{
  "schema": "aaes/capability-pack/1",
  "provider": "prisma",
  "version": "1.0.0",
  "description": "Prisma Cloud (Palo Alto Networks) Cloud Security API: read alerts, policies, compliance posture and cloud accounts, create alert rules, dismiss or reopen alerts, and remediate an alert.",
  "notes": "The endpoint host 'prisma-cloud-api.invalid' is a reserved non-production placeholder (an RFC 2606 reserved TLD): substitute the tenant's Prisma Cloud API host before enabling, in every endpoint, in the resource locator and in every egress allowlist entry — the allowlist matches exactly, so all three must be substituted together, and substitution is a required deployment step. The API host VARIES by the console stack the tenant is provisioned on (the vendor documents api.prismacloud.io, api2/api3/api4, api.eu, api.gov, api.anz, api.ca, api.sg, api.uk, api.jp and others, each matching a distinct admin console URL); the tenant's order fulfillment email and console URL determine the correct API host, so do not guess it.\n\nThe pack does not create access keys or mint JWTs: an external deployment process creates an access key in the Prisma Cloud console, exchanges the access key id and secret key for a JWT at POST /login, and stores and renews the value described in the credential note. Alert dismissal sits at the minimum R2 tier for update: dismissing or snoozing an alert suppresses a posture or runtime finding, but the change is reversible (dismissed alerts can be reopened), so it is registered as update at R2 with the suppression risk stated in its description and bounded by policy.\n\nAlert remediation sits at R3: for alerts on remediable policies the platform executes a remediation that changes the customer's cloud resources, which is a privileged response action on a third-party estate. Alert rule creation declares create, send and deploy at R3: the retrieved operation reference shows the rule schema admits external notification routing (AlertRuleNotificationConfig to third-party tools or email) and automatic remediation (the required allowAutoRemediate parameter), so an unrestricted rule create is notification-capable and remediation-capable, not a reversible metadata edit.\n\nList-alerts responses cap at 10k results per the vendor documentation; use the V2 paginated variant if the deployment needs more coverage.\n\nDocumented exclusions — this pack does not register: cloud account onboarding, update and offboarding (/cloud writes — offboarding a cloud account removes its monitoring and is not part of this pack), policy create/update/delete, compliance standard and requirement management, alert rule deletion, user, role and permission-group management, access key management APIs, SSO configuration, IP allow list changes, integration create/update (which sends alert data to third parties), and the alert evidence/report download jobs.\n\nThe access-keys API itself (List/Add/Delete/Update Access Key) is deliberately not registered: credential management must stay a human console operation. Vendor deprecation flag: the retrieved compliance-posture operation page (2026-09-21) marks GET /compliance/posture deprecated ('may be replaced or removed in future versions') and limits its data to the past 1 year — the capability is registered against the current contract and must be re-reviewed when the vendor replaces it.",
  "credential": {
    "secret_ref_id": "secret-ref-prisma-jwt",
    "custody": "customer_vault",
    "inject": "header",
    "inject_name": "x-redlock-auth",
    "note": "A Prisma Cloud JWT access token, held in the client's own secret manager. The stored material must be the complete x-redlock-auth header value, which per the vendor's Headers documentation is the JWT itself (no scheme prefix) as returned in the response object of a successful login request.\n\nIssuance is a two-step external flow: an admin creates an access key in the Prisma Cloud console (an access key id plus a secret key — two secret values, themselves stored under their own vault references), and an external deployment process exchanges them at POST /login for the JWT, storing and renewing it under this reference; the injector injects the stored value verbatim and performs no token lifecycle itself, so refresh ownership sits entirely with that external process. JWTs are short-lived and expire; an expired value fails closed.\n\nStated honestly for revocation: the retrieved login and access-keys documentation do not state whether disabling or deleting an access key invalidates already-issued JWTs — the JWT's format alone does not establish that its authorization remains usable until expiry. Deleting the key stops NEW JWT issuance; until the console's invalidation behavior is verified, the deployment must treat any captured JWT as live until expiry and rotate the key on suspicion.\n\nPer the vendor's login documentation, access keys maintain the same level of permissions as the permission group of the account that created them — least privilege therefore means creating the key from a dedicated service account assigned to a minimum permission group (read-only for the read capabilities; a group with alert-dismiss and remediation rights only where those capabilities are enabled), and never from a System Admin's personal account.\n\nThe vendor allows a limited number of access keys per user and supports key expiry dates: use a short key expiry and rotate regularly; an expired access key cannot be reactivated.\n\nExecutor hygiene: the value must live only in executor memory for the lifetime of a call, must never be written to logs, traces or diagnostics, and must not appear in crash dumps; a deployment that cannot meet that bar must not enable the pack."
