id: prisma_cloud
name: Prisma Cloud
version: 1.0.0
description: "Palo Alto Prisma Cloud (CSPM REST API) — cloud posture: list and read alerts, dismiss alerts, list policies and cloud accounts, and run a config (RQL) search. Access-key login authentication; stdlib-only, no extra Python dependencies."
changelog: "1.0.0 — Initial release: list/get alerts, dismiss alerts, list policies, list cloud accounts, config search."
category: cloud

# Per-instance configuration. Each command logs in with the access key ID +
# secret key to obtain a JWT (sent as the 'x-redlock-auth' header).
config_schema:
  properties:
    api_url:
      type: string
      description: "Prisma Cloud API URL (e.g. https://api.prismacloud.io)"
    username:
      type: string
      description: "Access Key ID"
    password:
      type: string
      description: "Secret Key"
      x-soar-sensitive: true
    insecure:
      type: boolean
      description: "Trust any TLS certificate (not secure)"
      default: false
  required:
    - api_url
    - username
    - password

commands:
  - id: list_alerts
    name: prisma-list-alerts
    description: "List alerts in a relative time window."
    risk: read
    inputs_schema:
      properties:
        time_amount: { type: number, description: "Look-back amount (default 24)" }
        time_unit: { type: string, description: "hour, day, week, month, or year (default hour)" }
        status: { type: string, description: "Optional status filter (open, resolved, dismissed)" }
      required: []
    outputs_schema: { properties: {} }
  - id: get_alert
    name: prisma-get-alert
    description: "Get a single alert by ID."
    risk: read
    inputs_schema:
      properties:
        alert_id: { type: string, description: "Alert ID" }
      required: [alert_id]
    outputs_schema: { properties: {} }
  - id: dismiss_alerts
    name: prisma-dismiss-alerts
    description: "Dismiss one or more alerts with a note."
    inputs_schema:
      properties:
        alert_ids: { type: string, description: "Comma-separated alert IDs" }
        note: { type: string, description: "Dismissal note" }
      required: [alert_ids]
    outputs_schema: { properties: {} }
  - id: list_policies
    name: prisma-list-policies
    description: "List policies."
    risk: read
    inputs_schema:
      properties:
        policy_type: { type: string, description: "Optional type filter (config, network, audit_event, ...)" }
      required: []
    outputs_schema: { properties: {} }
  - id: list_cloud_accounts
    name: prisma-list-cloud-accounts
    description: "List onboarded cloud accounts."
    risk: read
    inputs_schema:
      properties: {}
      required: []
    outputs_schema: { properties: {} }
  - id: config_search
    name: prisma-config-search
    description: "Run a config (RQL) search."
    risk: read
    inputs_schema:
      properties:
        query: { type: string, description: "RQL query (e.g. config from cloud.resource where ...)" }
        time_amount: { type: number, description: "Look-back amount (default 24)" }
        time_unit: { type: string, description: "hour, day, week, month (default hour)" }
      required: [query]
    outputs_schema: { properties: {} }

  - id: test_connection
    name: prisma-test-connection
    description: "Verify connectivity and credentials by logging in (used by the Test button)."
    risk: read
    inputs_schema:
      properties: {}
      required: []
    outputs_schema: { properties: {} }