Details
Content
Dependencies
Version History

Use the Prisma Cloud Compute integration to fetch incidents from your Prisma Cloud Compute environment.

Prisma Cloud Compute

This pack includes Cortex XSIAM content.

Overview

This integration lets you import Palo Alto Networks - Prisma Cloud Compute alerts into Cortex XSOAR.

Use Cases

Manage Prisma Cloud Compute alerts in Cortex XSOAR.
You can create new playbooks, or extend the default ones, to analyze alerts, assign tasks based on your analysis, and open tickets on other platforms.

Configure Prisma Cloud Compute

Configure Prisma Cloud Compute to send alerts to Cortex XSOAR by creating an alert profile.

Log in to your Prisma Cloud Compute console. On new Prisma Cloud versions, go to Runtime Security.
Navigate to Manage > Alerts.
Create a new alert profile by clicking Add Profile.
Provide a name, select Cortex from the provider list, and select XSOAR under Application.
Select the alert triggers. Alert triggers specify which alerts are sent to Cortex XSOAR.
Click Save to save the alert profile.

Configure Cortex XSOAR

Navigate to Settings > Integrations > Instances.
Search for Prisma Cloud Compute.
Click Add instance to create and configure a new integration.
- Name: Name for the integration.
- Fetches incidents: Configures this integration instance to fetch alerts from Prisma Cloud Compute.
- Prisma Cloud Compute Console URL: URL address of your Prisma Cloud Compute console. Copy the address from the alert profile created in Prisma Cloud Compute, or under Runtime Security copy the address from System > Utilities > Path to Console.
- Prisma Cloud Compute Project Name (if applies): If using projects in Prisma Cloud Compute, enter the project name here. Copy the project name from the alert profile created in Prisma Cloud Compute.
- Trust any certificate (not secure): Skips verification of the CA certificate (not recommended).
- Use system proxy settings: Uses the system's proxy settings.
- Credentials: Prisma Cloud Compute login credentials.
- Prisma Cloud Compute CA Certificate: CA Certificate used by Prisma Cloud Compute. Copy the certificate from the alert profile created in Prisma Cloud Compute.
Click Test to validate the integration.
Click Done to save the integration.

Using the integration and scripts

The integration ships with four default playbooks:

Prisma Cloud Compute - Audit Alert v3
Prisma Cloud Compute - Cloud Discovery Alert
Prisma Cloud Compute - Compliance Alert v2
Prisma Cloud Compute - Vulnerability Alert

Two of the above playbooks - Cloud Discovery Alert and Vulnerability Alert, contain a single script. The script in each playbook encodes the raw JSON alerts into Cortex XSOAR objects that can then be used in the playbooks. The scripts are:

PrismaCloudComputeParseVulnerabilityAlert
PrismaCloudComputeParseCloudDiscoveryAlert

To better understand how playbooks and scripts interoperate, consider the Prisma Cloud Compute - Vulnerability Alert playbook.

When the playbook is triggered, a task called Parse Vulnerability Alert runs.
The task runs the PrismaCloudComputeParseVulnerabilityAlert script, which takes the prismacloudcomputerawalertjson field of the incident (the raw JSON alert data) as input.

Click outputs to see how the script transformed the raw JSON input into a Cortex XSOAR object.

At this point, you can add tasks that extend the playbook to check and respond to alerts depending on the properties of the Cortex XSOAR object.

Audit Alert v3 playbook

This is a default playbook for parsing and enrichment of Prisma Cloud Compute audit alerts.

The playbook has the following sections:

Enrichment:

Image details
Similar container events
Owner details
Vulnerabilities
Compliance details
Forensics
Defender logs

Remediation:

Block Indicators - Generic v3
Cloud Response - Generic
Manual Remediation

Currently, the playbook supports incidents created by Runtime and WAAS triggers.

Compliance Alert v2

This is a default playbook for parsing and enrichment of Prisma Cloud Compute compliance alerts.
It will handle hosts, images and container compliance alerts.
Each sub playbook in this playbook is dedicated to a specific resource type: host, container or image, and will loop through all of the retrieved Compliance Issue IDs in order to retrieve enriched information about each of the resources.
The enriched information will be displayed in the layout under dedicated tabs and includes resources information like hostnames, container ID, image ID, cloud provider info, enriched compliance issue details and more.

In addition, the playbook can create and update external ticketing systems for each compliance issue automatically with the relevant enriched information. In order to do so, fill the relevant playbook inputs

Troubleshooting

If any alerts are missing in Cortex XSOAR, check the status of the integration:

### Pack Contributors:

Eric Partington

Contributions are welcome and appreciated. For more info, visit our Contribution Guide.

Prisma Cloud Compute

This pack includes Cortex XSIAM content.

Overview

This integration lets you import Palo Alto Networks - Prisma Cloud Compute alerts into Cortex XSIAM.

Use Cases

Manage Prisma Cloud Compute alerts in Cortex XSIAM.
You can create new playbooks, or extend the default ones, to analyze alerts, assign tasks based on your analysis, and open tickets on other platforms.

Configure Prisma Cloud Compute

Configure Prisma Cloud Compute to send alerts to Cortex XSIAM by creating an alert profile.

Log in to your Prisma Cloud Compute console. On new Prisma Cloud versions, go to Runtime Security.
Navigate to Manage > Alerts.
Create a new alert profile by clicking Add Profile.
Provide a name, select Cortex from the provider list, and select XSOAR under Application.
Select the alert triggers. Alert triggers specify which alerts are sent to Cortex XSIAM.
Click Save to save the alert profile.

Configure Cortex XSIAM

Navigate to Settings > Integrations > Instances.
Search for Prisma Cloud Compute.
Click Add instance to create and configure a new integration.
- Name: Name for the integration.
- Fetches incidents: Configures this integration instance to fetch alerts from Prisma Cloud Compute.
- Prisma Cloud Compute Console URL: URL address of your Prisma Cloud Compute console. Copy the address from the alert profile created in Prisma Cloud Compute, or under Runtime Security copy the address from System > Utilities > Path to Console.
- Prisma Cloud Compute Project Name (if applies): If using projects in Prisma Cloud Compute, enter the project name here. Copy the project name from the alert profile created in Prisma Cloud Compute.
- Trust any certificate (not secure): Skips verification of the CA certificate (not recommended).
- Use system proxy settings: Uses the system's proxy settings.
- Credentials: Prisma Cloud Compute login credentials.
- Prisma Cloud Compute CA Certificate: CA Certificate used by Prisma Cloud Compute. Copy the certificate from the alert profile created in Prisma Cloud Compute.
Click Test to validate the integration.
Click Done to save the integration.

Using the integration and scripts

The integration ships with four default playbooks:

Prisma Cloud Compute - Audit Alert v3
Prisma Cloud Compute - Cloud Discovery Alert
Prisma Cloud Compute - Compliance Alert v2
Prisma Cloud Compute - Vulnerability Alert

Two of the above playbooks - Cloud Discovery Alert and Vulnerability Alert, contain a single script. The script in each playbook encodes the raw JSON alerts into Cortex XSIAM objects that can then be used in the playbooks. The scripts are:

PrismaCloudComputeParseVulnerabilityAlert
PrismaCloudComputeParseCloudDiscoveryAlert

To better understand how playbooks and scripts interoperate, consider the Prisma Cloud Compute - Vulnerability Alert playbook.

