Network Security Group allows SMTP (TCP Port 25) Azure Network Security Group allows SqlServer (TCP Port 1433) Azure Network Security Group allows Telnet (TCP Port 23) Azure Network Security Group allows VNC Listener (TCP Port 5500) Azure Network Security Group allows all traffic on ICMP (Ping) Azure Network Security Group allows CIFS (UDP Port 445) Azure Network Security Group allows NetBIOS (UDP Port 137) Azure Network Security Group allows NetBIOS (UDP Port 138) Azure Network Security Group allows SQLServer (UDP Port 1434) Azure Network Security Group allows DNS (UDP Port 53)
Prisma Cloud Remediation - AWS EC2 Instance Misconfiguration	Deprecated. Use Prisma Cloud Remediation - AWS EC2 Instance Misconfiguration v2 instead. This playbook remediates Prisma Cloud AWS EC2 alerts. It calls the following sub-playbooks to perform the remediation: AWS Default Security Group Does Not Restrict All Traffic AWS Security Groups Allow Internet Traffic AWS Security Groups With Inbound Rule Overly Permissive To All Traffic AWS Security Groups allow internet traffic from internet to FTP-Data port (20) AWS Security Groups allow internet traffic from internet to FTP port (21) AWS Security Groups allow internet traffic to SSH port (22) AWS Security Group allows all traffic on SSH port (22) AWS Security Groups allow internet traffic from internet to Telnet port (23) AWS Security Groups allow internet traffic from internet to SMTP port (25) AWS Security Groups allow internet traffic from internet to DNS port (53) AWS Security Groups allow internet traffic from internet to Windows RPC port (135) AWS Security Groups allow internet traffic from internet to NetBIOS port (137) AWS Security Groups allow internet traffic from internet to NetBIOS port (138) AWS Security Groups allow internet traffic from internet to CIFS port (445) AWS Security Groups allow internet traffic from internet to SQLServer port (1433) AWS Security Groups allow internet traffic from internet to SQLServer port (1434) AWS Security Groups allow internet traffic from internet to MYSQL port (3306) AWS Security Groups allow internet traffic from internet to RDP port (3389) AWS Security Groups allow internet traffic from internet to MSQL port (4333) AWS Security Groups allow internet traffic from internet to PostgreSQL port (5432) AWS Security Groups allow internet traffic from internet to VNC Listener port (5500) AWS Security Groups allow internet traffic from internet to VNC Server port (5900)
Prisma Cloud - Find Public Cloud Resource by Public IP v2	Find Public Cloud resource by Public IP using Prisma Cloud inventory
Prisma Cloud - Find GCP Resource by Public IP	Deprecated. Use Prisma Cloud - Find GCP Resource by Public IP v2 instead. Find GCP resources by Public IP using Prisma Cloud inventory. Supported services: GCE, Load Balancing, GKE.
Prisma Cloud Correlate Alerts v2	Search alerts in Prisma Cloud for a specific asset ID and, if present in Cortex XSOAR, link them.
Prisma Cloud Remediation - AWS CloudTrail Is Not Integrated With CloudWatch Logs	This playbook remediates the following Prisma Cloud AWS CloudTrail alerts. Prisma Cloud policies remediated: AWS CloudTrail Is Not Integrated With CloudWatch Logs
Prisma Cloud Remediation - GCP Kubernetes Engine Misconfiguration	Deprecated. Use Prisma Cloud Remediation - GCP Kubernetes Engine Misconfiguration v2 instead. This playbook remediates Prisma Cloud GCP Kubernetes Engine alerts. It calls sub-playbooks that perform the actual remediation steps. Remediation: GCP Kubernetes Engine Clusters Basic Authentication is set to Enabled GCP Kubernetes Engine Clusters have HTTP load balancing disabled GCP Kubernetes Engine Clusters have Legacy Authorization enabled GCP Kubernetes Engine Clusters have Master authorized networks disabled GCP Kubernetes Engine Clusters have Network policy disabled GCP Kubernetes Engine Clusters have Stackdriver Logging disabled GCP Kubernetes Engine Clusters have Stackdriver Monitoring disabled GCP Kubernetes Engine Clusters have binary authorization disabled GCP Kubernetes Engine Clusters web UI/Dashboard is set to Enabled GCP Kubernetes cluster intra-node visibility disabled
Prisma Cloud Remediation - AWS IAM Policy Misconfiguration v2	This playbook remediates Prisma Cloud AWS IAM policy alerts. It uses sub-playbooks that perform the remediation steps.
Prisma Cloud - Find Azure Resource by Public IP v2	Find Azure resources by Public IP using Prisma Cloud inventory. Supported services: Azure VM, Azure Load Balancer, Azure Application Gateway, Azure Web Apps.
Prisma Cloud Remediation - GCP Compute Engine Instance Misconfiguration	This playbook remediates the following Prisma Cloud GCP Compute Engine VM Instance alerts. Prisma Cloud policies remediated: GCP VM instances have serial port access enabled GCP VM instances have block project-wide SSH keys feature disabled GCP VM instances without any custom metadata information
Prisma Cloud - Find GCP Resource by FQDN	Deprecated. Use Prisma Cloud - Find GCP Resource by FQDN v2 instead. Find GCP resources by FQDN using Prisma Cloud inventory. Supported services: Cloud DNS.
Prisma Cloud Remediation - AWS IAM Policy Misconfiguration	Deprecated. Use Prisma Cloud Remediation - AWS IAM Policy Misconfiguration v2 instead. This playbook remediates Prisma Cloud AWS IAM policy alerts. It uses sub-playbooks that perform the remediation steps.
Prisma Cloud Remediation - GCP Kubernetes Engine Cluster Misconfiguration	This playbook remediates the following Prisma Cloud GCP Kubernetes Engine Cluster alerts. Prisma Cloud policies remediated: GCP Kubernetes Engine Clusters Basic Authentication is set to Enabled GCP Kubernetes Engine Clusters have HTTP load balancing disabled GCP Kubernetes Engine Clusters have Legacy Authorization enabled GCP Kubernetes Engine Clusters have Master authorized networks disabled GCP Kubernetes Engine Clusters have Network policy disabled GCP Kubernetes Engine Clusters have Stackdriver Logging disabled GCP Kubernetes Engine Clusters have Stackdriver Monitoring disabled GCP Kubernetes Engine Clusters have binary authorization disabled GCP Kubernetes Engine Clusters web UI/Dashboard is set to Enabled GCP Kubernetes cluster intra-node visibility disabled
Prisma Cloud - Find GCP Resource by Public IP v2	Find GCP resources by Public IP using Prisma Cloud inventory. Supported services: GCE, Load Balancing, GKE.
Prisma Cloud Remediation - Azure SQL Database Misconfiguration	This playbook remediates the following Prisma Cloud Azure SQL database alerts. Prisma Cloud policies remediated: Azure SQL database auditing is disabled Azure SQL Database with Auditing Retention less than 90 days Azure Threat Detection on SQL databases is set to Off Azure SQL Database with Threat Retention less than or equals to 90 days
Prisma Cloud - Find Public Cloud Resource by Public IP	Find Public Cloud resource by Public IP using Prisma Cloud inventory
Prisma Cloud Remediation - Azure Network Security Group Misconfiguration	This playbook remediates the following Prisma Cloud Azure Network security group alerts. Prisma Cloud policies remediated: Azure Network Security Group (NSG) having Inbound rule overly permissive to allow all traffic from any source on any protocol Azure Network Security Group (NSG) having Inbound rule overly permissive to allow all traffic from any source on TCP protocol Azure Network Security Group (NSG) having Inbound rule overly permissive to allow all traffic from any source on UDP protocol Azure Network Security Group (NSG) allows SSH traffic from internet on port 22 Azure Network Security Group (NSG) allows traffic from internet on port 3389 Azure Network Security Group allows DNS (TCP Port 53) Azure Network Security Group allows FTP (TCP Port 21) Azure Network Security Group allows FTP-Data (TCP Port 20) Azure Network Security Group allows MSQL (TCP Port 4333) Azure Network Security Group allows MySQL (TCP Port 3306) Azure Network Security Group allows Windows RPC (TCP Port 135) Azure Network Security Group allows Windows SMB (TCP Port 445) Azure Network Security Group allows PostgreSQL (TCP Port 5432) Azure Network Security Group allows SMTP (TCP Port 25) Azure Network Security Group allows SqlServer (TCP Port 1433) Azure Network Security Group allows Telnet (TCP Port 23) Azure Network Security Group allows VNC Listener (TCP Port 5500) Azure Network Security Group allows all traffic on ICMP (Ping) Azure Network Security Group allows CIFS (UDP Port 445) Azure Network Security Group allows NetBIOS (UDP Port 137) Azure Network Security Group allows NetBIOS (UDP Port 138) Azure Network Security Group allows SQLServer (UDP Port 1434) Azure Network Security Group allows DNS (UDP Port 53)
Prisma Cloud Remediation - GCP VPC Network Firewall Misconfiguration	This playbook remediates the following Prisma Cloud GCP VPC Network Firewall alerts. Prisma Cloud policies remediated: GCP Firewall rule allows internet traffic to FTP port (21) GCP Firewall rule allows internet traffic to HTTP port (80) GCP Firewall rule allows internet traffic to MongoDB port (27017) GCP Firewall rule allows internet traffic to MySQL DB port (3306) GCP Firewall rule allows internet traffic to Oracle DB port (1521) GCP Firewall rule allows internet traffic to PostgreSQL port (5432) GCP Firewall rule allows internet traffic to RDP port (3389) GCP Firewall rule allows internet traffic to SSH port (22) GCP Firewall rule allows internet traffic to Telnet port (23) GCP Firewall rule allows internet traffic to DNS port (53) GCP Firewall rule allows internet traffic to Microsoft-DS port (445) GCP Firewall rule allows internet traffic to NetBIOS-SSN port (139) GCP Firewall rule allows internet traffic to POP3 port (110) GCP Firewall rule allows internet traffic to SMTP port (25) GCP Default Firewall rule should not have any rules (except http and https) GCP Firewall with Inbound rule overly permissive to All Traffic
Prisma Cloud - Find Azure Resource by FQDN	Deprecated. Use Prisma Cloud - Find Azure Resource by FQDN v2 instead. Find Azure resources by FQDN using Prisma Cloud inventory. Supported services: Azure VM, Azure Load Balancer, Azure Application Gateway, AKS, Azure Web Apps, Azure Storage.
