Palo Alto Networks Prisma Cloud

{
    "id":"2dcffa4a51d892bcf48ed80652e75650",
    "externalAssetId":"5115585594921894848",
    "cloudType":"gcp",
    "createdTs":1707216238063,
    "insertTs":1707216238063,
    "dynamicData":null,
    "data":{
        "id":"5115585594921894848",
        "kind":"compute#instance",
        "name":"example-name-rgmn",
        "tags":{
            "items":[
                "example-name"
            ],
            "fingerprint":"ycXN3kijHZc="
        },
        "zone":"https://www.googleapis.com/compute/v1/projects/PROJECT_NAME/zones/us-central1-a",
        "disks":[
            {
                "boot":true,
                "kind":"compute#attachedDisk",
                "mode":"READ_WRITE",
                "type":"PERSISTENT",
                "index":0,
                "source":"https://www.googleapis.com/compute/v1/projects/PROJECT_NAME/zones/us-central1-a/disks/example-name-rgmn",
                "licenses":[
                    "https://www.googleapis.com/compute/v1/projects/PROJECT_NAME/global/licenses/LICENSE_ID"
                ],
                "interface":"SCSI",
                "autoDelete":true,
                "deviceName":"persistent-disk-0",
                "diskSizeGb":"30",
                "architecture":"X86_64",
                "guestOsFeatures":[
                    {
                        "type":"GVNIC"
                    },
                    {
                        "type":"SEV_CAPABLE"
                    },
                    {
                        "type":"UEFI_COMPATIBLE"
                    },
                    {
                        "type":"VIRTIO_SCSI_MULTIQUEUE"
                    }
                ],
                "shieldedInstanceInitialState":{
                    "dbxs":[
                    ]
                }
            }
        ],
        "labels":{
            "goog-ccm":"true",
            "goog-solutions-console-solution-id":"java-application",
            "goog-solutions-console-deployment-name":"java-application"
        },
        "status":"RUNNING",
        "metadata":{
            "kind":"compute#metadata",
            "items":[
                {
                    "key":"created-by",
                    "value":"projects/PROJECT_ID/regions/us-central1/instanceGroupManagers/example-name"
                },
                {
                    "key":"instance-template",
                    "value":"projects/PROJECT_ID/global/instanceTemplates/xwiki-us-central1-a-temp"
                },
                {
                    "key":"startup-script",
                    "value":"#! /bin/bash\n\nsed -i \"s/$(echo JGROUP_BUCKET | sed -e 's/\\([[\/.*]\\|\\]\\)/\\\\&/g')/$(echo xwiki-jgroup-PROJECT_ID-gce | sed -e 's/[\/&]/\\\\&/g')/g\" /usr/lib/xwiki/WEB-INF/observation/remote/jgroups/tcp.xml\nsed -i \"s/$(echo ACCESS_KEY | sed -e 's/\\([[\/.*]\\|\\]\\)/\\\\&/g')/$(echo GOOG1E | sed -e 's/[\/&]/\\\\&/g')/g\" /usr/lib/xwiki/WEB-INF/observation/remote/jgroups/tcp.xml\nsed -i \"s/$(echo SECRET_KEY | sed -e 's/\\([[\/.*]\\|\\]\\)/\\\\&/g')/$(echo IvgTtIJJq+68sI9XISo2qMXGyONmFDf7U9QuegN/ | sed -e 's/[\/&]/\\\\&/g')/g\" /usr/lib/xwiki/WEB-INF/observation/remote/jgroups/tcp.xml\n\nDB_PASS=\"$(gcloud secrets versions access --secret xwiki-db-password latest --project PROJECT_NAME)\"\n\nbash /home/xwiki_startup.sh \"203.0.113.2\" \"xwiki\" \"${DB_PASS}\" \"203.0.113.242\"\nbash /home/xwiki_deploy_flavor.sh \"203.0.113.2\" \"xwiki\" \"${DB_PASS}\" \"203.0.113.242\"\n"
                }
            ],
            "fingerprint":"_s0ui1yxFME="
        },
        "selfLink":"https://www.googleapis.com/compute/v1/projects/PROJECT_NAME/zones/us-central1-a/instances/example-name-rgmn",