  },
  "capabilities": [
    {
      "capability_id": "prisma.alerts.read",
      "version": "1.0.0",
      "kind": "tool",
      "risk_tier": "R0",
      "owner": "REPLACE-WITH-ACCOUNTABLE-HUMAN",
      "data_class": "internal",
      "egress_allowlist": [
        "prisma-cloud-api.invalid"
      ],
      "endpoint": "https://prisma-cloud-api.invalid/alert",
      "method": "GET",
      "connector": "http",
      "custody": "customer_vault",
      "secret_ref_id": "secret-ref-prisma-jwt",
      "inject": "header",
      "inject_name": "x-redlock-auth",
      "actions": [
        "read"
      ],
      "resource_id": "prisma-cloud-tenant",
      "description": "List alerts matching query-parameter constraints (status, policy, time range): the tenant's open and historical security alerts. Registered as the collection read; the vendor caps this variant's response at 10k results — the paginated V2 list, single-alert detail (GET /alert/{id}) and alert counts are not registered.\n\nThe host is a reserved placeholder: substitute the tenant's stack-specific API host before enabling.",
      "requires_review": true
    },
    {
      "capability_id": "prisma.policies.read",
      "version": "1.0.0",
      "kind": "tool",
      "risk_tier": "R0",
      "owner": "REPLACE-WITH-ACCOUNTABLE-HUMAN",
      "data_class": "internal",
      "egress_allowlist": [
        "prisma-cloud-api.invalid"
      ],
      "endpoint": "https://prisma-cloud-api.invalid/policy",
      "method": "GET",
      "connector": "http",
      "custody": "customer_vault",
      "secret_ref_id": "secret-ref-prisma-jwt",
      "inject": "header",
      "inject_name": "x-redlock-auth",
      "actions": [
        "read"
      ],
      "resource_id": "prisma-cloud-tenant",
      "description": "List the tenant's policies from the collection endpoint: the misconfiguration, network, identity and anomaly policies (including custom policies) whose violations generate alerts. Registered as the collection read; policy create, update and delete are deliberately not registered.\n\nThe host is a reserved placeholder: substitute before enabling.",
      "requires_review": true
    },
    {
      "capability_id": "prisma.compliance_posture.read",
      "version": "1.0.0",
      "kind": "tool",
      "risk_tier": "R0",
      "owner": "REPLACE-WITH-ACCOUNTABLE-HUMAN",
      "data_class": "internal",
      "egress_allowlist": [
        "prisma-cloud-api.invalid"
      ],
      "endpoint": "https://prisma-cloud-api.invalid/compliance/posture",
      "method": "GET",
      "connector": "http",
      "custody": "customer_vault",
      "secret_ref_id": "secret-ref-prisma-jwt",
      "inject": "header",
      "inject_name": "x-redlock-auth",
      "actions": [
        "read"
      ],
      "resource_id": "prisma-cloud-tenant",
      "description": "Read the tenant's compliance posture: pass/fail posture against compliance standards across the connected cloud accounts. Registered as the posture read; compliance standard management is deliberately not registered. Vendor notice: the retrieved operation reference marks GET /compliance/posture deprecated (it may be replaced or removed in a future API version, and it returns at most the past 1 year of data) — this registration follows the vendor's documented surface as of the review date, and a deployment should plan migration when the vendor publishes the replacement.\n\nThe host is a reserved placeholder: substitute before enabling.",
      "requires_review": true
    },
    {
      "capability_id": "prisma.cloud_accounts.read",
      "version": "1.0.0",
      "kind": "tool",
      "risk_tier": "R0",
      "owner": "REPLACE-WITH-ACCOUNTABLE-HUMAN",
      "data_class": "internal",
      "egress_allowlist": [
        "prisma-cloud-api.invalid"
      ],
      "endpoint": "https://prisma-cloud-api.invalid/cloud",
      "method": "GET",
      "connector": "http",
      "custody": "customer_vault",
