capabilities.work

Prisma Cloud Alert Triage and Dismissal

A 4-step recipe with Palo Alto Networks. We can help you get access.

Recipe · 4 steps

Prisma Cloud Alert Triage and Dismissal

with Palo Alto Networks · Threat Detection & Response Management

Triage a Prisma Cloud alert from login through dismissal.

  1. Authenticate with access-key credentials and capture the JWT for later steps.
  2. List open alerts of the requested severity over a relative time window, authorizing with the JWT from the login step.
  3. Retrieve the full detail of the first alert returned by the list step.
  4. Dismiss the inspected alert with the supplied dismissal note.
What you'll need to have ready
  • username: Prisma Cloud Access Key ID.
  • password: Prisma Cloud Secret Key for the access key.
  • severity: Alert severity to filter on (critical, high, medium, low, informational).
  • timeAmount: Amount of time units for the relative time window.
  • timeUnit: Time unit for the relative window (minute, hour, day, week, month, year).
  • dismissalNote: Reason recorded when dismissing the alert.
For your developer

Arazzo workflow palo-alto-networks:triage-and-dismiss-alert, 4 operations: login → getAlerts → get-alert → dismiss-alerts. Specs on APIs.io.

More recipes with Palo Alto Networks

Cortex XDR Endpoint Isolation and VerificationCortex XDR Incident Triage and ResolutionCortex XDR Script Remediation with Result PollingCortex XDR XQL Threat HuntCortex XSIAM Incident-Driven Asset and XQL HuntCortex XSOAR Incident Response OrchestrationIoT Security Alert Investigation and ResolutionIoT Security Device Risk and Policy RecommendationPrisma Cloud Policy Review and UpdatePrisma Cloud RQL Configuration and Asset Search