Package: prismacloud-cli
Prisma Cloud CLIThe Prisma Cloud CLI is a command line interface forPrisma CloudbyPalo Alto Networks.Community SupportedThis template/solution is released under an as-is, best effort, support policy. These scripts should be seen as community supported and Palo Alto Networks will contribute our expertise as and when possible. We do not provide technical support or help in using or troubleshooting the components of the project through our normal support options such as Palo Alto Networks support teams, or ASC (Authorized Support Centers) partners and backline support options. The underlying product used (Prisma Cloud) by the scripts or templates are still supported, but the support is only for the product functionality and not for help in deploying or using the template or script itself.Unless explicitly tagged, all projects or work posted in our GitHub repository (athttps://github.com/PaloAltoNetworks) or sites other than our official Downloads page onhttps://support.paloaltonetworks.comare provided under the best effort policy.Getting startedRequirementsPython >= 3.8Pip3Installationpip3installprismacloud-cliInstallation on Alpine:sudopip3install--upgradepip&&pip3install--upgradesetuptools
sudopip3installprismacloud-cliInstallation on Ubuntu:sudoaptupdate
sudoaptinstall-ypython3-venvpython3-pipjq
mkdirpython_virtual_environments/cdpython_virtual_enviornments/
python3-mvenvprisma_cli_envsourceprisma_cli_env/bin/activate
pip3installprismacloud-cliRun the scriptRun the pc cli script. If you don't have a config file yet, it will help you to create one.pc versionThis process looks like the screenshot below. the prismacloud-cli asks you for some details, stores it in the credentials file and uses that file when it is already available.Create your own configurationCreate an access key from Settings then Access key
Get the path to console from Compute tab, System, UtilitiesCreate a file into home directory .prismacloud/credentials.json with the following structure.{"url":"__REDACTED__","identity":"__REDACTED__","secret":"__REDACTED__"}You can add additional configurations which you can call by using --config. For example, create a file
called ~/.prismacloud/demo.json with the contents above.Add--config demoto your cli commands.For example:pc --config demo -o csv policyUse environment variables for configurationBy setting the environment variables:PC_ACCESS_KEY
PC_SAAS_API_ENDPOINT
PC_SECRET_KEYAnd then run pc referring to a configuration called environment:pc --config environment <command>How to use the Prisma Cloud CLI in pipelines (e.g. Github Actions)SeePrisma Cloud CLI in GitHub ActionsHow to enable or disable policies at scale via CSVSeeHow to enable or disable policies at scale via CSVExamplespc -o csv policy
pc -o json policy | jq
pc tags
pc stats dashboard
pc -o json stats dashboard
pc cloud name
pc --columns defendersSummary.host stats dashboardGlobal optionsThe following global options are availableOptions:
  -v, --verbose                   Enables verbose mode.
  -vv, --very_verbose             Enables very verbose mode.
  -o, --output [text|csv|json|html|clipboard|markdown|columns]
  -c, --config TEXT               Select configuration
                                  ~/.prismacloud/[CONFIGURATION].json
  --columns TEXT                  Select columns for output
  --help                          Show this message and exit.Use -o columns to get a list of columns available for --columns, e.g.:pc -o columns images
pc --columns hostname,repoTag.repo,osDistro -o csv images -l 1Environment variablesTo overwrite the default output settings, use environment variables MAX_WIDTH (console output), MAX_ROWS, MAX_COLUMNS and MAX_LINES.MAX_LINES is used to defined the maximum number of lines within a cell when wrapping the contents.CommandsThe cli has several commands to work with, see the screenshot below for an example, but usepc --helpto see the latest list for your version.Use casesLog4J Impacted Resourcespc -o json stats vulnerabilities --cve CVE-2021-44228 | jq
pc stats vulnerabilities --cve CVE-2021-44228Use something similar for getting theSpring Shellimpacted resources.Search scan reports for images scanned by the Jenkins plugin or twistcli.pc scans --helpSelect only specific columns for the output:pc --columns entityInfo.repoTag.registry,entityInfo.repoTag.repo,entityInfo.repoTag.tag,entityInfo.vulnerabilitiesCount scans -l 20 -s nginxYou might also want to add some additional columns and save the output as html:pc --config local -o html --columns entityInfo.repoTag.registry,entityInfo.repoTag.repo,entityInfo.repoTag.tag,entityInfo.vulnerabilitiesCount,entityInfo.vulnerabilityDistribution.critical,entityInfo.vulnerabilityDistribution.high,entityInfo.vulnerabilityDistribution.medium scans -l 20 -s nginx  > /tmp/results.htmlThen, open /tmp/results.html:Enable CSPM policies with Prisma Cloud CLIpc policy set --help
pc -vv policy set --status enable --compliance_standard 'CIS v1.4.0 (AWS)'Disable CSPM policies with Prisma Cloud CLIpc -vv policy set --status disable --compliance_standard 'CIS v1.4.0 (AWS)'Code SecurityThe below examples are using Github as integration but it works as well with other integration:BitbucketGitlabAzureReposGithub EnterpriseGitlab EnterpriseBitbucket EnterpriseCount the number of unique git authors across all Github repositories:pc -ojson repositories count-git-authors -i Github | jq .Get the details of all CVE across all Github repositories:pc -o json repositories search -i Github -c Vulnerabilities -t packageCve --details | jq .Get all secrets across all Github repositories:pc -o json repositories search -i Github -c Secrets -t violation  | jq .Get all drift across all Github repositories:pc repositories search --integration_type Github --categories DriftContainer registriesListing registriesTo list all container registries:pcregistrylistTriggering ScansTo trigger scans on all registries:pcregistryscanIncluding Specific RegistriesTo include specific registries or repositories in the scan:pcregistryscan--include"registry_name/repo_name"--i"another_registry"Excluding Specific RegistriesTo exclude specific registries or repositories from the scan:pcregistryscan--exclude"registry_name/repo_name"--e"another_registry"