      "secret_ref_id": "secret-ref-prisma-jwt",
      "inject": "header",
      "inject_name": "x-redlock-auth",
      "actions": [
        "read"
      ],
      "resource_id": "prisma-cloud-tenant",
      "description": "List the cloud accounts onboarded to the tenant from the collection endpoint: account ids, names and onboarding status across AWS, Azure, GCP, OCI and Alibaba. Registered as the collection read; onboarding, update and offboarding of cloud accounts are deliberately not registered.\n\nThe host is a reserved placeholder: substitute before enabling.",
      "requires_review": true
    },
    {
      "capability_id": "prisma.alert_rule.create",
      "version": "1.0.0",
      "kind": "tool",
      "risk_tier": "R3",
      "owner": "REPLACE-WITH-ACCOUNTABLE-HUMAN",
      "data_class": "internal",
      "egress_allowlist": [
        "prisma-cloud-api.invalid"
      ],
      "endpoint": "https://prisma-cloud-api.invalid/alert/rule",
      "method": "POST",
      "connector": "http",
      "custody": "customer_vault",
      "secret_ref_id": "secret-ref-prisma-jwt",
      "inject": "header",
      "inject_name": "x-redlock-auth",
      "actions": [
        "create",
        "send",
        "deploy"
      ],
      "resource_id": "prisma-cloud-tenant",
      "description": "Create one alert rule: which policies on which account groups generate alerts, and which notification integrations receive them. The retrieved operation reference (POST /alert/rule, retrieved 2026-09-21) shows the request body carries the required allowAutoRemediate parameter (default false) and an AlertRuleNotificationConfig object routing triggered alerts to third-party integrations or email — so an unrestricted rule create can cause external notification delivery (send: alert data leaves the tenant and cannot be recalled after delivery) and can enable automatic remediation of matching alerts against the customer's cloud resources (deploy: live configuration change without any further call).\n\nThe capability declares create, send and deploy at the minimum R3 tier because the registration does not restrict the request body; send and deploy are designated actions requiring human approval.\n\nOn supported AAES-mediated execution paths, irreversible actions require approval by an authorized person; this does not prevent calls through bypass or observation-only paths. Alert rule deletion is deliberately not registered.\n\nThe host is a reserved placeholder: substitute before enabling.",
      "requires_review": true
    },
    {
      "capability_id": "prisma.alerts.dismiss",
      "version": "1.0.0",
      "kind": "tool",
      "risk_tier": "R2",
      "owner": "REPLACE-WITH-ACCOUNTABLE-HUMAN",
      "data_class": "internal",
      "egress_allowlist": [
        "prisma-cloud-api.invalid"
      ],
      "endpoint": "https://prisma-cloud-api.invalid/alert/dismiss",
      "method": "POST",
      "connector": "http",
      "custody": "customer_vault",
      "secret_ref_id": "secret-ref-prisma-jwt",
      "inject": "header",
      "inject_name": "x-redlock-auth",
      "actions": [
        "update"
      ],
      "resource_id": "prisma-cloud-tenant",
      "description": "Dismiss one or more alerts (alert ids in the request body); if the caller specifies a dismissal time range the alerts snooze for that period rather than being dismissed outright. Dismissing or snoozing an alert suppresses a security finding from the active queue; the change is reversible (dismissed alerts can be reopened), so the capability sits at the minimum R2 tier for update with the suppression risk stated here and bounded by policy.\n\nThe tenant can require a dismissal note; whether a note is required is tenant configuration, and this registration does not guarantee one was given.\n\nThe host is a reserved placeholder: substitute before enabling.",
      "requires_review": true
    },
    {
      "capability_id": "prisma.alerts.reopen",
      "version": "1.0.0",