Prisma Cloud Remediation - AWS IAM Password Policy Misconfiguration	This playbook remediates the following Prisma Cloud AWS IAM password policy alerts. Prisma Cloud policies remediated: AWS IAM password policy allows password reuse AWS IAM password policy does not expire in 90 days AWS IAM password policy does not have a lowercase character AWS IAM password policy does not have a minimum of 14 characters AWS IAM password policy does not have a number AWS IAM password policy does not have a symbol AWS IAM password policy does not have a uppercase character AWS IAM password policy does not have password expiration period AWS IAM Password policy is insecure
Prisma Cloud Remediation - GCP Compute Engine Misconfiguration v2	This playbook remediates Prisma Cloud GCP Compute Engine alerts. It calls sub-playbooks that perform the actual remediation steps. Remediation: GCP VM instances have serial port access enabled GCP VM instances have block project-wide SSH keys feature disabled GCP VM instances without any custom metadata information.
Prisma Cloud Remediation - Azure Network Misconfiguration v2	This playbook remediates Prisma Cloud Azure Network alerts. It calls sub-playbooks that perform the actual remediation steps. Remediation: Azure Network Security Group (NSG) having Inbound rule overly permissive to allow all traffic from any source on any protocol Azure Network Security Group (NSG) having Inbound rule overly permissive to allow all traffic from any source on TCP protocol Azure Network Security Group (NSG) having Inbound rule overly permissive to allow all traffic from any source on UDP protocol Azure Network Security Group (NSG) allows SSH traffic from internet on port 22 Azure Network Security Group (NSG) allows traffic from internet on port 3389 Azure Network Security Group allows DNS (TCP Port 53) Azure Network Security Group allows FTP (TCP Port 21) Azure Network Security Group allows FTP-Data (TCP Port 20) Azure Network Security Group allows MSQL (TCP Port 4333) Azure Network Security Group allows MySQL (TCP Port 3306) Azure Network Security Group allows Windows RPC (TCP Port 135) Azure Network Security Group allows Windows SMB (TCP Port 445) Azure Network Security Group allows PostgreSQL (TCP Port 5432) Azure Network Security Group allows SMTP (TCP Port 25) Azure Network Security Group allows SqlServer (TCP Port 1433) Azure Network Security Group allows Telnet (TCP Port 23) Azure Network Security Group allows VNC Listener (TCP Port 5500) Azure Network Security Group allows all traffic on ICMP (Ping) Azure Network Security Group allows CIFS (UDP Port 445) Azure Network Security Group allows NetBIOS (UDP Port 137) Azure Network Security Group allows NetBIOS (UDP Port 138) Azure Network Security Group allows SQLServer (UDP Port 1434) Azure Network Security Group allows DNS (UDP Port 53).
Prisma Cloud - Find AWS Resource by Public IP v2	Find AWS resources by Public IP using Prisma Cloud inventory. Supported services: EC2, Network Load Balancer, ECS, Route53.
Prisma Cloud Remediation - AWS Security Groups Allows Internet Traffic To TCP Port	This playbook extracts the TCP public Security Groups rule and provides manual/automatic options to have the rules revoked.
Prisma Cloud Remediation - Azure Storage Misconfiguration	Deprecated. Use Prisma Cloud Remediation - Azure Storage Misconfiguration v2 instead. This playbook remediates Prisma Cloud Azure Storage alerts. It calls sub-playbooks that perform the actual remediation steps. Remediation: Azure storage account has a blob container with public access Azure storage account logging for blobs is disabled Azure Storage Accounts without Secure transfer enabled Azure storage account logging for queues is disabled Azure storage account logging for tables is disabled #95
Prisma Cloud Remediation - Azure AKS Misconfiguration	Deprecated. Use Prisma Cloud Remediation - Azure AKS Misconfiguration v2 instead. This playbook remediates Prisma Cloud Azure AKS alerts. It calls sub-playbooks that perform the actual remediation steps. Remediation: Azure AKS cluster monitoring not enabled Azure AKS cluster HTTP application routing enabled
Prisma Cloud - RQL Execution	This playbook enables Prisma Cloud RQL Execution from the alert layout.
Prisma Cloud - VM Alert Prioritization	This playbook handles incidents related to dozens of Prisma Cloud public VM alerts. It determines the severity of the ingested alert based on data returned from Cortex XSOAR commands interacting with the Prisma Cloud API and creates new issues in either Slack or Jira, with all of the relevant information. The playbook updates the Cortex XSOAR incident’s layout with information the analyst can use to investigate the alert. It also extracts and enriches indicators using existing configured integrations and then closes the investigation. The flow of this playbook is as following: 1) Check the CSP type. 2) Check whether there's a public IP associated to the instance. In case there is, it will continue to other steps, if not, it will set the severity of the incident to "Low" and will close the incident. 3) Check if there are any vulnerabilities or findings related to the instance. 4) Check if there are any IAM permissions associated to the instance. 5) Set the incident severity based on the results: Low - No public IP was found. Medium - Public IP was found, other checks didn't return results. High - Public IP was found and also one of the other checks returned results. Critical - Public IP was found and both of the other checks returned results. 6) Notifications and ticketing with 3rd party systems. 7) Close the incident. This playbook will run when a new incident is created with the Prisma Cloud - VM Alert Prioritization incident type which also includes a dedicated layout.
Prisma Cloud Remediation - Azure Storage Misconfiguration v2	This playbook remediates Prisma Cloud Azure Storage alerts. It calls sub-playbooks that perform the actual remediation steps. Remediation: Azure storage account has a blob container with public access Azure storage account logging for blobs is disabled Azure Storage Accounts without Secure transfer enabled Azure storage account logging for queues is disabled Azure storage account logging for tables is disabled
Prisma Cloud - Find Azure Resource by Public IP	Deprecated. Use Prisma Cloud - Find Azure Resource by Public IP v2 instead. Find Azure resources by Public IP using Prisma Cloud inventory. Supported services: Azure VM, Azure Load Balancer, Azure Application Gateway, Azure Web Apps.
Prisma Cloud - Find Public Cloud Resource by FQDN	Find Public Cloud resources by FQDN using Prisma Cloud inventory
Prisma Cloud Remediation - AWS CloudTrail is not Enabled on the Account	AWS Cloudtrail is a service which provides event history of your AWS account activity, including actions taken through the AWS Management Console, AWS SDKs, command line tools, and other AWS services. To remediate Prisma Cloud Alert "CloudTrail is not enabled on the account", this playbook creates an S3 bucket to host Cloudtrail logs and enable Cloudtrail (includes all region events and global service events).
Prisma Cloud Remediation - AWS Inactive Users For More Than 30 Days	To increase the security of your AWS account, it is recommended to find and remove IAM user credentials (passwords, access keys) that have not been used within a specified period of time. To remediate Prisma Cloud Alert Inactive users for more than 30 days, this playbook deactivates the user by disabling the access keys (marking them as inactive) as well as resetting the user console password.
Prisma Cloud Remediation - GCP Compute Engine Misconfiguration	Deprecated. Use Prisma Cloud Remediation - GCP Compute Engine Misconfiguration v2 instead. This playbook remediates Prisma Cloud GCP Compute Engine alerts. It calls sub-playbooks that perform the actual remediation steps. Remediation: GCP VM instances have serial port access enabled GCP VM instances have block project-wide SSH keys feature disabled GCP VM instances without any custom metadata information
Prisma Cloud Remediation - Azure Storage Blob Misconfiguration	This playbook remediates the following Prisma Cloud Azure Storage blob alerts. Prisma Cloud policies remediated: Azure storage account has a blob container with public access Azure storage account logging for blobs is disabled
Prisma Cloud Remediation - AWS IAM User Policy Misconfiguration	This playbook remediates the following Prisma Cloud AWS IAM User alerts. Prisma Cloud policies remediated: AWS IAM user has two active Access Keys
Prisma Cloud Remediation - GCP VPC Network Misconfiguration v2	This playbook remediates Prisma Cloud GCP VPC Network alerts. It calls sub-playbooks that perform the actual remediation steps. Remediation: GCP project is using the default network GCP Firewall rule allows internet traffic to FTP port (21) GCP Firewall rule allows internet traffic to HTTP port (80) GCP Firewall rule allows internet traffic to MongoDB port (27017) GCP Firewall rule allows internet traffic to MySQL DB port (3306) GCP Firewall rule allows internet traffic to Oracle DB port (1521) GCP Firewall rule allows internet traffic to PostgreSQL port (5432) GCP Firewall rule allows internet traffic to RDP port (3389) GCP Firewall rule allows internet traffic to SSH port (22) GCP Firewall rule allows internet traffic to Telnet port (23) GCP Firewall rule allows internet traffic to DNS port (53) GCP Firewall rule allows internet traffic to Microsoft-DS port (445) GCP Firewall rule allows internet traffic to NetBIOS-SSN port (139) GCP Firewall rule allows internet traffic to POP3 port (110) GCP Firewall rule allows internet traffic to SMTP port (25) GCP Default Firewall rule should not have any rules (except http and https) GCP Firewall with Inbound rule overly permissive to All Traffic
Prisma Cloud Remediation - GCP VPC Network Project Misconfiguration	This playbook remediates the following Prisma Cloud GCP VPC Network Project alerts. Prisma Cloud policies remediated: GCP project is using the default network
Prisma Cloud Remediation - Azure AKS Misconfiguration v2	This playbook remediates Prisma Cloud Azure AKS alerts. It calls sub-playbooks that perform the actual remediation steps. Remediation: Azure AKS cluster monitoring not enabled Azure AKS cluster HTTP application routing enabled
Prisma Cloud Remediation - AWS CloudTrail Trail Misconfiguration	This playbook remediates the following Prisma Cloud AWS CloudTrail alerts. Prisma Cloud policies remediated: AWS CloudTrail Trail Log Validation Is Not Enabled In All Regions AWS CloudTrail is not enabled in all regions.

