openapi: 3.2.0
info:
  title: Palo Alto Networks Resource Explorer API
  version: Latest
  contact: {}
  description: 'Operations tagged Resource Explorer across 2 of this provider''s published API definitions: palo-alto-cspm-consolidated-spec-cspm-spec-openapi.json, palo-alto-cspm-resourceexplorer-openapi.json. Each path carries the servers of the definition it was published in.'
servers:
- url: https://api.prismacloud.io
- url: https://api2.prismacloud.io
- url: https://api3.prismacloud.io
- url: https://api4.prismacloud.io
- url: https://api.anz.prismacloud.io
- url: https://api.eu.prismacloud.io
- url: https://api2.eu.prismacloud.io
- url: https://api.gov.prismacloud.io
- url: https://api.prismacloud.cn
- url: https://api.ca.prismacloud.io
- url: https://api.sg.prismacloud.io
- url: https://api.uk.prismacloud.io
- url: https://api.ind.prismacloud.io
- url: https://api.jp.prismacloud.io
- url: https://api.fr.prismacloud.io
tags:
- description: "### Where Do I Find the RRN For My Resource?\n\nYou can find the RRN for a resource in the URL when you view that resource in the Prisma Cloud Resource explorer.\nThe following is an example of such a URL. The RRN is in the URL query string.\n\n```\nhttps://app.prismacloud.io/investigate/details?resourceId=rrn:aws:storageBucket:us-east-1:123456789012:test-bucket \n``` \n\n### Account Representation\n\nIf the **regionId** and **resourceId** are not in the RRN, then the **cloudType** and **resourceType** fields\nin thr RRN are optional. In this siutation, the RRN identifies an account.\n\n\nFull RRN:\n```\nrrn:::us-west-1:12345678901:i-ABCDEFGH\n```\n\nAbridged RRN:\n```  \nrrn::::12345678901\n```\n"
  name: Resource Explorer
paths:
  /resource:
    post:
      description: "Returns detailed information for the resource with the given **rrn**.  \n\nGenerally, the data field in the response object contains the raw JSON blob as is received from the \nsource cloud service provider API for the given resource.\n\nOnly the **rrn** parameter in the request body is used for this API. Ignore the **timelineItemId** and \n**findingType** fields for this API.\n\nAn example request body is:\n```\n{\n  \"rrn\": \"rrn::storageBucket:us-east-1:123456789012:test-bucket\"\n}\n```\n"
      operationId: get-resource
      requestBody:
        content:
          application/json; charset=UTF-8:
            schema:
              $ref: '#/components/schemas/ResourceExplorerRequest'
      responses:
        '200':
          content:
            application/json; charset=UTF-8:
              schema:
                $ref: '#/components/schemas/ResourceMetaModel'
          description: successful operation
        '400':
          description: bad_request / no_results / invalid_parameter_value
        '404':
          description: not_found
        '500':
          description: internal_error
      security:
      - x-redlock-auth: []
      summary: Get Resource
      tags:
      - Resource Explorer
    servers:
    - url: https://api.prismacloud.io
    - url: https://api2.prismacloud.io
    - url: https://api3.prismacloud.io
    - url: https://api4.prismacloud.io
  /resource/alert:
    post:
      description: "Get a list of alerts associated with a given resource.  \n\nOnly the **rrn** parameter in the request body is used for this API. Ignore the **timelineItemId** and \n**findingType** fields for this API.\n\nAn example request body is:\n```\n{\n  \"rrn\": \"rrn::storageBucket:us-east-1:123456789012:test-bucket\"\n}\n```\n"
      operationId: get-alerts-for-resource
      requestBody:
        content:
          application/json; charset=UTF-8:
            schema:
              $ref: '#/components/schemas/ResourceExplorerRequest'
      responses:
        '200':
          content:
            application/json; charset=UTF-8:
              schema:
                items:
                  $ref: '#/components/schemas/AlertIdAndSeverity'
                type: array
          description: successful operation
        '400':
          description: bad_request / invalid_parameter_value
      security:
      - x-redlock-auth: []
      summary: Get Alerts for Resource
      tags:
      - Resource Explorer
    servers:
    - url: https://api.prismacloud.io
    - url: https://api2.prismacloud.io
    - url: https://api3.prismacloud.io
    - url: https://api4.prismacloud.io
  /resource/network:
    post:
      description: "Fetch network port settings and configuration for a resource.  \n\nOnly the **rrn** parameter in the request body is used for this API. Ignore the **timelineItemId** and \n**findingType** fields for this API.\n\nAn example request body is:\n```\n{\n  \"rrn\": \"rrn::storageBucket:us-east-1:123456789012:test-bucket\"\n}\n```\n"
      operationId: get-network-for-resource
      requestBody:
        content:
          application/json; charset=UTF-8:
            schema:
              $ref: '#/components/schemas/ResourceExplorerRequest'
      responses:
        '200':
          content:
            application/json; charset=UTF-8:
              schema:
                items:
                  $ref: '#/components/schemas/SecurityGroupDetail'
                type: array
          description: success / no_results
        '400':
          description: bad_request / invalid_parameter_value
      security:
      - x-redlock-auth: []
      summary: Get Resource Network Settings
      tags:
      - Resource Explorer
    servers:
    - url: https://api.prismacloud.io
    - url: https://api2.prismacloud.io
    - url: https://api3.prismacloud.io
    - url: https://api4.prismacloud.io
  /resource/external_finding:
    get:
      description: Get a list of all host findings for a specific alert.
      operationId: get-host-findings-for-alert
      parameters:
      - in: query
        name: alertId
        required: true
        schema:
          type: string
      - explode: true
        in: query
        name: type
        required: false
        schema:
          items:
            type: string
          type: array
      - explode: true
        in: query
        name: source
        required: false
        schema:
          items:
            type: string
          type: array
      responses:
        '200':
          content:
            application/json; charset=UTF-8:
              schema:
                items:
                  $ref: '#/components/schemas/ExternalFindingView'
                type: array
          description: successful operation
        '400':
          description: bad_request / invalid_parameter_value
      security:
      - x-redlock-auth: []
      summary: List Host Findings For Alert
      tags:
      - Resource Explorer
    post:
      description: "Returns a list of all host findings for the current resource.  \n\nSupported finding types:\n\nFinding Type | Key\n-----------| ----\nAWS GuardDuty Host | **guard_duty_host**\nAWS GuardDuty IAM  | **guard_duty_iam**\nAWS Inspector Security Best Practices | **inspector_sbp**\nAWS Runtime Behavior Analysis | **inspector_rba_count**\nCIS Compliance | **compliance_cis**\nHost Vulnerability | **host_vulnerability_cve**\n\nOnly the **rrn** parameter in the request body is used for this API. Ignore the **timelineItemId** \nfield for this API.\n\nAn example request body with a specified finding type is:\n```json\n{\n  \"findingType\": [ \"host_vulnerability_cve\", \"inspector_sbp\" ],\n  \"rrn\": \"rrn::instance:us-east-1:i-xxxxxxxxxx\"\n}\n``` \n\nAn example request body for all finding types is:\n```json\n{\n  \"rrn\": \"rrn::instance:us-east-1:i-xxxxxxxxxx\"\n}\n"
      operationId: get-host-findings
      requestBody:
        content:
          application/json; charset=UTF-8:
            schema:
              $ref: '#/components/schemas/ResourceExplorerRequest'
      responses:
        '200':
          content:
            application/json; charset=UTF-8:
              schema:
                items:
                  $ref: '#/components/schemas/ExternalFindingView'
                type: array
          description: successful operation
        '400':
          description: bad_request / invalid_parameter_value
      security:
      - x-redlock-auth: []
      summary: List Host Findings
      tags:
      - Resource Explorer
    servers:
    - url: https://api.prismacloud.io
    - url: https://api2.prismacloud.io
    - url: https://api3.prismacloud.io
    - url: https://api4.prismacloud.io
  /resource/timeline:
    post:
      description: "Returns a timeline of events and alerts for the given resource.  \n\nOnly the **rrn** parameter in the request body is used for this API. Ignore the **timelineItemId** and \n**findingType** fields for this API.\n\nAn example request body is:\n```json\n{\n  \"\"rrn\": \"rrn::instance:us-east-1:i-xxxxxxxxxx\"\n}\n```\n"
      operationId: get-timeline-for-resource
      requestBody:
        content:
          application/json; charset=UTF-8:
            schema:
              $ref: '#/components/schemas/ResourceExplorerRequest'
      responses:
        '200':
          content:
            application/json; charset=UTF-8:
              schema:
                items:
                  $ref: '#/components/schemas/ResourceTimelineItem'
                type: array
          description: successful operation
        '400':
          description: invalid_parameter_value
        '404':
          description: not_found
        '500':
          description: internal_error
      security:
      - x-redlock-auth: []
      summary: Get Resource Timeline
      tags:
      - Resource Explorer
    servers:
    - url: https://api.prismacloud.io
    - url: https://api2.prismacloud.io
    - url: https://api3.prismacloud.io
    - url: https://api4.prismacloud.io
  /resource/raw:
    post:
      description: "Returns the raw metadata of the configuration of a resource at a given point in time.  \n\nGenerally, the response object contains the raw JSON blob as is received from the \nsource cloud service provider API.\n\nOnly the **rrn** parameter in the request body is used for this API. Ignore the **findingType** \nfield for this API.\n\nYou can find the **timelineItemId** for your resource from the timeline results that \n[Get Resource Timeline](/prisma-cloud/api/cspm/get-timeline-for-resource)\nreturns.\n\nAn example request body is:\n```json\n{\n  \"rrn\": \"rrn::instance:us-east-1:i-xxxxxxxxxx\",\n  \"timelineItemId\": \"xxxxxxxxxxxxxx\"\n}\n```\n"
      operationId: get-resource-raw
      requestBody:
        content:
          application/json; charset=UTF-8:
            schema:
              $ref: '#/components/schemas/ResourceExplorerRequest'
      responses:
        '200':
          content:
            application/json; charset=UTF-8:
              schema:
                type: object
          description: successful operation
        '400':
          description: invalid_parameter_value
        '404':
          description: not_found
        '500':
          description: internal_error
      security:
      - x-redlock-auth: []
      summary: Get Resource (Raw)
      tags:
      - Resource Explorer
    servers:
    - url: https://api.prismacloud.io
    - url: https://api2.prismacloud.io
    - url: https://api3.prismacloud.io
    - url: https://api4.prismacloud.io
  /resource/external_integration:
    post:
      description: Returns a list of external ingestion integrations for the specified resource.
      operationId: get-external-integrations-for-resource
      requestBody:
        content:
          application/json; charset=UTF-8:
            schema:
              $ref: '#/components/schemas/ResourceExplorerRequest'
      responses:
        '200':
          content:
            application/json; charset=UTF-8:
              schema:
                items:
                  $ref: '#/components/schemas/ExternalIntegrationView'
                type: array
          description: success / no_results
        '400':
          description: bad_request / invalid_parameter_value
      security:
      - x-redlock-auth: []
      summary: Get External Ingest Integrations for the resource
      tags:
      - Resource Explorer
    servers:
    - url: https://api.prismacloud.io
    - url: https://api2.prismacloud.io
    - url: https://api3.prismacloud.io
    - url: https://api4.prismacloud.io
components:
  schemas:
    ResourceTimelineVulnerability:
      properties:
        id:
          type: string
        url:
          type: string
      type: object
    ResourceMetaModel:
      description: Model containing resource metadata
      properties:
        accountGroupName:
          description: Account group name
          type: string
        accountId:
          description: Account ID
          type: string
        accountName:
          description: Account name
          type: string
        allowDrillDown:
          description: allowDrillDown
          type: boolean
        assetId:
          description: Asset ID
          type: string
        cloudType:
          description: Cloud Type
          enum:
          - ALL
          - AWS
          - AZURE
          - GCP
          - ALIBABA_CLOUD
          - OCI
          - IBM
          type: string
        createdTs:
          description: Creation timestamp
          format: int64
          type: integer
        data:
          description: Raw JSON data for the resource