When the playbook is triggered, a task called Parse Vulnerability Alert runs.
The task runs the PrismaCloudComputeParseVulnerabilityAlert script, which takes the prismacloudcomputerawalertjson field of the incident (the raw JSON alert data) as input.

Click outputs to see how the script transformed the raw JSON input into a Cortex XSIAM object.

At this point, you can add tasks that extend the playbook to check and respond to alerts depending on the properties of the Cortex XSIAM object.

Audit Alert v3 playbook

This is a default playbook for parsing and enrichment of Prisma Cloud Compute audit alerts.

The playbook has the following sections:

Enrichment:

Image details
Similar container events
Owner details
Vulnerabilities
Compliance details
Forensics
Defender logs

Remediation:

Block Indicators - Generic v3
Cloud Response - Generic
Manual Remediation

Currently, the playbook supports incidents created by Runtime and WAAS triggers.

Compliance Alert v2

This is a default playbook for parsing and enrichment of Prisma Cloud Compute compliance alerts.

It will handle hosts, images and container compliance alerts.
Each sub playbook in this playbook is dedicated to a specific resource type: host, container or image, and will loop through all of the retrieved Compliance Issue IDs in order to retrieve enriched information about each of the resources.
The enriched information will be displayed in the layout under dedicated tabs and includes resources information like hostnames, container ID, image ID, cloud provider info, enriched compliance issue details and more.

Troubleshooting

If any alerts are missing in Cortex XSIAM, check the status of the integration:

Pack Contributors:

Eric Partington

Contributions are welcome and appreciated. For more info, visit our Contribution Guide.

Automations

Name	Description
CreatePrismaCloudComputeLink	This script creates a link back to the Prisma Cloud Compute instance.
CreatePrismaCloudComputeResourceComplianceReportButton	Generate a compliance report for Prisma Cloud resources - host, container or image.
PrismaCloudRemoteTrustedImagesListUpdate	Gets the existing "Trusted Images" results from Prisma Cloud Compute and updates the relevant trust group with the images stored in the given internal list.
PCComputeImageComplianceIssuesButton	This script runs the "prisma-cloud-compute-images-scan-list" command for a specific container ID and returns details about its compliance issues, if found. If any compliance issues found, it will create a new tab in the layout called "Detailed Compliance Issues" showing the issues details. Returns the following fields for each compliance ID: Compliance ID Cause Severity Title Description.
PrismaCloudComputeParseAuditAlert	Parse Audit alert raw JSON data
CreatePrismaCloudComputeComplianceReportButton	Generate a compliance report via button.
PCComputeHostComplianceIssuesButton	This script runs the "prisma-cloud-compute-hosts-scan-list" command for a specific hostname and returns details about its compliance issues, if found. If any compliance issues found, it will create a new tab in the layout called "Detailed Compliance Issues" showing the issues details. Returns the following fields for each compliance ID: Compliance ID Cause Severity Title Description.
PrismaCloudComputeParseComplianceAlert	Parse Compliance alert raw JSON data.
PrismaCloudComputeParseCloudDiscoveryAlert	Parse Cloud Discovery alert raw JSON data.
PCComputeContainerComplianceIssuesButton	This script runs the "prisma-cloud-compute-container-scan-results-list" command for a specific container ID and returns details about its compliance issues, if found. If any compliance issues found, it will create a new tab in the layout called "Detailed Compliance Issues" showing the issues details. Returns the following fields for each compliance ID: Compliance ID Cause Severity Title Description.
PrismaCloudComputeParseVulnerabilityAlert	Parse Vulnerability alert raw JSON data.
PrismaCloudLocalTrustedImagesListUpdate	Takes the results of "prisma-cloud-compute-images-scan-list" and "prisma-cloud-ci-scan-results-list" commands and creates or updates a list of trusted images which can be used for updating the "Trusted Images" list in Prisma Cloud, using the PrismaCloudRemoteTrustedImagesListUpdate automation.
TagIndicatorButton	This is a wrapper around the setIndicators script.
PrismaCloudComputeComplianceTable	Iterate over EnrichedComplianceIssue information in the context data and add the important keys to a table under PrismaCloudCompute.ComplianceTable or a provided grid id.

Classifiers

Name	Description
Palo Alto Networks Prisma Cloud Compute - Classifier	Classifies Palo Alto Networks Prisma Cloud Compute events.
Palo Alto Networks Prisma Cloud Compute - Incoming Mapper	Maps incoming Palo Alto Networks Prisma Cloud Compute event fields.

Incident Fields

Name	Description
Prisma Cloud Compute Defender Logs
Prisma Cloud Compute User
Prisma Cloud Compute Command
Prisma Cloud Compute Total
Prisma Cloud Compute Project
Prisma Cloud Compute Audit Table
Prisma Cloud Compute Region
Prisma Cloud Compute Rule
Prisma Cloud Compute Interactive
Prisma Cloud Compute Cluster
Prisma Cloud Compute Provider
Prisma Cloud Compute Distribution
Prisma Cloud Compute Log File
Prisma Cloud Compute Kubernetes Resource
Prisma Cloud Compute Activity Type
Prisma Cloud Compute PCC Defender Logs
Prisma Cloud Compute Registry
Prisma Cloud Compute Image Compliance Issues
Prisma Cloud Compute Service
Prisma Cloud Compute Container
Prisma Cloud Compute Function
Prisma Cloud Compute Container Compliance Issues
Prisma Cloud Compute Credential ID
Prisma Cloud Compute Host Compliance Issues
Prisma Cloud Compute Forensic
Prisma Cloud Compute Runtime
Prisma Cloud Compute Markdown
Prisma Cloud Compute Image
Prisma Cloud Compute AppID
Prisma Cloud Compute Service Type
Prisma Cloud Compute Show Compliance Tab
Prisma Cloud Compute Labels
Prisma Cloud Compute Category
Prisma Cloud Compute Line
Prisma Cloud Compute Tickets Info	A table to hold all tickets information related to Prisma Cloud Compute that were opened or updated by XSOAR.
Prisma Cloud Compute Collections
Prisma Cloud Compute Namespaces	The namespaces associated to the resource.
Prisma Cloud Compute Host
Prisma Cloud Compute Type
Prisma Cloud Compute Protected
Prisma Cloud Compute FQDN
Prisma Cloud Compute Message
Prisma Cloud Compute Error
Prisma Cloud Compute Raw Alert JSON

Incident Types

Name	Description
Prisma Cloud Compute Vulnerability
Prisma Cloud Compute Compliance v2
Prisma Cloud Compute Cloud Discovery
Prisma Cloud Compute Audit v3
Prisma Cloud Compute Audit v2
Prisma Cloud Compute Compliance
Prisma Cloud Compute Audit

Integrations

Name	Description
Palo Alto Networks - Prisma Cloud Compute	Use the Prisma Cloud Compute integration to fetch incidents from your Prisma Cloud Compute environment.