Automations

Name	Description
PrismaCloudAttribution	Recursively extracts specified fields from provided list of assets for Prisma Cloud attribution use case.

Classifiers

Name	Description
Prisma Cloud - Classifier	Classifies incoming Prisma Cloud alerts that are created through the 'fetch incidents' command in the Prisma Cloud integration.
Prisma Cloud App - Classifier	Classifies incoming Prisma Cloud events that are pushed into Cortex XSIAM through the Prisma Cloud App add-on.
Prisma Cloud App - Incoming Mapper	Maps incoming Prisma Cloud event fields that are pushed into Cortex XSIAM through the Prisma Cloud App add-on.
User Profile - PrismaCloud (Incoming)	Maps a user data to a User Profile data.
User Profile - PrismaCloud (Outgoing)	Maps a User Profile data to the PrismaCloudIAM user data.
Prisma Cloud - Incoming Mapper	Maps incoming Prisma Cloud event fields that are created through the 'fetch incidents' command in the Prisma Cloud integration.

Incident Fields

Name	Description
Subscription Name
Prisma Cloud ID
System Default
Resource API Name
Subscription Type
Subscription Updated By
Prisma Cloud Dismissal Note
Subscription Updated On
Prisma Cloud Time
Prisma Cloud - IAM Results
Subscription ID
Resource Cloud Type
RRN
Prisma Cloud Rules
Subscription Description
Subscription Assigned By
VPC ID
Subscription Created By
Prisma Cloud Reason
Subscription Created On
Prisma Cloud - Findings Results
Prisma Cloud Status

Incident Types

Name	Description
AWS CloudTrail Misconfiguration
AWS EC2 Instance Misconfiguration
GCP Compute Engine Misconfiguration
GCP Kubernetes Engine Misconfiguration
Azure AKS Misconfiguration
Azure Network Misconfiguration
Azure SQL Misconfiguration
Azure Storage Misconfiguration
Prisma Cloud - VM Alert Prioritization
AWS IAM Policy Misconfiguration
Prisma Cloud

Integrations

Name	Description
Prisma Cloud v2	Prisma Cloud secures infrastructure, workloads and applications, across the entire cloud-native technology stack.
PrismaCloud IAM	The Prisma Cloud IAM API consists of a set of API endpoints that allow customers to perform CRUD operation on their user profiles.
Prisma Cloud (RedLock) (Deprecated)	Deprecated. Use the Prisma Cloud v2 integration instead.

Layoutrule

Name	Description
Prisma Cloud V2 Layout Rule	display for Prisma Cloud alerts.
Prisma Cloud Network API and Anomaly	display for Prisma Cloud Network API and Anomaly alerts.

Layouts

Name	Description
Prisma Cloud - Network API and Anomaly Incident Layout
Prisma Cloud V2

