Copy page

Palo Alto

Prisma Cloud Alerts

Collects security alerts from Palo Alto Prisma Cloud Security Posture Management

Details

This input collects security alerts from the Palo Alto Prisma Cloud API. It periodically fetches alerts and handles pagination automatically. Key features include:

• Incremental sync support with state management
• Support for detailed alert information

Requirements

1. A Prisma Cloud account with API access
2. Access Key ID and Secret Key from Prisma Cloud console
3. Your Prisma Cloud API URL (e.g., https://api.prismacloud.io)

Setup Instructions

1. Log in to your Prisma Cloud Console
2. Navigate to Settings > Access Control
3. Create a new Access Key and Secret Key pair
4. Note down your Prisma Cloud API URL (varies by region). Refer to this documentation for the correct URL:
   • Prisma Cloud API URLs
5. Configure the input using the credentials and URL

Related Articles

• Prisma Cloud API Reference
• Access Key Management
• Alert Management

Settings

Field	Description	Type	Required
url	Base URL for the Prisma Cloud API (e.g., https://api.prismacloud.io)	string	Yes
backfill start time	string	No	The date to start fetching data from. If not specified, no past records will be fetched.
API Rate Limit	Optional limit on the connector's outbound request rate to the source API. Leave blank to use the connector's default behavior. See API Rate Limiting for the field format, limits, and how to choose a value.	object	No

Secrets

Field	Description	Type	Required
username	Username or Access Key ID	string	Yes
password	Password or Secret Key	string	Yes

Note on Collection Behavior

The input follows an incremental collection pattern:

• First run: Collects all available alerts
• Subsequent runs: Collects only new alerts since the last successful run
• Implements state management to track the last collection timestamp

Troubleshooting

Common issues and their solutions:

1. Authentication failures

   • Verify Access Key ID and Secret Key are correct
   • Ensure the API keys have not expired
   • Check if the keys have required permissions

2. Connection issues

   • Verify the API URL is correct for your region
   • Check network connectivity and firewall rules
   • Ensure proper SSL/TLS configuration

3. Rate limiting

   • The input implements automatic rate limiting handling
   • Consider adjusting the polling interval if needed

Sample Record

Code
{
  "id": "N-301",
  "status": "suppressed",
  "reason": "RESOURCE_ADDED",
  "firstSeen": 1742340436008,
  "lastSeen": 1744456299142,
  "alertTime": 1744098242691,
  "lastUpdated": 1744181047491,
  "policyId": "1b69c6f8-c38b-b004-e28a-e5a132cc0ea4",
  "metadata": {
    "riskFactors": [
      "Public exposure",
      "Admin port"
    ]
  },
  "policy": {
    "policyId": "53b8912d-7774-515e-2f05-cdb769b05b19",
    "name": "AWS S3 bucket publicly accessible",
    "policyType": "data",
    "systemDefault": true,
    "description": "AWS EC2 instances accessible from the internet (0.0.0.0/0) on ports 22 and 3389 are highly susceptible to unauthorized access. This misconfiguration exposes critical systems to attacks.",
    "severity": "low",
    "recommendation": "Follow the principle of least privilege for IAM permissions",
    "labels": [
      "CIS_Benchmark",
      "Attack Path Rule"
    ],
    "aiRemediable": false,
    "lastModifiedOn": 1742361843157,
    "lastModifiedBy": "admin@example.com",
    "deleted": false,
    "findingTypes": [],
    "hasSearchExecutionSupport": true,
    "remediable": true
  },
  "alertRules": [],
  "history": [],
  "resource": {
    "rrn": "rrn:azure:instance:us-east-1:585501320820:70d7d620-1c6f-0b09-6f49-a05d54c79875:vm-47cdd149-2d3e-3c28-c645-6518401e93a2",
    "id": "db-d5cadcd4-ca8c-48d0-6279-35e3eb82e9c9",
    "name": "web-server-prod",
    "account": "AWS Cloud Account",
    "accountId": "596105122472",
    "cloudAccountGroups": [
      "Production"
    ],
    "region": "AWS Frankfurt",
    "regionId": "us-west-2",
    "resourceType": "DATABASE",
    "resourceApiName": "azure-compute-virtualmachines",
    "cloudServiceName": "Amazon S3",
    "url": "https://us-central1.console.cloud.google.com/compute/home?region=us-east-1#NetworkDetails:networkId=vm-320b8d2e-a897-17af-ce7f-f39c12dc8d1b",
    "data": null,
    "additionalInfo": null,
    "cloudType": "azure",
    "resourceTs": 1743482280099,
    "unifiedAssetId": "e293f7e0-c909-ac7c-87fd-62530637e0b3",
    "resourceConfigJsonAvailable": false,
    "resourceDetailsAvailable": true
  },
  "investigateOptions": {
    "alertId": "N-213"
  }
}

Sync frequency

By default this input polls approximately every 10 seconds, with each sync beginning after the previous one completes. A cron schedule configured on the pipeline overrides this cadence. See Input Sync Frequency for details.