      "kind": "tool",
      "risk_tier": "R2",
      "owner": "REPLACE-WITH-ACCOUNTABLE-HUMAN",
      "data_class": "internal",
      "egress_allowlist": [
        "prisma-cloud-api.invalid"
      ],
      "endpoint": "https://prisma-cloud-api.invalid/alert/reopen",
      "method": "POST",
      "connector": "http",
      "custody": "customer_vault",
      "secret_ref_id": "secret-ref-prisma-jwt",
      "inject": "header",
      "inject_name": "x-redlock-auth",
      "actions": [
        "update"
      ],
      "resource_id": "prisma-cloud-tenant",
      "description": "Set one or more dismissed or snoozed alerts back to open (alert ids in the request body); registered as a reversible update at R2 — it restores visibility rather than removing it.\n\nThe host is a reserved placeholder: substitute before enabling.",
      "requires_review": true
    },
    {
      "capability_id": "prisma.alerts.remediate",
      "version": "1.0.0",
      "kind": "tool",
      "risk_tier": "R3",
      "owner": "REPLACE-WITH-ACCOUNTABLE-HUMAN",
      "data_class": "internal",
      "egress_allowlist": [
        "prisma-cloud-api.invalid"
      ],
      "endpoint": "https://prisma-cloud-api.invalid/alert/remediation/ALERT_ID",
      "method": "PATCH",
      "connector": "http",
      "custody": "customer_vault",
      "secret_ref_id": "secret-ref-prisma-jwt",
      "inject": "header",
      "inject_name": "x-redlock-auth",
      "actions": [
        "deploy"
      ],
      "resource_id": "prisma-cloud-tenant",
      "description": "Remediate the alert with the specified id if it is associated with a remediable policy (PATCH /alert/remediation/:id; ALERT_ID in the path is a placeholder the deployment binds to a concrete alert id before enabling — note the same path without the id, POST /alert/remediation, is a different operation: it only LISTS remediation commands and is not registered). Remediation is not a label change: the platform executes the policy's remediation (via the cloud provider CLI commands surfaced by the remediation-commands endpoint) against the customer's cloud resources, so a single call can change live cloud configuration.\n\nRegistered with the deploy verb at the minimum R3 tier: executing remediation against live cloud configuration is deploy-equivalent under the library convention (compare crowdstrike host containment and dbt run triggers).\n\nThe host is a reserved placeholder: substitute before enabling.",
      "requires_review": true
    }
  ],
  "resources": [
    {
      "resource_id": "prisma-cloud-tenant",
      "kind": "api",
      "locator": "https://prisma-cloud-api.invalid",
      "data_class": "internal",
      "owner": "REPLACE-WITH-ACCOUNTABLE-HUMAN"
    }
  ],
  "review": {
    "state": "library",
    "date": "2026-09-23",
    "sources": [
      "https://pan.dev/prisma-cloud/api/cspm/api-urls/ (retrieved 2026-09-21)",
      "https://pan.dev/prisma-cloud/api/cspm/api-headers/ (retrieved 2026-09-21)",
      "https://pan.dev/prisma-cloud/api/cspm/app-login/ (retrieved 2026-09-21)",
      "https://pan.dev/prisma-cloud/api/cspm/alerts/ (retrieved 2026-09-21)",
      "https://pan.dev/prisma-cloud/api/cspm/access-keys/ (retrieved 2026-09-21)",
      "https://pan.dev/prisma-cloud/api/cspm/add-alert-rule/ (retrieved 2026-09-21)",
      "https://pan.dev/prisma-cloud/api/cspm/get-policies/ (retrieved 2026-09-21)",
      "https://pan.dev/prisma-cloud/api/cspm/get-compliance-posture/ (retrieved 2026-09-21)",
      "https://pan.dev/prisma-cloud/api/cspm/get-cloud-accounts/ (retrieved 2026-09-21)",
      "https://pan.dev/prisma-cloud/api/cspm/dismiss-alerts/ (retrieved 2026-09-21)",
      "https://pan.dev/prisma-cloud/api/cspm/reopen-alerts/ (retrieved 2026-09-21)",
      "https://pan.dev/prisma-cloud/api/cspm/perform-remediation-for-alert/ (retrieved 2026-09-21)",
      "https://pan.dev/prisma-cloud/api/cspm/get-alerts-remediation/ (retrieved 2026-09-21)"
    ],
    "reviewer_id": "aaes-eng"
  }
}