        "scheduling":{
            "preemptible":false,
            "automaticRestart":true,
            "onHostMaintenance":"MIGRATE",
            "provisioningModel":"STANDARD"
        },
        "cpuPlatform":"Intel Cascade Lake",
        "fingerprint":"YBMt5z3lxpI=",
        "machineType":"https://www.googleapis.com/compute/v1/projects/PROJECT_NAME/zones/us-central1-a/machineTypes/n2-standard-2",
        "minCpuPlatform":"Intel Cascade Lake",
        "serviceAccounts":[
            {
                "email":"example@developer.gserviceaccount.com",
                "scopes":[
                    "https://www.googleapis.com/auth/cloud-platform",
                    "https://www.googleapis.com/auth/compute",
                    "https://www.googleapis.com/auth/devstorage.full_control",
                    "https://www.googleapis.com/auth/devstorage.read_only",
                    "https://www.googleapis.com/auth/logging.write",
                    "https://www.googleapis.com/auth/monitoring.write",
                    "https://www.googleapis.com/auth/service.management.readonly",
                    "https://www.googleapis.com/auth/servicecontrol",
                    "https://www.googleapis.com/auth/trace.append"
                ]
            }
        ],
        "startRestricted":false,
        "labelFingerprint":"Cy_Kdpu4cz8=",
        "creationTimestamp":"2024-02-05T16:28:31.856-08:00",
        "networkInterfaces":[
            {
                "kind":"compute#networkInterface",
                "name":"nic0",
                "network":"https://www.googleapis.com/compute/v1/projects/PROJECT_NAME/global/networks/NETWORK_ID",
                "networkIP":"203.0.113.2",
                "stackType":"IPV4_ONLY",
                "subnetwork":"https://www.googleapis.com/compute/v1/projects/PROJECT_NAME/regions/us-central1/subnetworks/SUBNETWORK_ID",
                "fingerprint":"lpKHF5wzhv4="
            }
        ],
        "deletionProtection":false,
        "lastStartTimestamp":"2024-02-05T16:28:47.038-08:00",
        "shieldedInstanceConfig":{
            "enableVtpm":true,
            "enableSecureBoot":false,
            "enableIntegrityMonitoring":true
        },
        "shieldedInstanceIntegrityPolicy":{
            "updateAutoLearnPolicy":true
        }
    },
    "name":"example-name-rgmn",
    "regionId":"us-central1",
    "regionName":"US",
    "riskGrade":"B",
    "stateId":null,
    "url":"https://console.cloud.google.comhttps://console.cloud.google.com/compute/instancesDetail/zones/us-central1-a/instances/example-name-rgmn?project=PROJECT_NAME",
    "vpcId":null,
    "vpcName":null,
    "relationshipCounts":1,
    "vulnerabilityCounts":{
        "critical":17,
        "high":38,
        "knownExploits":{
            "critical":0,
            "high":0,
            "low":0,
            "medium":0
        },
        "low":31,
        "medium":59,
        "old":{
            "critical":0,
            "high":0,
            "low":0,
            "medium":0
        },
        "patchable":{
            "critical":17,
            "high":38,
            "low":5,
            "medium":26
        }
    },
    "vpcExternalAssetId":null,
    "tags":{
        "goog-ccm":true,
        "xwiki-us-central1-autoscale":"",
        "goog-solutions-console-deployment-name":"java-application",
        "goog-solutions-console-solution-id":"java-application"
    },
    "assetType":"Google Compute Engine VM Instance",
    "serviceName":"Google Compute Engine",
    "resourceType":"Google Compute Engine VM Instance",
    "accountGroup":"account",
    "accountName":"Example-Name",
    "assetClassId":"compute",
    "assetClass":"Compute",
    "deleted":false,
    "problem":[
        