Layouts

Name	Description
Prisma Cloud Compute Compliance Incident v2
Prisma Cloud Compute Audit Layout v2
Prisma Cloud Compute Compliance Incident
Prisma Cloud Compute Cloud Discovery Incident
Prisma Cloud Compute Audit Layout v3
Prisma Cloud Compute Vulnerability Incident
Prisma Cloud Compute Audit

Playbooks

Name	Description
Prisma Cloud Compute - Compliance Alert Host Enrichment Loop	This is a sub-playbook of the "Prisma Cloud Compute - Compliance Alert v2" playbook. It will loop through all of the given compliance issue IDs and will retrieve the following information for each affected host based on the compliance issue ID: Hostname Compliance Issues Compliance Distribution Cloud MetaData The enriched information will be displayed in the layout in a dedicated table under the "Host Compliance Information" tab.
Prisma Cloud Compute - Audit Alert v3	Default playbook for parsing and enrichment of Prisma Cloud Compute audit alerts. The playbook has the following sections: Enrichment: Image details Similar container events Owner details Vulnerabilities Compliance details Forensics Defender logs. Remediation: Block Indicators - Generic v3 Cloud Response - Generic Manual Remediation. Currently, the playbook supports incidents created by Runtime and WAAS triggers.
Prisma Cloud Compute - Vulnerability Alert	Default playbook for parsing Prisma Cloud Compute vulnerability alerts
Prisma Cloud Compute - Audit Alert v2	Deprecated. Use "Prisma Cloud Compute - Audit Alert v3" instead. Default playbook for parsing and enrichment of Prisma Cloud Compute audit alerts.
Prisma Cloud Compute - ServiceNow Ticket (HTML Table)	This playbook is a sub-playbook of the "Prisma Cloud Compute - ServiceNow Compliance Ticket" playbook. It creates a new ServiceNow ticket or updates an existing ServiceNow ticket with an HTML table for the given compliance ID retrieved from the parent playbook, with enriched data for each resource (host, image or container).
Prisma Cloud Compute - Compliance Alert Image Enrichment Loop	This is a sub-playbook of the "Prisma Cloud Compute - Compliance Alert v2" playbook. It will loop through all of the given compliance issue IDs and will retrieve the following information for each affected image based on the compliance issue ID: Image ID Compliance Issues Compliance Distribution Hosts Image Instances Cloud MetaData The enriched information will be displayed in the layout in a dedicated table under the "Image Compliance Information" tab.
Prisma Cloud Compute - Jira Compliance Issue	This playbook is a sub-playbook of the "Prisma Cloud Compute - Compliance Alert Host Enrichment Loop" playbook. It creates a new Jira issue or updates an existing Jira issue for each compliance ID retrieved in the original Prisma Cloud compliance alert, with enriched data for each resource (host, image or container).
Prisma Cloud Compute - Audit Alert Enrichment	This is a sub-playbook of the "Prisma Cloud Compute - Audit Alert v2" playbook. It does the following: Runs the "Prisma Cloud - Get Account Owner" playbook in order to retrieve potential owners for the alert. Sets the incident link to the layout. Pulls image details and alerts Pulls host scan results.
Prisma Cloud Compute - Compliance Alert v2	Playbook for enriching Prisma Cloud Compute compliance alerts. It will handle hosts, images and container compliance alerts. Each sub-playbook in this playbook is dedicated to a specific resource type: host, container or image, and will loop through all of the retrieved Compliance Issue IDs in order to retrieve enriched information about each of the resources. The enriched information will be displayed in the layout under dedicated tabs and includes resources information like hostnames, container ID, image ID, cloud provider info, enriched compliance issue details and more. In addition, the playbook can create and update external ticketing systems for each compliance issue automatically with the relevant enriched information. In order to do so, fill the relevant playbook inputs.
Prisma Cloud Compute - Audit Alert	Deprecated. Use "Prisma Cloud Compute - Audit Alert v3" instead. Default playbook for parsing Prisma Cloud Compute audit alerts
Prisma Cloud Compute - ServiceNow Ticket (XLSX)	This playbook is a sub-playbook of the "Prisma Cloud Compute - ServiceNow Compliance Ticket" playbook. It creates a new ServiceNow ticket or updates an existing ServiceNow ticket with an XLSX file for the given compliance ID retrieved from the parent playbook, with enriched data for each resource (host, image or container).
Prisma Cloud Compute - Audit Alert Vulnerabilities Enrichment	This is a sub-playbook of the "Prisma Cloud Compute - Audit Alert v2" playbook. It creates CVE indicators based on image or host vulnerabilities.
Prisma Cloud Compute - Compliance Alert	Deprecated. Use Prisma Cloud Compute - Compliance Alert v2 instead.
Prisma Cloud Compute - Container Forensics	This is a sub-playbook of the "Prisma Cloud Compute - Audit Alert v2" playbook. Gets the container profile and forensics.
Prisma Cloud Compute - Compliance Alert Container Enrichment Loop	This is a sub-playbook of the "Prisma Cloud Compute - Compliance Alert v2" playbook. It will loop through all of the given compliance issue IDs and will retrieve the following information for each affected container based on the compliance issue ID: Container ID Compliance Issues Compliance Distribution Hostname Image Name Cloud MetaData The enriched information will be displayed in the layout in a dedicated table under the "Container Compliance Information" tab.
Prisma Cloud Compute - Jira Ticket (Markdown Table)	This playbook is a sub-playbook of the "Prisma Cloud Compute - Jira Compliance Issue" playbook. It creates a new Jira issue or updates an existing Jira issue with a markdown table for the given compliance ID retrieved from the parent playbook, with enriched data for each resource (host, image or container).
Prisma Cloud Compute - Cloud Discovery Alert	Default playbook for parsing Prisma Cloud Compute Cloud Discovery alerts
Prisma Cloud Compute - Get Defender Logs	This is a sub-playbook of the “Prisma Cloud Compute - Audit Alert v2” playbook. Gets defender logs and sets them to layout Downloads defender logs Gets defender backups
Prisma Cloud Compute - Get Container Events	This is a sub-playbook of the "Prisma Cloud Compute - Audit Alert v2" playbook. Get container runtime or WAAS events and set it in the layout.
Prisma Cloud Compute - Audit Alert Compliance Enrichment	This is a sub-playbook of the "Prisma Cloud Compute - Audit Alert v2" playbook. Retrieves the following information: Alert profiles. Container WAAS policies. Image compliance issues.
Prisma Cloud Compute - Jira Ticket (XLSX)	This playbook is a sub-playbook of the "Prisma Cloud Compute - Jira Compliance Issue" playbook. It creates a new Jira issue or updates an existing Jira issue with an XLSX file for the given compliance ID retrieved from the parent playbook, with enriched data for each resource (host, image or container).
Prisma Cloud Compute - ServiceNow Compliance Ticket	This playbook is a sub-playbook of the "Prisma Cloud Compute - Compliance Alert Host Enrichment Loop" playbook. It creates a new ServiceNow ticket or updates an existing ServiceNow ticket for each compliance ID retrieved in the original Prisma Cloud compliance alert, with enriched data for each resource (host, image or container).

Wizards

Name	Description
Prisma Cloud Compute Compliance Use Case	Welcome to the Deployment Wizard! These steps will guide you through configuring your content pack so you'll have a working use case when the wizard finishes. Make sure to follow the steps in order, you can always continue the wizard where you left off. Learn more about this pack’s deployment in the "Cortex XSOAR Administrator Guide" -> "Set up Your Use Case with the Deployment Wizard".