Modeling Rules

Name	Description
Palo Alto Prisma Cloud Modeling Rule

Parsing Rules

Name	Description
Palo Alto Prisma Cloud Parsing Rule

Playbooks

Name	Description
Prisma Cloud - Find Azure Resource by Public IP	Deprecated. Use Prisma Cloud - Find Azure Resource by Public IP v2 instead. Find Azure resources by Public IP using Prisma Cloud inventory. Supported services: Azure VM, Azure Load Balancer, Azure Application Gateway, Azure Web Apps.
Prisma Cloud Remediation - GCP VPC Network Firewall Misconfiguration	This playbook remediates the following Prisma Cloud GCP VPC Network Firewall alerts. Prisma Cloud policies remediated: GCP Firewall rule allows internet traffic to FTP port (21) GCP Firewall rule allows internet traffic to HTTP port (80) GCP Firewall rule allows internet traffic to MongoDB port (27017) GCP Firewall rule allows internet traffic to MySQL DB port (3306) GCP Firewall rule allows internet traffic to Oracle DB port (1521) GCP Firewall rule allows internet traffic to PostgreSQL port (5432) GCP Firewall rule allows internet traffic to RDP port (3389) GCP Firewall rule allows internet traffic to SSH port (22) GCP Firewall rule allows internet traffic to Telnet port (23) GCP Firewall rule allows internet traffic to DNS port (53) GCP Firewall rule allows internet traffic to Microsoft-DS port (445) GCP Firewall rule allows internet traffic to NetBIOS-SSN port (139) GCP Firewall rule allows internet traffic to POP3 port (110) GCP Firewall rule allows internet traffic to SMTP port (25) GCP Default Firewall rule should not have any rules (except http and https) GCP Firewall with Inbound rule overly permissive to All Traffic
Prisma Cloud Remediation - Azure AKS Misconfiguration	Deprecated. Use Prisma Cloud Remediation - Azure AKS Misconfiguration v2 instead. This playbook remediates Prisma Cloud Azure AKS alerts. It calls sub-playbooks that perform the actual remediation steps. Remediation: Azure AKS cluster monitoring not enabled Azure AKS cluster HTTP application routing enabled
Prisma Cloud Remediation - AWS IAM User Policy Misconfiguration	This playbook remediates the following Prisma Cloud AWS IAM User alerts. Prisma Cloud policies remediated: AWS IAM user has two active Access Keys
Prisma Cloud - RQL Execution	This playbook enables Prisma Cloud RQL Execution from the alert layout.
Prisma Cloud Remediation - AWS CloudTrail Misconfiguration v2	This playbook remediates Prisma Cloud AWS CloudTrail alerts. It calls sub-playbooks that perform the actual remediation steps. Remediation: AWS CloudTrail Trail Log Validation Is Not Enabled In All Regions AWS CloudTrail is not enabled in all regions AWS CloudTrail Trail Is Not Integrated With CloudWatch Logs AWS CloudTrail is not enabled on the account.
Prisma Cloud Remediation - AWS IAM Password Policy Misconfiguration	This playbook remediates the following Prisma Cloud AWS IAM password policy alerts. Prisma Cloud policies remediated: AWS IAM password policy allows password reuse AWS IAM password policy does not expire in 90 days AWS IAM password policy does not have a lowercase character AWS IAM password policy does not have a minimum of 14 characters AWS IAM password policy does not have a number AWS IAM password policy does not have a symbol AWS IAM password policy does not have a uppercase character AWS IAM password policy does not have password expiration period AWS IAM Password policy is insecure
Prisma Cloud - Find AWS Resource by Public IP v2	Find AWS resources by Public IP using Prisma Cloud inventory. Supported services: EC2, Network Load Balancer, ECS, Route53.
Prisma Cloud Remediation - AWS IAM Policy Misconfiguration	Deprecated. Use Prisma Cloud Remediation - AWS IAM Policy Misconfiguration v2 instead. This playbook remediates Prisma Cloud AWS IAM policy alerts. It uses sub-playbooks that perform the remediation steps.
Prisma Cloud - VM Alert Prioritization	This playbook handles alerts related to dozens of Prisma Cloud public VM alerts. It determines the severity of the ingested alert based on data returned from Cortex XSIAM commands interacting with the Prisma Cloud API and creates new issues in either Slack or Jira, with all of the relevant information. The playbook updates the Cortex XSIAM alert’s layout with information the analyst can use to investigate the alert. It also extracts and enriches indicators using existing configured integrations and then closes the investigation. The flow of this playbook is as following: 1) Check the CSP type. 2) Check whether there's a public IP associated to the instance. In case there is, it will continue to other steps, if not, it will set the severity of the alert to "Low" and will close the alert. 3) Check if there are any vulnerabilities or findings related to the instance. 4) Check if there are any IAM permissions associated to the instance. 5) Set the alert severity based on the results: Low - No public IP was found. Medium - Public IP was found, other checks didn't return results. High - Public IP was found and also one of the other checks returned results. Critical - Public IP was found and both of the other checks returned results. 6) Notifications and ticketing with 3rd party systems. 7) Close the alert. This playbook will run when a new alert is created with the Prisma Cloud - VM Alert Prioritization alert type which also includes a dedicated layout.
Prisma Cloud Remediation - GCP VPC Network Project Misconfiguration	This playbook remediates the following Prisma Cloud GCP VPC Network Project alerts. Prisma Cloud policies remediated: GCP project is using the default network
Prisma Cloud Remediation - Azure Storage Blob Misconfiguration	This playbook remediates the following Prisma Cloud Azure Storage blob alerts. Prisma Cloud policies remediated: Azure storage account has a blob container with public access Azure storage account logging for blobs is disabled
Prisma Cloud Remediation - Azure Storage Misconfiguration	Deprecated. Use Prisma Cloud Remediation - Azure Storage Misconfiguration v2 instead. This playbook remediates Prisma Cloud Azure Storage alerts. It calls sub-playbooks that perform the actual remediation steps. Remediation: Azure storage account has a blob container with public access Azure storage account logging for blobs is disabled Azure Storage Accounts without Secure transfer enabled Azure storage account logging for queues is disabled Azure storage account logging for tables is disabled #95
Prisma Cloud Remediation - AWS CloudTrail is not Enabled on the Account	AWS Cloudtrail is a service which provides event history of your AWS account activity, including actions taken through the AWS Management Console, AWS SDKs, command line tools, and other AWS services. To remediate Prisma Cloud Alert "CloudTrail is not enabled on the account", this playbook creates an S3 bucket to host Cloudtrail logs and enable Cloudtrail (includes all region events and global service events).
Prisma Cloud - Find Azure Resource by FQDN v2	Find Azure resources by FQDN using Prisma Cloud inventory. Supported services: Azure VM, Azure Load Balancer, Azure Application Gateway, AKS, Azure Web Apps, Azure Storage.
Prisma Cloud Remediation - AWS Security Groups Allows Internet Traffic To TCP Port	This playbook extracts the TCP public Security Groups rule and provides manual/automatic options to have the rules revoked.