    ],
    "alertsCount":[
        {
            "count":5,
            "severity":"high"
        },
        {
            "count":3,
            "severity":"critical"
        },
        {
            "count":2,
            "severity":"low"
        }
    ],
    "attributes":{
        "altAssetId":"example-name-rgmn.us-central1-a.c.PROJECT_NAME.internal",
        "name":"example-name-rgmn.us-central1-a.c.PROJECT_NAME.internal",
        "provider":"gcp",
        "accountID":"example-account",
        "region":"us-central1-a",
        "resourceName":"5115585594921894848",
        "osRelease":"focal",
        "osDistro":"ubuntu",
        "distro":"Ubuntu 20.04.5 LTS",
        "scannedBy":"Agentless",
        "docker":"",
        "kubernetes":"",
        "cluster":"",
        "vmImage":"hsa-xwiki-vm-img-latest",
        "collections":[
            "All"
        ],
        "scanPassed":true,
        "stage":"run",
        "lastScanTime":"2024-02-12T18:25:39.39Z"
    },
    "alertCountBySeverity":[
        {
            "severity":"high",
            "count":5
        },
        {
            "severity":"critical",
            "count":3
        },
        {
            "severity":"low",
            "count":2
        }
    ]
}

{
"response_status": {"Reopened", "Snoozed", "Dismissed", "Remediated", "No Remediation Applied."} 
}

"filters": [
 {
     "operator": "=",
     "name": "policy.name",
     "value": "Google Cloud VM instance that is internet reachable with unrestricted access (203.0.113.0/24)"
 },
 {
     "operator": "=",
     "name": "policy.name",
     "value": "Compute Engine with IAM write access level"
 }
]

{
 "id": "ID",
 "status": "open",
 "reason": "NEW_ALERT",
 "firstSeen": 1706971601230,
 "lastSeen": 1706971601230,
 "alertTime": 1706971601230,
 "lastUpdated": 1707806767098,
 "saveSearchId": "b1ccf7df-d2c8-4588-8d06-b62738fd9745",
 "policy": {
     "policyId": "45488d62-6abe-4938-9b7a-aaa44858540e",
     "name": "Data destruction risk due to a publicly exposed and vulnerable Google Cloud VM instance with delete permissions",
     "policyType": "attack_path",
     "systemDefault": true,
     "description": "This policy idnces as soon as possible.",
     "severity": "critical",
     "recommendation": "The followinge vulnerabilities quickly.",
     "labels": [
         "Prisma_Cloud"
     ],
     "lastModifiedOn": 1702006359544,
     "lastModifiedBy": "user@example.com",
     "deleted": false,
     "findingTypes": [],
     "remediable": false
 },
 "alertRules": [
     {
         "policyScanConfigId": "9612cba4-4f76-44ec-b11f-9c01ba9a4c04",
         "name": "Default Alert Rule",
         "enabled": true,
         "scanAll": true,
         "target": {
             "accountGroups": [],
             "excludedAccounts": [],
             "regions": [],
             "tags": []
         },
         "createdBy": "example@example.com",
         "alertRuleNotificationConfig": [],
         "allowAutoRemediate": false,
         "notifyOnOpen": true,
         "notifyOnSnoozed": false,
         "notifyOnDismissed": false,
         "notifyOnResolved": false
     }
 ],
 "resource": {
     "id": "ID",
     "name": "gke-gke-pc-pool-1-4e52a225-12id",
     "account": "Example-Account",
     "accountId": "ACCOUNT_ID",
     "cloudAccountGroups": [
         "Default Account Group"
     ],
     "region": "US",
     "regionId": "us-central1",
     "resourceType": "INSTANCE",
     "resourceApiName": "gcloud-compute-instances-list",
     "cloudServiceName": "Google Compute Engine",
     "data": {},
     "cloudType": "gcp",
     "resourceTs": 1706915178410,
     "internalResourceId": "INTERNAL_RESOURCE_ID",
     "cloudAccountOwners": [
         "user1@example.com",
         "user2@example.com"
     ],
     "unifiedAssetId": "393924d2b306c07490b19615c6e1a265",
     "resourceConfigJsonAvailable": false,
     "resourceDetailsAvailable": true
 },
 "networkAnomaly": false
}