          type: object
        deleted:
          description: Deleted
          type: boolean
        dynamicData:
          additionalProperties:
            type: object
          description: Dynamic data
          type: object
        hasExtFindingRiskFactors:
          description: Has risk factors
          type: boolean
        hasExternalFinding:
          description: Has external finding
          type: boolean
        hasExternalIntegration:
          description: Has external integration
          type: boolean
        hasNetwork:
          description: Has network
          type: boolean
        id:
          description: ID
          type: string
        insertTs:
          description: Insertion timestamp
          format: int64
          type: integer
        name:
          description: Name
          type: string
        regionId:
          description: Region ID
          type: string
        regionName:
          description: Region name
          type: string
        resourceConfigJsonAvailable:
          description: allowDrillDown
          type: boolean
        resourceType:
          description: Resource type
          type: string
        riskGrade:
          description: Risk grade
          type: string
        rrn:
          allOf:
          - $ref: '#/components/schemas/RRNModel'
          - description: RRN
        service:
          description: Service
          type: string
        stateId:
          description: State ID
          type: string
        tags:
          additionalProperties:
            type: string
          description: Tags
          type: object
        url:
          description: URL
          type: string
        vpcId:
          description: Virtual private cloud ID
          type: string
        vpcName:
          description: Virtual private cloud name
          type: string
      type: object
    ExternalIntegrationView:
      properties:
        assetJson:
          type: string
        firstSeen:
          format: int64
          type: integer
        hasAgent:
          type: boolean
        id:
          type: string
        lastSeen:
          format: int64
          type: integer
        name:
          type: string
        rlUpdatedOn:
          format: int64
          type: integer
        source:
          enum:
          - AWS_INSPECTOR
          - AWS_GUARD_DUTY
          - TENABLE
          - QUALYS
          - PRISMA_CLOUD
          - AZURE_SECURITY_CENTER
          type: string
        tags:
          items:
            type: string
          type: array
      type: object
    ResourceExplorerRequest:
      properties:
        excludeSeverityList:
          description: External Findings Severitys to exclude
          items:
            type: string
          type: array
        findingSource:
          description: External Finding Sources
          items:
            enum:
            - AWS_INSPECTOR
            - AWS_GUARD_DUTY
            - TENABLE
            - QUALYS
            - PRISMA_CLOUD
            - AZURE_SECURITY_CENTER
            type: string
          readOnly: true
          type: array
        findingType:
          description: External Finding Types
          items:
            type: string
          type: array
        riskFactors:
          description: External finding risk factors
          items:
            enum:
            - CRITICAL_SEVERITY
            - HIGH_SEVERITY
            - MEDIUM_SEVERITY
            - HAS_FIX
            - REMOTE_EXECUTION
            - DOS
            - RECENT_VULNERABILITY
            - EXPLOIT_EXISTS
            - ATTACK_COMPLEXITY_LOW
            - ATTACK_VECTOR_NETWORK
            - REACHABLE_FROM_THE_INTERNET
            - LISTENING_PORTS
            - CONTAINER_IS_RUNNING_AS_ROOT
            - NO_MANDATORY_SECURITY_PROFILE_APPLIED
            - RUNNING_AS_PRIVILEGED_CONTAINER
            - PACKAGE_IN_USE
            type: string
          type: array
        rrn:
          description: Restricted Resource Name
          type: string
        rrnList:
          description: Restricted Resource Name
          items:
            type: string
          type: array
        timelineItemId:
          description: Timeline Item ID
          type: string
      type: object
    SecurityGroupDetail:
      properties:
        access:
          type: string
        direction:
          type: string
        id:
          format: int64
          type: integer