Prisma Cloud Remediation - Azure AKS Cluster Misconfiguration	This playbook remediates the following Prisma Cloud Azure AKS cluster alerts. Prisma Cloud policies remediated: Azure AKS cluster monitoring not enabled Azure AKS cluster HTTP application routing enabled
Prisma Cloud Remediation - AWS CloudTrail Is Not Integrated With CloudWatch Logs	This playbook remediates the following Prisma Cloud AWS CloudTrail alerts. Prisma Cloud policies remediated: AWS CloudTrail Is Not Integrated With CloudWatch Logs
Prisma Cloud Remediation - AWS CloudTrail Trail Misconfiguration	This playbook remediates the following Prisma Cloud AWS CloudTrail alerts. Prisma Cloud policies remediated: AWS CloudTrail Trail Log Validation Is Not Enabled In All Regions AWS CloudTrail is not enabled in all regions.
Prisma Cloud Remediation - GCP Kubernetes Engine Cluster Misconfiguration	This playbook remediates the following Prisma Cloud GCP Kubernetes Engine Cluster alerts. Prisma Cloud policies remediated: GCP Kubernetes Engine Clusters Basic Authentication is set to Enabled GCP Kubernetes Engine Clusters have HTTP load balancing disabled GCP Kubernetes Engine Clusters have Legacy Authorization enabled GCP Kubernetes Engine Clusters have Master authorized networks disabled GCP Kubernetes Engine Clusters have Network policy disabled GCP Kubernetes Engine Clusters have Stackdriver Logging disabled GCP Kubernetes Engine Clusters have Stackdriver Monitoring disabled GCP Kubernetes Engine Clusters have binary authorization disabled GCP Kubernetes Engine Clusters web UI/Dashboard is set to Enabled GCP Kubernetes cluster intra-node visibility disabled
Prisma Cloud - Find Public Cloud Resource by Public IP	Find Public Cloud resource by Public IP using Prisma Cloud inventory
Prisma Cloud Remediation - Azure SQL Database Misconfiguration	This playbook remediates the following Prisma Cloud Azure SQL database alerts. Prisma Cloud policies remediated: Azure SQL database auditing is disabled Azure SQL Database with Auditing Retention less than 90 days Azure Threat Detection on SQL databases is set to Off Azure SQL Database with Threat Retention less than or equals to 90 days
Prisma Cloud Remediation - Azure Network Misconfiguration v2	This playbook remediates Prisma Cloud Azure Network alerts. It calls sub-playbooks that perform the actual remediation steps. Remediation: Azure Network Security Group (NSG) having Inbound rule overly permissive to allow all traffic from any source on any protocol Azure Network Security Group (NSG) having Inbound rule overly permissive to allow all traffic from any source on TCP protocol Azure Network Security Group (NSG) having Inbound rule overly permissive to allow all traffic from any source on UDP protocol Azure Network Security Group (NSG) allows SSH traffic from internet on port 22 Azure Network Security Group (NSG) allows traffic from internet on port 3389 Azure Network Security Group allows DNS (TCP Port 53) Azure Network Security Group allows FTP (TCP Port 21) Azure Network Security Group allows FTP-Data (TCP Port 20) Azure Network Security Group allows MSQL (TCP Port 4333) Azure Network Security Group allows MySQL (TCP Port 3306) Azure Network Security Group allows Windows RPC (TCP Port 135) Azure Network Security Group allows Windows SMB (TCP Port 445) Azure Network Security Group allows PostgreSQL (TCP Port 5432) Azure Network Security Group allows SMTP (TCP Port 25) Azure Network Security Group allows SqlServer (TCP Port 1433) Azure Network Security Group allows Telnet (TCP Port 23) Azure Network Security Group allows VNC Listener (TCP Port 5500) Azure Network Security Group allows all traffic on ICMP (Ping) Azure Network Security Group allows CIFS (UDP Port 445) Azure Network Security Group allows NetBIOS (UDP Port 137) Azure Network Security Group allows NetBIOS (UDP Port 138) Azure Network Security Group allows SQLServer (UDP Port 1434) Azure Network Security Group allows DNS (UDP Port 53).
Prisma Cloud Remediation - GCP VPC Network Misconfiguration	Deprecated. Use Prisma Cloud Remediation - GCP VPC Network Misconfiguration v2 instead. This playbook remediates Prisma Cloud GCP VPC Network alerts. It calls sub-playbooks that perform the actual remediation steps. Remediation: GCP project is using the default network GCP Firewall rule allows internet traffic to FTP port (21) GCP Firewall rule allows internet traffic to HTTP port (80) GCP Firewall rule allows internet traffic to MongoDB port (27017) GCP Firewall rule allows internet traffic to MySQL DB port (3306) GCP Firewall rule allows internet traffic to Oracle DB port (1521) GCP Firewall rule allows internet traffic to PostgreSQL port (5432) GCP Firewall rule allows internet traffic to RDP port (3389) GCP Firewall rule allows internet traffic to SSH port (22) GCP Firewall rule allows internet traffic to Telnet port (23) GCP Firewall rule allows internet traffic to DNS port (53) GCP Firewall rule allows internet traffic to Microsoft-DS port (445) GCP Firewall rule allows internet traffic to NetBIOS-SSN port (139) GCP Firewall rule allows internet traffic to POP3 port (110) GCP Firewall rule allows internet traffic to SMTP port (25) GCP Default Firewall rule should not have any rules (except http and https) GCP Firewall with Inbound rule overly permissive to All Traffic
Prisma Cloud - Find Public Cloud Resource by FQDN	Find Public Cloud resources by FQDN using Prisma Cloud inventory
Prisma Cloud Remediation - Azure Network Misconfiguration	Deprecated. Use Prisma Cloud Remediation - Azure Network Misconfiguration v2 instead. This playbook remediates Prisma Cloud Azure Network alerts. It calls sub-playbooks that perform the actual remediation steps. Remediation: Azure Network Security Group (NSG) having Inbound rule overly permissive to allow all traffic from any source on any protocol Azure Network Security Group (NSG) having Inbound rule overly permissive to allow all traffic from any source on TCP protocol Azure Network Security Group (NSG) having Inbound rule overly permissive to allow all traffic from any source on UDP protocol Azure Network Security Group (NSG) allows SSH traffic from internet on port 22 Azure Network Security Group (NSG) allows traffic from internet on port 3389 Azure Network Security Group allows DNS (TCP Port 53) Azure Network Security Group allows FTP (TCP Port 21) Azure Network Security Group allows FTP-Data (TCP Port 20) Azure Network Security Group allows MSQL (TCP Port 4333) Azure Network Security Group allows MySQL (TCP Port 3306) Azure Network Security Group allows Windows RPC (TCP Port 135) Azure Network Security Group allows Windows SMB (TCP Port 445) Azure Network Security Group allows PostgreSQL (TCP Port 5432) Azure Network Security Group allows SMTP (TCP Port 25) Azure Network Security Group allows SqlServer (TCP Port 1433) Azure Network Security Group allows Telnet (TCP Port 23) Azure Network Security Group allows VNC Listener (TCP Port 5500) Azure Network Security Group allows all traffic on ICMP (Ping) Azure Network Security Group allows CIFS (UDP Port 445) Azure Network Security Group allows NetBIOS (UDP Port 137) Azure Network Security Group allows NetBIOS (UDP Port 138) Azure Network Security Group allows SQLServer (UDP Port 1434) Azure Network Security Group allows DNS (UDP Port 53)