Automations

Name	Description
PCComputeContainerComplianceIssuesButton	This script runs the "prisma-cloud-compute-container-scan-results-list" command for a specific container ID and returns details about its compliance issues, if found. If any compliance issues found, it will create a new tab in the layout called "Detailed Compliance Issues" showing the issues details. Returns the following fields for each compliance ID: Compliance ID Cause Severity Title Description.
PrismaCloudComputeParseCloudDiscoveryAlert	Parse Cloud Discovery alert raw JSON data.
PCComputeHostComplianceIssuesButton	This script runs the "prisma-cloud-compute-hosts-scan-list" command for a specific hostname and returns details about its compliance issues, if found. If any compliance issues found, it will create a new tab in the layout called "Detailed Compliance Issues" showing the issues details. Returns the following fields for each compliance ID: Compliance ID Cause Severity Title Description.
TagIndicatorButton	This is a wrapper around the setIndicators script.
PCComputeImageComplianceIssuesButton	This script runs the "prisma-cloud-compute-images-scan-list" command for a specific container ID and returns details about its compliance issues, if found. If any compliance issues found, it will create a new tab in the layout called "Detailed Compliance Issues" showing the issues details. Returns the following fields for each compliance ID: Compliance ID Cause Severity Title Description.
CreatePrismaCloudComputeComplianceReportButton	Generate a compliance report via button.
PrismaCloudLocalTrustedImagesListUpdate	Takes the results of "prisma-cloud-compute-images-scan-list" and "prisma-cloud-ci-scan-results-list" commands and creates or updates a list of trusted images which can be used for updating the "Trusted Images" list in Prisma Cloud, using the PrismaCloudRemoteTrustedImagesListUpdate automation.
PrismaCloudComputeParseVulnerabilityAlert	Parse Vulnerability alert raw JSON data.
CreatePrismaCloudComputeResourceComplianceReportButton	Generate a compliance report for Prisma Cloud resources - host, container or image.
PrismaCloudComputeParseAuditAlert	Parse Audit alert raw JSON data
PrismaCloudComputeParseComplianceAlert	Parse Compliance alert raw JSON data.
PrismaCloudComputeComplianceTable	Iterate over EnrichedComplianceIssue information in the context data and add the important keys to a table under PrismaCloudCompute.ComplianceTable or a provided grid id.
PrismaCloudRemoteTrustedImagesListUpdate	Gets the existing "Trusted Images" results from Prisma Cloud Compute and updates the relevant trust group with the images stored in the given internal list.
CreatePrismaCloudComputeLink	This script creates a link back to the Prisma Cloud Compute instance.

Classifiers

Name	Description
Palo Alto Networks Prisma Cloud Compute - Classifier	Classifies Palo Alto Networks Prisma Cloud Compute events.
Palo Alto Networks Prisma Cloud Compute - Incoming Mapper	Maps incoming Palo Alto Networks Prisma Cloud Compute event fields.

Incident Fields

Name	Description
Prisma Cloud Compute Command
Prisma Cloud Compute Service Type
Prisma Cloud Compute Message
Prisma Cloud Compute Runtime
Prisma Cloud Compute Interactive
Prisma Cloud Compute Distribution
Prisma Cloud Compute Registry
Prisma Cloud Compute Container Compliance Issues
Prisma Cloud Compute Type
Prisma Cloud Compute Service
Prisma Cloud Compute Show Compliance Tab
Prisma Cloud Compute Activity Type
Prisma Cloud Compute Image Compliance Issues
Prisma Cloud Compute Rule
Prisma Cloud Compute Forensic
Prisma Cloud Compute Line
Prisma Cloud Compute Provider
Prisma Cloud Compute Collections
Prisma Cloud Compute Log File
Prisma Cloud Compute Host Compliance Issues
Prisma Cloud Compute Defender Logs
Prisma Cloud Compute Region
Prisma Cloud Compute Tickets Info	A table to hold all tickets information related to Prisma Cloud Compute that were opened or updated by XSOAR.
Prisma Cloud Compute Credential ID
Prisma Cloud Compute Error
Prisma Cloud Compute Labels
Prisma Cloud Compute Protected
Prisma Cloud Compute Audit Table
Prisma Cloud Compute Raw Alert JSON
Prisma Cloud Compute Function
Prisma Cloud Compute Total
Prisma Cloud Compute Markdown
Prisma Cloud Compute PCC Defender Logs
Prisma Cloud Compute Namespaces	The namespaces associated to the resource.
Prisma Cloud Compute Kubernetes Resource

Incident Types

Name	Description
Prisma Cloud Compute Compliance
Prisma Cloud Compute Audit v3
Prisma Cloud Compute Vulnerability
Prisma Cloud Compute Compliance v2
Prisma Cloud Compute Audit
Prisma Cloud Compute Cloud Discovery
Prisma Cloud Compute Audit v2

Integrations

Name	Description
Palo Alto Networks - Prisma Cloud Compute	Use the Prisma Cloud Compute integration to fetch incidents from your Prisma Cloud Compute environment.

Layoutrule

Name	Description
Prisma Cloud Compute - Audit Alert v3 Layout Rule	Layout for Prisma Cloud Compute - Audit Alert v3 incidents.
Prisma Cloud Compute - Compliance Alert v2 Layout Rule	Layout for Prisma Cloud Compute - Compliance Alert v2 incidents.

Layouts

Name	Description
Prisma Cloud Compute Compliance Incident v2
Prisma Cloud Compute Audit Layout v3