        ips:
          type: string
        ports:
          type: string
        priority:
          format: int32
          type: integer
        protocol:
          type: string
      type: object
    AlertIdAndSeverity:
      properties:
        id:
          type: string
        severity:
          enum:
          - INFORMATIONAL
          - LOW
          - MEDIUM
          - HIGH
          - CRITICAL
          type: string
      type: object
    RRNModel:
      description: Model for RRN
      properties:
        accountId:
          description: Account ID
          readOnly: true
          type: string
        cloudType:
          description: Cloud type
          enum:
          - ALL
          - AWS
          - AZURE
          - GCP
          - ALIBABA_CLOUD
          - OCI
          - IBM
          readOnly: true
          type: string
        idmapId:
          description: Hashed generated ID
          readOnly: true
          type: string
        regionId:
          description: Region ID
          readOnly: true
          type: string
        resourceId:
          description: Resource ID
          readOnly: true
          type: string
        resourceType:
          description: Resource type
          readOnly: true
          type: string
      type: object
    ExternalFindingView:
      properties:
        accountId:
          type: string
        count:
          type: string
        createdOn:
          format: int64
          type: integer
        customerId:
          format: int32
          type: integer
        cveId:
          type: string
        description:
          type: string
        externalFindingId:
          format: int64
          type: integer
        findingId:
          type: string
        normalizedName:
          type: string
        normalizedNames:
          items:
            type: string
          type: array
        nvdUrl:
          type: string
        rawData:
          type: string
        regionId:
          type: string
        resourceCloudId:
          type: string
        resourceId:
          format: int64
          type: integer
        resourceUrl:
          type: string
        riskFactors:
          items:
            enum:
            - CRITICAL_SEVERITY
            - HIGH_SEVERITY
            - MEDIUM_SEVERITY
            - HAS_FIX
            - REMOTE_EXECUTION
            - DOS
            - RECENT_VULNERABILITY
            - EXPLOIT_EXISTS
            - ATTACK_COMPLEXITY_LOW
            - ATTACK_VECTOR_NETWORK
            - REACHABLE_FROM_THE_INTERNET
            - LISTENING_PORTS
            - CONTAINER_IS_RUNNING_AS_ROOT
            - NO_MANDATORY_SECURITY_PROFILE_APPLIED
            - RUNNING_AS_PRIVILEGED_CONTAINER
            - PACKAGE_IN_USE
            type: string
          type: array
          uniqueItems: true
        rlUpdatedOn:
          format: int64
          type: integer
        scanId:
          type: string
        score:
          type: object
        severity:
          enum:
          - INFORMATIONAL
          - LOW
          - MEDIUM
          - HIGH
          - CRITICAL
          type: string
        source:
          enum:
          - AWS_INSPECTOR
          - AWS_GUARD_DUTY
          - TENABLE
          - QUALYS
          - PRISMA_CLOUD
          - AZURE_SECURITY_CENTER
          type: string
        sourceData:
          additionalProperties:
            type: object
          type: object
        status:
          enum:
          - PENDING
          - NO_ERROR
          - ERROR
          - ENABLED
          - DISABLED
          - OPEN
          - DISMISSED
          - RESOLVED
          - DESCOPED
          - RISK_SCORING_ERROR
          - ACTIVE
          - CLOSED
          - SUPPRESSED
          type: string
        title:
          type: string
        type:
          enum:
          - HOST_VULNERABILITY_CVE
          - COMPLIANCE_ISSUE_CIS
          - AWS_INSPECTOR_SECURITY_BEST_PRACTICES
          - AWS_INSPECTOR_RUNTIME_BEHAVIOR_ANALYSIS
          - AWS_GUARD_DUTY_HOST_FINDING
          - AWS_GUARD_DUTY_IAM_FINDING
          - SERVERLESS_VULNERABILITY
          - AZURE_SECURITY_CENTER_ALERTS
          - PACKAGE_VULNERABILITY
          - NETWORK_REACHABILITY
          - AWS_GUARD_DUTY_EKS_FINDING
          - AWS_GUARD_DUTY_ECS_FINDING
          - AWS_GUARD_DUTY_CONTAINER_FINDING
          type: string
        updatedOn:
          format: int64
          type: integer
      type: object