Prisma Cloud - Get Owner By Namespace	This playbook will retrieve the potential owners of a runtime audit alert. This is done using the "Namespace" value of the alert in order to query associated resource lists and user roles with associated users. Eventually the playbook returns a list of user objects (if found).
Prisma Cloud - Find Azure Resource by Public IP v2	Find Azure resources by Public IP using Prisma Cloud inventory. Supported services: Azure VM, Azure Load Balancer, Azure Application Gateway, Azure Web Apps.
Prisma Cloud Remediation - GCP Compute Engine Instance Misconfiguration	This playbook remediates the following Prisma Cloud GCP Compute Engine VM Instance alerts. Prisma Cloud policies remediated: GCP VM instances have serial port access enabled GCP VM instances have block project-wide SSH keys feature disabled GCP VM instances without any custom metadata information
Prisma Cloud Correlate Alerts v2	Search alerts in Prisma Cloud for a specific asset ID and, if present in Cortex XSIAM, link them.
Prisma Cloud Remediation - AWS CloudTrail Misconfiguration	Deprecated. Use Prisma Cloud Remediation - AWS CloudTrail Misconfiguration v2 instead. This playbook remediates Prisma Cloud AWS CloudTrail alerts. It calls sub-playbooks that perform the actual remediation steps. Remediation: AWS CloudTrail Trail Log Validation Is Not Enabled In All Regions AWS CloudTrail is not enabled in all regions AWS CloudTrail Trail Is Not Integrated With CloudWatch Logs AWS CloudTrail is not enabled on the account
Prisma Cloud Remediation - AWS EC2 Instance Misconfiguration v2	This playbook remediates Prisma Cloud AWS EC2 alerts. It calls the following sub-playbooks to perform the remediation: AWS Default Security Group Does Not Restrict All Traffic (policy id: 2378dbf4-b104-4bda-9b05-7417affbba3f) AWS Security Group allows all traffic on SSH port (22) (policy id: 617b9138-584b-4e8e-ad15-7fbabafbed1a) AWS Security Groups allow internet traffic from internet to RDP port (3389) (policy id: b82f90ce-ed8b-4b49-970c-2268b0a6c2e5).
Prisma Cloud Remediation - AWS Inactive Users For More Than 30 Days	To increase the security of your AWS account, it is recommended to find and remove IAM user credentials (passwords, access keys) that have not been used within a specified period of time. To remediate Prisma Cloud Alert Inactive users for more than 30 days, this playbook deactivates the user by disabling the access keys (marking them as inactive) as well as resetting the user console password.
Prisma Cloud Remediation - AWS EC2 Security Group Misconfiguration	This playbook remediates the Prisma Cloud AWS EC2 alerts generated by the following policies: AWS Default Security Group Does Not Restrict All Traffic AWS Security Group allows all traffic on SSH port (22).
Prisma Cloud Remediation - GCP Compute Engine Misconfiguration	Deprecated. Use Prisma Cloud Remediation - GCP Compute Engine Misconfiguration v2 instead. This playbook remediates Prisma Cloud GCP Compute Engine alerts. It calls sub-playbooks that perform the actual remediation steps. Remediation: GCP VM instances have serial port access enabled GCP VM instances have block project-wide SSH keys feature disabled GCP VM instances without any custom metadata information
Prisma Cloud - Find GCP Resource by Public IP	Deprecated. Use Prisma Cloud - Find GCP Resource by Public IP v2 instead. Find GCP resources by Public IP using Prisma Cloud inventory. Supported services: GCE, Load Balancing, GKE.
Prisma Cloud Remediation - GCP VPC Network Misconfiguration v2	This playbook remediates Prisma Cloud GCP VPC Network alerts. It calls sub-playbooks that perform the actual remediation steps. Remediation: GCP project is using the default network GCP Firewall rule allows internet traffic to FTP port (21) GCP Firewall rule allows internet traffic to HTTP port (80) GCP Firewall rule allows internet traffic to MongoDB port (27017) GCP Firewall rule allows internet traffic to MySQL DB port (3306) GCP Firewall rule allows internet traffic to Oracle DB port (1521) GCP Firewall rule allows internet traffic to PostgreSQL port (5432) GCP Firewall rule allows internet traffic to RDP port (3389) GCP Firewall rule allows internet traffic to SSH port (22) GCP Firewall rule allows internet traffic to Telnet port (23) GCP Firewall rule allows internet traffic to DNS port (53) GCP Firewall rule allows internet traffic to Microsoft-DS port (445) GCP Firewall rule allows internet traffic to NetBIOS-SSN port (139) GCP Firewall rule allows internet traffic to POP3 port (110) GCP Firewall rule allows internet traffic to SMTP port (25) GCP Default Firewall rule should not have any rules (except http and https) GCP Firewall with Inbound rule overly permissive to All Traffic
Prisma Cloud - Find AWS Resource by Public IP	Deprecated. Use Prisma Cloud - Find AWS Resource by Public IP v2 instead. Find AWS resources by Public IP using Prisma Cloud inventory. Supported services: EC2, Network Load Balancer, ECS, Route53.
Prisma Cloud - Find AWS Resource by FQDN v2	Find AWS resources by FQDN using Prisma Cloud inventory. Supported services: EC2, Application Load Balancer, ECS, Route53, CloudFront, S3, API Gateway.
Prisma Cloud - Find GCP Resource by FQDN	Deprecated. Use Prisma Cloud - Find GCP Resource by FQDN v2 instead. Find GCP resources by FQDN using Prisma Cloud inventory. Supported services: Cloud DNS.
Prisma Cloud - Get Account Owner	Retrieves the details of the owner of a given cloud account from the following playbooks: Get Cloud Account Owner - Generic Prisma Cloud - Get Owner By Namespace
Prisma Cloud Remediation - GCP Compute Engine Misconfiguration v2	This playbook remediates Prisma Cloud GCP Compute Engine alerts. It calls sub-playbooks that perform the actual remediation steps. Remediation: GCP VM instances have serial port access enabled GCP VM instances have block project-wide SSH keys feature disabled GCP VM instances without any custom metadata information.
Prisma Cloud - Find Azure Resource by FQDN	Deprecated. Use Prisma Cloud - Find Azure Resource by FQDN v2 instead. Find Azure resources by FQDN using Prisma Cloud inventory. Supported services: Azure VM, Azure Load Balancer, Azure Application Gateway, AKS, Azure Web Apps, Azure Storage.
Prisma Cloud - Find AWS Resource by FQDN	Deprecated. Use Prisma Cloud - Find AWS Resource by FQDN v2 instead. Find AWS resources by FQDN using Prisma Cloud inventory. Supported services: EC2, Application Load Balancer, ECS, Route53, CloudFront, S3, API Gateway.
Prisma Cloud Remediation - GCP Kubernetes Engine Misconfiguration	Deprecated. Use Prisma Cloud Remediation - GCP Kubernetes Engine Misconfiguration v2 instead. This playbook remediates Prisma Cloud GCP Kubernetes Engine alerts. It calls sub-playbooks that perform the actual remediation steps. Remediation: GCP Kubernetes Engine Clusters Basic Authentication is set to Enabled GCP Kubernetes Engine Clusters have HTTP load balancing disabled GCP Kubernetes Engine Clusters have Legacy Authorization enabled GCP Kubernetes Engine Clusters have Master authorized networks disabled GCP Kubernetes Engine Clusters have Network policy disabled GCP Kubernetes Engine Clusters have Stackdriver Logging disabled GCP Kubernetes Engine Clusters have Stackdriver Monitoring disabled GCP Kubernetes Engine Clusters have binary authorization disabled GCP Kubernetes Engine Clusters web UI/Dashboard is set to Enabled GCP Kubernetes cluster intra-node visibility disabled