Modeling Rules

Name	Description
Prisma Cloud Compute Modeling Rule

Parsing Rules

Name	Description
Prisma Cloud Compute Parsing Rule

Playbooks

Name	Description
Prisma Cloud Compute - Compliance Alert Host Enrichment Loop	This is a sub playbook of the "Prisma Cloud Compute - Compliance Alert v2" playbook. It will loop through all of the given compliance issue IDs and will retrieve the following information for each affected host based on the compliance issue ID: Hostname Compliance Issues Compliance Distribution Cloud MetaData The enriched information will be displayed in the layout in a dedicated table under the "Host Compliance Information" tab.
Prisma Cloud Compute - Compliance Alert Image Enrichment Loop	This is a sub playbook of the "Prisma Cloud Compute - Compliance Alert v2" playbook. It will loop through all of the given compliance issue IDs and will retrieve the following information for each affected image based on the compliance issue ID: Image ID Compliance Issues Compliance Distribution Hosts Image Instances Cloud MetaData The enriched information will be displayed in the layout in a dedicated table under the "Image Compliance Information" tab.
Prisma Cloud Compute - ServiceNow Ticket (XLSX)	This playbook is a sub-playbook of the "Prisma Cloud Compute - ServiceNow Compliance Ticket" playbook. It creates a new ServiceNow ticket or updates an existing ServiceNow ticket with an XLSX file for the given compliance ID retrieved from the parent playbook, with enriched data for each resource (host, image or container).
Prisma Cloud Compute - Jira Compliance Issue	This playbook is a sub-playbook of the "Prisma Cloud Compute - Compliance Alert Host Enrichment Loop" playbook. It creates a new Jira issue or updates an existing Jira issue for each compliance ID retrieved in the original Prisma Cloud compliance alert, with enriched data for each resource (host, image or container).
Prisma Cloud Compute - Jira Ticket (Markdown Table)	This playbook is a sub-playbook of the "Prisma Cloud Compute - Jira Compliance Issue" playbook. It creates a new Jira issue or updates an existing Jira issue with a markdown table for the given compliance ID retrieved from the parent playbook, with enriched data for each resource (host, image or container).
Prisma Cloud Compute - Vulnerability Alert	Default playbook for parsing Prisma Cloud Compute vulnerability alerts
Prisma Cloud Compute - Audit Alert	Deprecated. Use "Prisma Cloud Compute - Audit Alert v3" instead. Default playbook for parsing Prisma Cloud Compute audit alerts
Prisma Cloud Compute - Audit Alert Enrichment	This is a sub-playbook of the "Prisma Cloud Compute - Audit Alert v2" playbook. It does the following: Runs the "Prisma Cloud - Get Account Owner" playbook in order to retrieve potential owners for the alert. Sets the alert link to the layout. Pulls image details and alerts Pulls host scan results.
Prisma Cloud Compute - Jira Ticket (XLSX)	This playbook is a sub-playbook of the "Prisma Cloud Compute - Jira Compliance Issue" playbook. It creates a new Jira issue or updates an existing Jira issue with an XLSX file for the given compliance ID retrieved from the parent playbook, with enriched data for each resource (host, image or container).
Prisma Cloud Compute - Audit Alert v3	Default playbook for parsing and enrichment of Prisma Cloud Compute audit alerts. The playbook has the following sections: Enrichment: Image details Similar container events Owner details Vulnerabilities Compliance details Forensics Defender logs. Remediation: Block Indicators - Generic v3 Cloud Response - Generic Manual Remediation. Currently, the playbook supports alerts created by Runtime and WAAS triggers.
Prisma Cloud Compute - ServiceNow Compliance Ticket	This playbook is a sub-playbook of the "Prisma Cloud Compute - Compliance Alert Host Enrichment Loop" playbook. It creates a new ServiceNow ticket or updates an existing ServiceNow ticket for each compliance ID retrieved in the original Prisma Cloud compliance alert, with enriched data for each resource (host, image or container).
Prisma Cloud Compute - Compliance Alert	Deprecated. Use Prisma Cloud Compute - Compliance Alert v2 instead.
Prisma Cloud Compute - Compliance Alert v2	Playbook for enriching Prisma Cloud Compute compliance alerts. It will handle hosts, images and container compliance alerts. Each sub-playbook in this playbook is dedicated to a specific resource type: host, container or image, and will loop through all of the retrieved Compliance Issue IDs in order to retrieve enriched information about each of the resources. The enriched information will be displayed in the layout under dedicated tabs and includes resources information like hostnames, container ID, image ID, cloud provider info, enriched compliance issue details and more. In addition, the playbook can create and update external ticketing systems for each compliance issue automatically with the relevant enriched information. In order to do so, fill the relevant playbook inputs.
Prisma Cloud Compute - Compliance Alert Container Enrichment Loop	This is a sub playbook of the "Prisma Cloud Compute - Compliance Alert v2" playbook. It will loop through all of the given compliance issue IDs and will retrieve the following information for each affected container based on the compliance issue ID: Container ID Compliance Issues Compliance Distribution Hostname Image Name Cloud MetaData The enriched information will be displayed in the layout in a dedicated table under the "Container Compliance Information" tab.
Prisma Cloud Compute - Audit Alert Compliance Enrichment	This is a sub-playbook of the "Prisma Cloud Compute - Audit Alert v2" playbook. Retrieves the following information: Alert profiles. Container WAAS policies. Image compliance issues.
Prisma Cloud Compute - Audit Alert Vulnerabilities Enrichment	This is a sub-playbook of the "Prisma Cloud Compute - Audit Alert v2" playbook. It creates CVE indicators based on image or host vulnerabilities.
Prisma Cloud Compute - Get Defender Logs	This is a sub-playbook of the “Prisma Cloud Compute - Audit Alert v2” playbook. Gets defender logs and sets them to layout Downloads defender logs Gets defender backups
Prisma Cloud Compute - Container Forensics	This is a sub-playbook of the "Prisma Cloud Compute - Audit Alert v2" playbook. Gets the container profile and forensics.
Prisma Cloud Compute - Get Container Events	This is a sub-playbook of the "Prisma Cloud Compute - Audit Alert v2" playbook. Get container runtime or WAAS events and set it in the layout.
Prisma Cloud Compute - ServiceNow Ticket (HTML Table)	This playbook is a sub-playbook of the "Prisma Cloud Compute - ServiceNow Compliance Ticket" playbook. It creates a new ServiceNow ticket or updates an existing ServiceNow ticket with an HTML table for the given compliance ID retrieved from the parent playbook, with enriched data for each resource (host, image or container).
Prisma Cloud Compute - Audit Alert v2	Deprecated. Use "Prisma Cloud Compute - Audit Alert v3" instead. Default playbook for parsing and enrichment of Prisma Cloud Compute audit alerts.
Prisma Cloud Compute - Cloud Discovery Alert	Default playbook for parsing Prisma Cloud Compute Cloud Discovery alerts

Trigger

Name	Description
Prisma Cloud Compute - Compliance Alert v2 Trigger	This trigger is responsible for running the Prisma Cloud Compute - Compliance Alert v2 playbook on compliance alerts.
Prisma Cloud Compute - Audit Alert v3 Trigger	This trigger is responsible for running the Prisma Cloud Compute - Audit Alert v3 playbook on audit alerts.

Required Content Packs (6)

Pack Name	Pack By
Base	By: Cortex XSOAR
Common Scripts	By: Cortex XSOAR
Filters And Transformers	By: Cortex XSOAR
Atlassian Jira	By: Cortex XSOAR
Prisma Cloud by Palo Alto Networks	By: Cortex XSOAR
ServiceNow	By: Cortex XSOAR

Optional Content Packs (2)

Pack Name	Pack By
Common Playbooks	By: Cortex XSOAR
Common Types	By: Cortex XSOAR

All level dependencies (8)

Pack Name	Pack By
Filters And Transformers	By: Cortex XSOAR
Atlassian Jira	By: Cortex XSOAR
Base	By: Cortex XSOAR
Common Scripts	By: Cortex XSOAR
Prisma Cloud by Palo Alto Networks	By: Cortex XSOAR
Cortex REST API	By: Cortex XSOAR
Rasterize	By: Cortex XSOAR
ServiceNow	By: Cortex XSOAR

1.7.8 - 1738579 (December 2, 2024)

Scripts

PrismaCloudComputeComplianceTable

Updated the Docker image to: demisto/pandas:1.0.0.117209.

Related pull requests:
- 37425
- 37421
- 37419
- 37422
- 37418
- 37420

Download

1.7.7 - R1709192 (November 26, 2024)

Integrations

Palo Alto Networks - Prisma Cloud Compute

Updated the Docker image to: demisto/python3:3.11.10.115186.

Scripts

PrismaCloudComputeParseComplianceAlert

Updated the Docker image to: demisto/python3:3.11.10.115186.

PCComputeContainerComplianceIssuesButton

Updated the Docker image to: demisto/python3:3.11.10.115186.