    ResourceTimelineItem:
      properties:
        alertIds:
          items:
            type: string
          type: array
        discoveredTs:
          format: int64
          type: integer
        eventName:
          type: string
        eventType:
          type: string
        firstState:
          type: boolean
        id:
          type: string
        previousStateId:
          type: string
        similarSince:
          format: int64
          type: integer
        similarStateCount:
          format: int64
          type: integer
        timestamp:
          format: int64
          type: integer
        type:
          enum:
          - STATE_CHANGE
          - EVENT
          - VULNERABILITY
          type: string
        user:
          type: string
        vulnerabilities:
          items:
            $ref: '#/components/schemas/ResourceTimelineVulnerability'
          type: array
      type: object
    ExternalFindingView_2:
      properties:
        accountId:
          type: string
        apiId:
          format: int32
          type: integer
        count:
          type: string
        createdOn:
          format: int64
          type: integer
        customerId:
          format: int32
          type: integer
        cveId:
          type: string
        description:
          type: string
        externalFindingId:
          format: int64
          type: integer
        findingId:
          type: string
        normalizedName:
          type: string
        normalizedNames:
          items:
            type: string
          type: array
        nvdUrl:
          type: string
        rawData:
          type: string
        regionId:
          type: string
        resourceCloudId:
          type: string
        resourceId:
          format: int64
          type: integer
        resourceUrl:
          type: string
        riskFactors:
          items:
            enum:
            - CRITICAL_SEVERITY
            - HIGH_SEVERITY
            - MEDIUM_SEVERITY
            - HAS_FIX
            - REMOTE_EXECUTION
            - DOS
            - RECENT_VULNERABILITY
            - EXPLOIT_EXISTS
            - ATTACK_COMPLEXITY_LOW
            - ATTACK_VECTOR_NETWORK
            - REACHABLE_FROM_THE_INTERNET
            - LISTENING_PORTS
            - CONTAINER_IS_RUNNING_AS_ROOT
            - NO_MANDATORY_SECURITY_PROFILE_APPLIED
            - RUNNING_AS_PRIVILEGED_CONTAINER
            - PACKAGE_IN_USE
            type: string
          type: array
          uniqueItems: true
        rlUpdatedOn:
          format: int64
          type: integer
        scanId:
          type: string
        score:
          type: object
        severity:
          enum:
          - INFORMATIONAL
          - LOW
          - MEDIUM
          - HIGH
          - CRITICAL
          type: string
        source:
          enum:
          - AWS_INSPECTOR
          - AWS_GUARD_DUTY
          - TENABLE
          - QUALYS
          - PRISMA_CLOUD
          - AZURE_SECURITY_CENTER
          type: string
        sourceData:
          additionalProperties:
            type: object
          type: object
        status:
          enum:
          - PENDING
          - NO_ERROR
          - ERROR
          - ENABLED
          - DISABLED
          - OPEN
          - DISMISSED
          - RESOLVED
          - DESCOPED
          - RISK_SCORING_ERROR
          - ACTIVE
          - CLOSED
          - SUPPRESSED
          type: string
        title:
          type: string
        type:
          enum:
          - HOST_VULNERABILITY_CVE
          - COMPLIANCE_ISSUE_CIS
          - AWS_INSPECTOR_SECURITY_BEST_PRACTICES
          - AWS_INSPECTOR_RUNTIME_BEHAVIOR_ANALYSIS
          - AWS_GUARD_DUTY_HOST_FINDING
          - AWS_GUARD_DUTY_IAM_FINDING
          - SERVERLESS_VULNERABILITY
          - AZURE_SECURITY_CENTER_ALERTS
          - PACKAGE_VULNERABILITY
          - NETWORK_REACHABILITY
          - AWS_GUARD_DUTY_EKS_FINDING
          - AWS_GUARD_DUTY_ECS_FINDING
          - AWS_GUARD_DUTY_CONTAINER_FINDING
          type: string
        updatedOn:
          format: int64
          type: integer
      type: object
  securitySchemes:
    x-redlock-auth:
      description: The x-redlock-auth value is a JSON Web Token (JWT).
      in: header
      name: x-redlock-auth
      type: apiKey
x-refined-from:
- palo-alto-cspm-consolidated-spec-cspm-spec-openapi.json
- palo-alto-cspm-resourceexplorer-openapi.json