Prisma Cloud Remediation - Azure SQL Misconfiguration	Deprecated. Use Prisma Cloud Remediation - Azure SQL Misconfiguration v2 instead. This playbook remediates Prisma Cloud Azure SQL alerts. It calls sub-playbooks that perform the actual remediation steps. Remediation: Azure SQL database auditing is disabled Azure SQL Database with Auditing Retention less than 90 days Azure Threat Detection on SQL databases is set to Off Azure SQL Database with Threat Retention less than or equals to 90 days
Prisma Cloud Remediation - Azure SQL Misconfiguration v2	This playbook remediates Prisma Cloud Azure SQL alerts. It calls sub-playbooks that perform the actual remediation steps. Remediation: Azure SQL database auditing is disabled Azure SQL Database with Auditing Retention less than 90 days Azure Threat Detection on SQL databases is set to Off Azure SQL Database with Threat Retention less than or equals to 90 days
Prisma Cloud Remediation - Azure AKS Misconfiguration v2	This playbook remediates Prisma Cloud Azure AKS alerts. It calls sub-playbooks that perform the actual remediation steps. Remediation: Azure AKS cluster monitoring not enabled Azure AKS cluster HTTP application routing enabled
Prisma Cloud Remediation - AWS EC2 Instance Misconfiguration	Deprecated. Use Prisma Cloud Remediation - AWS EC2 Instance Misconfiguration v2 instead. This playbook remediates Prisma Cloud AWS EC2 alerts. It calls the following sub-playbooks to perform the remediation: AWS Default Security Group Does Not Restrict All Traffic AWS Security Groups Allow Internet Traffic AWS Security Groups With Inbound Rule Overly Permissive To All Traffic AWS Security Groups allow internet traffic from internet to FTP-Data port (20) AWS Security Groups allow internet traffic from internet to FTP port (21) AWS Security Groups allow internet traffic to SSH port (22) AWS Security Group allows all traffic on SSH port (22) AWS Security Groups allow internet traffic from internet to Telnet port (23) AWS Security Groups allow internet traffic from internet to SMTP port (25) AWS Security Groups allow internet traffic from internet to DNS port (53) AWS Security Groups allow internet traffic from internet to Windows RPC port (135) AWS Security Groups allow internet traffic from internet to NetBIOS port (137) AWS Security Groups allow internet traffic from internet to NetBIOS port (138) AWS Security Groups allow internet traffic from internet to CIFS port (445) AWS Security Groups allow internet traffic from internet to SQLServer port (1433) AWS Security Groups allow internet traffic from internet to SQLServer port (1434) AWS Security Groups allow internet traffic from internet to MYSQL port (3306) AWS Security Groups allow internet traffic from internet to RDP port (3389) AWS Security Groups allow internet traffic from internet to MSQL port (4333) AWS Security Groups allow internet traffic from internet to PostgreSQL port (5432) AWS Security Groups allow internet traffic from internet to VNC Listener port (5500) AWS Security Groups allow internet traffic from internet to VNC Server port (5900)
Prisma Cloud Remediation - GCP Kubernetes Engine Misconfiguration v2	This playbook remediates Prisma Cloud GCP Kubernetes Engine alerts. It calls sub-playbooks that perform the actual remediation steps. Remediation: GCP Kubernetes Engine Clusters Basic Authentication is set to Enabled GCP Kubernetes Engine Clusters have HTTP load balancing disabled GCP Kubernetes Engine Clusters have Legacy Authorization enabled GCP Kubernetes Engine Clusters have Master authorized networks disabled GCP Kubernetes Engine Clusters have Network policy disabled GCP Kubernetes Engine Clusters have Stackdriver Logging disabled GCP Kubernetes Engine Clusters have Stackdriver Monitoring disabled GCP Kubernetes Engine Clusters have binary authorization disabled GCP Kubernetes Engine Clusters web UI/Dashboard is set to Enabled GCP Kubernetes cluster intra-node visibility disabled.
Prisma Cloud - Find GCP Resource by FQDN v2	Find GCP resources by FQDN using Prisma Cloud inventory. Supported services: Cloud DNS.
Prisma Cloud Remediation - Azure Storage Misconfiguration v2	This playbook remediates Prisma Cloud Azure Storage alerts. It calls sub-playbooks that perform the actual remediation steps. Remediation: Azure storage account has a blob container with public access Azure storage account logging for blobs is disabled Azure Storage Accounts without Secure transfer enabled Azure storage account logging for queues is disabled Azure storage account logging for tables is disabled
Prisma Cloud - Find GCP Resource by Public IP v2	Find GCP resources by Public IP using Prisma Cloud inventory. Supported services: GCE, Load Balancing, GKE.
Prisma Cloud Remediation - AWS IAM Policy Misconfiguration v2	This playbook remediates Prisma Cloud AWS IAM policy alerts. It uses sub-playbooks that perform the remediation steps.
Prisma Cloud Correlate Alerts	Deprecated. Use Prisma Cloud Correlate Alerts v2 instead. Search alerts in Prisma Cloud for a specific asset ID and, if present in XSOAR, link them.
Prisma Cloud Remediation - Azure Network Security Group Misconfiguration	This playbook remediates the following Prisma Cloud Azure Network security group alerts. Prisma Cloud policies remediated: Azure Network Security Group (NSG) having Inbound rule overly permissive to allow all traffic from any source on any protocol Azure Network Security Group (NSG) having Inbound rule overly permissive to allow all traffic from any source on TCP protocol Azure Network Security Group (NSG) having Inbound rule overly permissive to allow all traffic from any source on UDP protocol Azure Network Security Group (NSG) allows SSH traffic from internet on port 22 Azure Network Security Group (NSG) allows traffic from internet on port 3389 Azure Network Security Group allows DNS (TCP Port 53) Azure Network Security Group allows FTP (TCP Port 21) Azure Network Security Group allows FTP-Data (TCP Port 20) Azure Network Security Group allows MSQL (TCP Port 4333) Azure Network Security Group allows MySQL (TCP Port 3306) Azure Network Security Group allows Windows RPC (TCP Port 135) Azure Network Security Group allows Windows SMB (TCP Port 445) Azure Network Security Group allows PostgreSQL (TCP Port 5432) Azure Network Security Group allows SMTP (TCP Port 25) Azure Network Security Group allows SqlServer (TCP Port 1433) Azure Network Security Group allows Telnet (TCP Port 23) Azure Network Security Group allows VNC Listener (TCP Port 5500) Azure Network Security Group allows all traffic on ICMP (Ping) Azure Network Security Group allows CIFS (UDP Port 445) Azure Network Security Group allows NetBIOS (UDP Port 137) Azure Network Security Group allows NetBIOS (UDP Port 138) Azure Network Security Group allows SQLServer (UDP Port 1434) Azure Network Security Group allows DNS (UDP Port 53)
Prisma Cloud - Find Public Cloud Resource by Public IP v2	Find Public Cloud resource by Public IP using Prisma Cloud inventory
Prisma Cloud - Network API and Anomaly Alerts	This playbook handles alerts of internet exposed services and detect potential risky configurations that can make your cloud environment vulnerable to attacks, and alerts of unusual network and user activity for all users, and are especially critical for privileged users and assumed roles where detecting unusual activity may indicate the first steps in a potential misuse or account compromise.