CreatePrismaCloudComputeResourceComplianceReportButton

Updated the Docker image to: demisto/python3:3.11.10.115186.

PrismaCloudComputeParseAuditAlert

Updated the Docker image to: demisto/python3:3.11.10.115186.

PCComputeImageComplianceIssuesButton

Updated the Docker image to: demisto/python3:3.11.10.115186.

PCComputeHostComplianceIssuesButton

Updated the Docker image to: demisto/python3:3.11.10.115186.

PrismaCloudComputeParseCloudDiscoveryAlert

Updated the Docker image to: demisto/python3:3.11.10.115186.

PrismaCloudRemoteTrustedImagesListUpdate

Updated the Docker image to: demisto/python3:3.11.10.115186.

PrismaCloudLocalTrustedImagesListUpdate

Updated the Docker image to: demisto/python3:3.11.10.115186.

PrismaCloudComputeParseVulnerabilityAlert

Updated the Docker image to: demisto/python3:3.11.10.115186.

Related pull requests:
- 37147
- 37137
- 37136
- 37140
- 37138
- 37139

Download

1.7.6 - 1602991 (November 6, 2024)

Scripts

PrismaCloudComputeParseAuditAlert

Updated the Docker image to: demisto/python3:3.11.10.113941.

PCComputeHostComplianceIssuesButton

Updated the Docker image to: demisto/python3:3.11.10.113941.

PrismaCloudComputeParseVulnerabilityAlert

Updated the Docker image to: demisto/python3:3.11.10.113941.

CreatePrismaCloudComputeResourceComplianceReportButton

Updated the Docker image to: demisto/python3:3.11.10.113941.

PCComputeContainerComplianceIssuesButton

Updated the Docker image to: demisto/python3:3.11.10.113941.

PCComputeImageComplianceIssuesButton

Updated the Docker image to: demisto/python3:3.11.10.113941.

PrismaCloudRemoteTrustedImagesListUpdate

Updated the Docker image to: demisto/python3:3.11.10.113941.

CreatePrismaCloudComputeLink

Updated the Docker image to: demisto/python3:3.11.10.113941.

PrismaCloudComputeParseComplianceAlert

Updated the Docker image to: demisto/python3:3.11.10.113941.

CreatePrismaCloudComputeComplianceReportButton

Updated the Docker image to: demisto/python3:3.11.10.113941.

PrismaCloudLocalTrustedImagesListUpdate

Updated the Docker image to: demisto/python3:3.11.10.113941.

PrismaCloudComputeParseCloudDiscoveryAlert

Updated the Docker image to: demisto/python3:3.11.10.113941.

TagIndicatorButton

Updated the Docker image to: demisto/python3:3.11.10.113941.

Related pull requests:
- 37006
- 36995
- 36994
- 36998
- 36993
- 36992
- 36997

Download

1.7.5 - 1597102 (November 5, 2024)

Integrations

Palo Alto Networks - Prisma Cloud Compute

Added new command prisma-cloud-compute-custom-feeds-ip-remove
Updated the Docker image to: demisto/python3:3.11.10.113941.

Related pull requests:
- 37032

Download

1.7.4 - 1370357 (September 11, 2024)

Layouts

Prisma Cloud Compute Compliance Incident v2
Updated layout with canvas tab.
Prisma Cloud Compute Audit Layout v3
Updated layout with canvas tab.

Related pull requests:
- 36021

Download

1.7.3 - R1324639 (August 29, 2024)

Wizards

New: Prisma Cloud Compute Compliance Use Case

Added a new deployment wizard for setting up Prisma Cloud Compute Compliance use case

Related pull requests:
- 35296

Download

1.7.2 - 1149551 (July 4, 2024)

Integrations

Palo Alto Networks - Prisma Cloud Compute

Updated the integration image to align to common image for Prisma Cloud.

Related pull requests:
- 35112
- 35225

Download

1.7.1 - 1099854 (June 17, 2024)

Integrations

Palo Alto Networks - Prisma Cloud Compute

Updated the Docker image to: demisto/python3:3.10.14.95137.

Related pull requests:
- 34512

Download

1.7.0 - R951066 (April 11, 2024)

Incident Fields

New: Prisma Cloud Compute Container Compliance Issues
New: Prisma Cloud Compute Host Compliance Issues
New: Prisma Cloud Compute Image Compliance Issues
New: Prisma Cloud Compute Show Compliance Tab
New: Prisma Cloud Compute Tickets Info

Incident Types

Prisma Cloud Compute Compliance v2

Integrations

Palo Alto Networks - Prisma Cloud Compute

Configured a default mapper and classifier.
Increased the http call timeout from 10 seconds to 30 seconds.

Layouts

New: Prisma Cloud Compute Compliance Incident v2
New: A new compliance incident layout with improved and enhanced content.
New tabs for each resource type for showing compliance issues.
New tab for showing enriched compliance information for specific resource.
New tab for showing external ticketing systems information.

Mappers

Palo Alto Networks Prisma Cloud Compute - Incoming Mapper

Mapped Compliance Notes and Alert Category.

Playbooks

New: Prisma Cloud Compute - Compliance Alert Container Enrichment Loop

New: This is a sub playbook of the "Prisma Cloud Compute - Compliance Alert v2" playbook.
It will loop through all of the given compliance issue IDs and will retrieve the following information for each affected container based on the compliance issue ID:

Container ID
Compliance Issues
Compliance Distribution
Hostname
Image Name
Cloud MetaData
The enriched information will be displayed in the layout in a dedicated table under the "Container Compliance Information" tab.

New: Prisma Cloud Compute - Compliance Alert Host Enrichment Loop

Hostname
Compliance Issues
Compliance Distribution
Cloud MetaData
The enriched information will be displayed in the layout in a dedicated table under the "Host Compliance Information" tab.

New: Prisma Cloud Compute - Compliance Alert Image Enrichment Loop

Image ID
Compliance Issues
Compliance Distribution
Hosts
Image Instances
Cloud MetaData
The enriched information will be displayed in the layout in a dedicated table under the "Image Compliance Information" tab.

New: Prisma Cloud Compute - Compliance Alert v2

New: Playbook for enriching Prisma Cloud Compute compliance alerts.
It will handle hosts, images and container compliance alerts.
Each sub playbook in this playbook is dedicated to a specific resource type: host, container or image, and will loop through all of the retrieved Compliance Issue IDs in order to retrieve enriched information about each of the resources.
The enriched information will be displayed in the layout under dedicated tabs and includes resources information like hostnames, container ID, image ID, cloud provider info, enriched compliance issue details and more.
In addition, the playbook can create and update external ticketing systems for each compliance issue automatically with the relevant enriched information. In order to do so, fill the relevant playbook inputs.

New: Prisma Cloud Compute - Jira Compliance Issue

New: This playbook is a sub playbook of the "Prisma Cloud Compute - Compliance Alert Host Enrichment Loop" playbook.
It creates a new Jira issue or updates an existing Jira issue for each compliance ID retrieved in the original Prisma Cloud compliance alert, with enriched data for each resource (host, image or container).

New: Prisma Cloud Compute - Jira Ticket (Markdown Table)

New: This playbook is a sub playbook of the "Prisma Cloud Compute - Jira Compliance Issue" playbook.
It creates a new Jira issue or updates an existing Jira issue with a markdown table for the given compliance ID retrieved from the parent playbook, with enriched data for each resource (host, image or container).