Trigger

Name	Description
AWS CloudTrail Misconfiguration	This trigger is responsible for handling AWS CloudTrail Misconfiguration alerts
Prisma Cloud Network API and Anomaly alerts	This trigger is responsible for handling Prisma Cloud Network, API and Anomaly alerts
GCP Kubernetes Engine Misconfiguration	This trigger is responsible for handling GCP Kubernetes Engine Misconfiguration alerts
Azure SQL Misconfiguration	This trigger is responsible for handling Azure SQL Misconfiguration alerts
AWS IAM Policy Misconfiguration	This trigger is responsible for handling AWS IAM Policy Misconfiguration alerts
Azure Storage Misconfiguration	This trigger is responsible for handling Azure Storage Misconfiguration alerts
GCP Compute Engine Misconfiguration	This trigger is responsible for handling GCP Compute Engine Misconfiguration alerts
Azure Network Misconfiguration	This trigger is responsible for handling Azure Network Misconfiguration alerts
Prisma Cloud - VM Alert Prioritization	This trigger is responsible for handling Prisma Cloud - VM Alert Prioritization alerts
Azure AKS Misconfiguration	This trigger is responsible for handling Azure AKS Misconfiguration alerts
AWS EC2 Instance Misconfiguration	This trigger is responsible for handling AWS EC2 Instance Misconfiguration alerts

Required Content Packs (5)

Pack Name	Pack By
Base	By: Cortex XSOAR
Common Playbooks	By: Cortex XSOAR
Common Scripts	By: Cortex XSOAR
Common Types	By: Cortex XSOAR
Filters And Transformers	By: Cortex XSOAR

Optional Content Packs (15)

Pack Name	Pack By
AWS - CloudTrail	By: Cortex XSOAR
AWS - CloudWatchLogs	By: Cortex XSOAR
AWS - EC2	By: Cortex XSOAR
AWS - IAM	By: Cortex XSOAR
AWS - S3	By: Cortex XSOAR
Azure Kubernetes Services	By: Cortex XSOAR
Azure Network Security Groups	By: Cortex XSOAR
Azure SQL Management	By: Cortex XSOAR
Azure Storage Management	By: Cortex XSOAR
Google Cloud Compute	By: Cortex XSOAR
Google Kubernetes Engine	By: Cortex XSOAR
Atlassian Jira	By: Cortex XSOAR
Malware Core	By: Cortex XSOAR
Slack	By: Cortex XSOAR
Use Case Builder	By: Joe Cosgrove

All level dependencies (7)

Pack Name	Pack By
Common Scripts	By: Cortex XSOAR
Rasterize	By: Cortex XSOAR
Base	By: Cortex XSOAR
Common Playbooks	By: Cortex XSOAR
Filters And Transformers	By: Cortex XSOAR
Cortex REST API	By: Cortex XSOAR
Common Types	By: Cortex XSOAR

4.3.3 - 951066 (April 11, 2024)

Playbooks

New: Prisma Cloud - RQL Execution

New(Available on Cortex XSIAM): This playbook enables Prisma Cloud RQL Execution from the alert layout.

Triggers Recommendations

New: Prisma Cloud Network API and Anomaly alerts

Related pull requests:
- 33781

Download

4.3.2 - 936713 (April 5, 2024)

Integrations

Prisma Cloud v2

Fixed an issue where test button did not work properly on XSIAM.

Related pull requests:
- 33691

Download

4.3.1 - 925751 (April 1, 2024)

Integrations

Prisma Cloud v2

Fixed an issue where the test button failed on container timeout when server url is not reachable.
Updated the Docker image to: demisto/python3:3.10.14.91134.

Related pull requests:
- 33654

Download

4.3.0 - R921333 (March 28, 2024)

Integrations

Prisma Cloud v2

Marked as hybrid. Behavior is unchanged.
Updated the Docker image to: demisto/python3:3.10.13.88772.

Related pull requests:
- 33206

Download

4.2.24 - R828628 (February 14, 2024)

Integrations

Prisma Cloud v2

Fixed an issue where the following arguments were used in the prisma-cloud-event-search command, instead of the prisma-cloud-config-search command.

include_resource_json
include_additional_resource_fields

Related pull requests:
- 32724

Download

4.2.23 - 807749 (February 5, 2024)

Integrations

Prisma Cloud v2

Fixed an issue where the output of the prisma-cloud-config-search command wasn't optimized.
Breaking changes:In order to maintain reasonable response size, the output lacks the following 2 values values by default:
- data.items.data.disks.shieldedInstanceInitialState
- data.items.data.metadata.items.configure-sh
  You can now use the argument include_additional_resource_fields=true to include their values in the output.

Related pull requests:
- 32714

Download

4.2.22 - 806093 (February 5, 2024)

Integrations

Prisma Cloud v2

Added support for minimizing Prisma Cloud output size in the prisma-cloud-config-search command.
Updated the Docker image to: demisto/python3:3.10.13.86272.

Related pull requests:
- 32606

Download

4.2.21 - 798475 (February 1, 2024)

Integrations

PrismaCloud IAM

Updated the Docker image to: demisto/python3:3.10.13.86272.

Related pull requests:
- 32444

Download

4.2.20 - 786509 (January 26, 2024)

Integrations

Prisma Cloud v2

Added retries to the API calls in the fetch-incidents command.
Updated the Docker image to: demisto/python3:3.10.13.85667.

Related pull requests:
- 32433

Download

4.2.19 - 783533 (January 24, 2024)