New: Prisma Cloud Compute - Jira Ticket (XLSX)

New: This playbook is a sub playbook of the "Prisma Cloud Compute - Jira Compliance Issue" playbook.
It creates a new Jira issue or updates an existing Jira issue with an XLSX file for the given compliance ID retrieved from the parent playbook, with enriched data for each resource (host, image or container).

New: Prisma Cloud Compute - ServiceNow Compliance Ticket

New: This playbook is a sub playbook of the "Prisma Cloud Compute - Compliance Alert Host Enrichment Loop" playbook.
It creates a new ServiceNow ticket or updates an existing ServiceNow ticket for each compliance ID retrieved in the original Prisma Cloud compliance alert, with enriched data for each resource (host, image or container).

New: Prisma Cloud Compute - ServiceNow Ticket (HTML Table)

New: This playbook is a sub playbook of the "Prisma Cloud Compute - Jira Compliance Issue" playbook.
It creates a new ServiceNow ticket or updates an existing ServiceNow ticket with an HTML table for the given compliance ID retrieved from the parent playbook, with enriched data for each resource (host, image or container).

New: Prisma Cloud Compute - ServiceNow Ticket (XLSX)

New: This playbook is a sub playbook of the "Prisma Cloud Compute - Jira Compliance Issue" playbook.
It creates a new ServiceNow ticket or updates an existing ServiceNow ticket with an XLSX file for the given compliance ID retrieved from the parent playbook, with enriched data for each resource (host, image or container).

Scripts

New: CreatePrismaCloudComputeResourceComplianceReportButton

New: Generate a compliance report for Prisma Cloud resources - host, container or image.

New: PCComputeContainerComplianceIssuesButton

New: This script runs the "prisma-cloud-compute-container-scan-results-list" command for a specific container ID and returns details about its compliance issues, if found. If any compliance issues found, it will create a new tab in the layout called "Detailed Compliance Issues" showing the issues details.
Returns the following fields for each compliance ID:

Compliance ID
Cause
Severity
Title
Description.

New: PCComputeHostComplianceIssuesButton

New: This script runs the "prisma-cloud-compute-hosts-scan-list" command for a specific hostname and returns details about its compliance issues, if found. If any compliance issues found, it will create a new tab in the layout called "Detailed Compliance Issues" showing the issues details.
Returns the following fields for each compliance ID:

Compliance ID
Cause
Severity
Title
Description.

New: PCComputeImageComplianceIssuesButton

New: This script runs the "prisma-cloud-compute-images-scan-list" command for a specific container ID and returns details about its compliance issues, if found. If any compliance issues found, it will create a new tab in the layout called "Detailed Compliance Issues" showing the issues details.
Returns the following fields for each compliance ID:

Compliance ID
Cause
Severity
Title
Description.

New: PrismaCloudComputeComplianceTable

New: Iterate over EnrichedComplianceIssue information in the context data and add the important keys to a table under PrismaCloudCompute.ComplianceTable or a provided grid id.

Triggers Recommendations

New: Prisma Cloud Compute - Compliance Alert v2 Trigger

Related pull requests:
- 32936

Download

1.6.3 - 904622 (March 20, 2024)

Scripts

TagIndicatorButton

Updated the Docker image to: demisto/python3:3.10.13.89009.

CreatePrismaCloudComputeLink

Updated the Docker image to: demisto/python3:3.10.13.89009.

CreatePrismaCloudComputeComplianceReportButton

Updated the Docker image to: demisto/python3:3.10.13.89009.

Related pull requests:
- 33391
- 33314
- 33318
- 33328
- 33357
- 33344
- 33359
- 33348

Download

1.6.2 - 865088 (March 3, 2024)

Scripts

PrismaCloudComputeParseAuditAlert

Updated the Docker image to: demisto/python3:3.10.13.87159.

Related pull requests:
- 33020

Download

1.6.1 - 846375 (February 22, 2024)

Integrations

Palo Alto Networks - Prisma Cloud Compute

Documentation and metadata improvements.

Related pull requests:
- 32943

Download

1.6.0 - R828628 (February 14, 2024)

Integrations

Palo Alto Networks - Prisma Cloud Compute

Updated the prisma-cloud-compute-container-scan-results-list command to support the all_results argument that will provide all the results without limit. When using this argument many results might be returned and therefore it is not recommended to use it often.
Added new commands:
- prisma-cloud-archive-audit-incident
- prisma-cloud-compute-runtime-host-audit-events-list
- prisma-cloud-compute-runtime-container-policy-list
Updated the Docker image to: demisto/python3:3.10.13.86272.

Related pull requests:
- 32303

Download

1.5.1 - 766592 (January 16, 2024)

Playbooks

Prisma Cloud Compute - Get Container Events

Fixed an error for setting events table when no events are found.
Changed a task to use playbook input to retrieve WAAS events.

Prisma Cloud Compute - Audit Alert v3

Fixed a logic bug where all hosts results were retrieved when no image or host is provided in the incident.

Prisma Cloud Compute - Audit Alert Enrichment

Changed enrichment tasks to not extract indicators.

Prisma Cloud Compute - Audit Alert Vulnerabilities Enrichment

Added a playbook input for controlling which indicators would get created from CVEs based on their severity. The default is "High, Critical". This would reduce the number of indicators created to avoid performance issues.

Related pull requests:
- 32303
- 32485

Download

1.5.0 - 728763 (December 31, 2023)

Classifiers

Palo Alto Networks Prisma Cloud Compute - Classifier

Changed the audit events type to Audit Alert v3.

Incident Fields

Associated the following fields to "Prisma Cloud Compute Audit v3" incident type:

Prisma Cloud Compute Raw Alert JSON
Prisma Cloud Compute Activity Type
Prisma Cloud Compute AppID
Prisma Cloud Compute Category
Prisma Cloud Compute Command
Prisma Cloud Compute Container
Prisma Cloud Compute FQDN
Prisma Cloud Compute Forensic
Prisma Cloud Compute Function
Prisma Cloud Compute Host
Prisma Cloud Compute Image
Prisma Cloud Compute Interactive
Prisma Cloud Compute Kubernetes Resource
Prisma Cloud Compute Labels
Prisma Cloud Compute Line
Prisma Cloud Compute Log File
Prisma Cloud Compute Message
Prisma Cloud Compute Region
Prisma Cloud Compute Rule
Prisma Cloud Compute Runtime
Prisma Cloud Compute Service
Prisma Cloud Compute Type
Prisma Cloud Compute User
Added the following new incident fields:
New: Prisma Cloud Compute Namespaces
New: Prisma Cloud Compute Cluster
New: Prisma Cloud Compute Namespaces

Incident Types

New: Prisma Cloud Compute Audit v3
Prisma Cloud Compute Audit v2

Layouts

New: Prisma Cloud Compute Audit Layout v3
New: A new layout for the new "Prisma Cloud Compute - Audit Alert v3" incident type.
The following changes were added:
Fixed an issue with the buttons Add Hash to Prisma Blocklist and Add IP to Prisma Malicious Feed which prevented the buutons from working properly.
Added item owner Email to the Case Details section.
Changed the name of the tab Container Forensics to Forensics since this tab now includes host forensics on host events.

Mappers

##### Palo Alto Networks Prisma Cloud Compute - Incoming Mapper

Added support for the new "Prisma Cloud Compute - Audit Alert v3".

Playbooks

Prisma Cloud Compute - Audit Alert

Deprecated. Use "Prisma Cloud Compute - Audit Alert v3" instead.

Prisma Cloud Compute - Audit Alert v2

Deprecated. Use "Prisma Cloud Compute - Audit Alert v3" instead.

New: Prisma Cloud Compute - Audit Alert v3

New: Default playbook for parsing and enrichment of Prisma Cloud Compute audit alerts.
The playbook has the following sections:
Enrichment:

Image details
Similar container events
Owner details
Vulnerabilities
Compliance details
Forensics
Defender logs.
Remediation:
Block Indicators - Generic v3
Cloud Response - Generic
Manual Remediation

New: Prisma Cloud Compute - Audit Alert Compliance Enrichment

New: This is a sub-playbook of the "Prisma Cloud Compute - Audit Alert v2" playbook.
Retrieves the following information:

Alert profiles
Container WAAS policies
Image compliance issues

New: Prisma Cloud Compute - Audit Alert Enrichment

New: This is a sub-playbook of the "Prisma Cloud Compute - Audit Alert v2" playbook.
It does the following:

Runs the "Prisma Cloud - Get Account Owner" playbook in order to retrieve potential owners for the alert.
Sets the incident link to the layout.
Pulls image details and alerts.
Pulls host scan results.

New: Prisma Cloud Compute - Audit Alert Vulnerabilities Enrichment

New: This is a sub-playbook of the "Prisma Cloud Compute - Audit Alert v2" playbook.
It creates CVE indicators based on image or host vulnerabilities.

New: Prisma Cloud Compute - Container Forensics

New: This is a sub-playbook of the "Prisma Cloud Compute - Audit Alert v2" playbook.
Gets the container profile and forensics.

New: Prisma Cloud Compute - Get Container Events

New: This is a sub-playbook of the "Prisma Cloud Compute - Audit Alert v2" playbook.

Get container WAAS events
Get runtime container events and set it to layout.

New: Prisma Cloud Compute - Get Defender Logs

New: This is a sub-playbook of the “Prisma Cloud Compute - Audit Alert v2” playbook

Gets defender logs and sets them to layout
Downloads defender logs
Gets defender backups

Triggers Recommendations

New: Prisma Cloud Compute - Audit Alert v3 Trigger

Related pull requests:
- 33719
- 32936

Download

1.4.19 - 722180 (December 28, 2023)

Scripts

PrismaCloudComputeParseVulnerabilityAlert

Updated the Docker image to: demisto/python3:3.10.13.83255.

PrismaCloudRemoteTrustedImagesListUpdate

Updated the Docker image to: demisto/python3:3.10.13.83255.

PrismaCloudComputeParseCloudDiscoveryAlert

Updated the Docker image to: demisto/python3:3.10.13.83255.

PrismaCloudComputeParseComplianceAlert

Updated the Docker image to: demisto/python3:3.10.13.83255.

PrismaCloudLocalTrustedImagesListUpdate

Updated the Docker image to: demisto/python3:3.10.13.83255.

Related pull requests:
- 31812

Download

PUBLISHER

PLATFORMS

Cortex XSOARCortex XSIAM

INFO

Certification	Certified	Read more
Supported By	Cortex
Created	March 10, 2020
Last Release	December 2, 2024

WORKS WITH THE FOLLOWING INTEGRATIONS:

Palo Alto Networks - Prisma Cloud Compute

DISCLAIMER

Content packs are licensed by the Publisher identified above and subject to the Publisher’s own licensing terms. Palo Alto Networks is not liable for and does not warrant or support any content pack produced by a third-party Publisher, whether or not such packs are designated as “Palo Alto Networks-certified” or otherwise. For more information, see the Marketplace documentation.

Prisma Cloud Compute by Palo Alto Networks

Prisma Cloud Compute

Overview

Use Cases

Configure Prisma Cloud Compute

Configure Cortex XSOAR

Using the integration and scripts

Audit Alert v3 playbook

Compliance Alert v2

Troubleshooting

Prisma Cloud Compute

Overview

Use Cases

Configure Prisma Cloud Compute

Configure Cortex XSIAM

Using the integration and scripts

Audit Alert v3 playbook

Compliance Alert v2

Troubleshooting

Pack Contributors:

Scripts

PrismaCloudComputeComplianceTable

Integrations

Palo Alto Networks - Prisma Cloud Compute

Scripts

PrismaCloudComputeParseComplianceAlert

PCComputeContainerComplianceIssuesButton

CreatePrismaCloudComputeResourceComplianceReportButton

PrismaCloudComputeParseAuditAlert

PCComputeImageComplianceIssuesButton

PCComputeHostComplianceIssuesButton

PrismaCloudComputeParseCloudDiscoveryAlert

PrismaCloudRemoteTrustedImagesListUpdate

PrismaCloudLocalTrustedImagesListUpdate

PrismaCloudComputeParseVulnerabilityAlert

Scripts

PrismaCloudComputeParseAuditAlert

PCComputeHostComplianceIssuesButton

PrismaCloudComputeParseVulnerabilityAlert

CreatePrismaCloudComputeResourceComplianceReportButton

PCComputeContainerComplianceIssuesButton

PCComputeImageComplianceIssuesButton

PrismaCloudRemoteTrustedImagesListUpdate

CreatePrismaCloudComputeLink

PrismaCloudComputeParseComplianceAlert

CreatePrismaCloudComputeComplianceReportButton

PrismaCloudLocalTrustedImagesListUpdate

PrismaCloudComputeParseCloudDiscoveryAlert

TagIndicatorButton

Integrations

Palo Alto Networks - Prisma Cloud Compute

Layouts

Wizards

New: Prisma Cloud Compute Compliance Use Case

Integrations

Palo Alto Networks - Prisma Cloud Compute

Integrations

Palo Alto Networks - Prisma Cloud Compute

Incident Fields

Incident Types

Integrations

Palo Alto Networks - Prisma Cloud Compute

Layouts

Mappers

Palo Alto Networks Prisma Cloud Compute - Incoming Mapper

Playbooks

New: Prisma Cloud Compute - Compliance Alert Container Enrichment Loop

New: Prisma Cloud Compute - Compliance Alert Host Enrichment Loop

New: Prisma Cloud Compute - Compliance Alert Image Enrichment Loop

New: Prisma Cloud Compute - Compliance Alert v2

New: Prisma Cloud Compute - Jira Compliance Issue

New: Prisma Cloud Compute - Jira Ticket (Markdown Table)

New: Prisma Cloud Compute - Jira Ticket (XLSX)

New: Prisma Cloud Compute - ServiceNow Compliance Ticket

New: Prisma Cloud Compute - ServiceNow Ticket (HTML Table)

New: Prisma Cloud Compute - ServiceNow Ticket (XLSX)

Scripts

New: CreatePrismaCloudComputeResourceComplianceReportButton

New: PCComputeContainerComplianceIssuesButton

New: PCComputeHostComplianceIssuesButton