> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cloud-posture-management-rn/cortex-cloud-posture-management-release-information/api-ingestions/september-2026.md). # September 2026 ## New API Ingestions These are the Cortex Cloud API ingestions introduced in the September 2026 release. For the complete list of API ingestions see the [Cortex Cloud Discovery Catalog](https://docs-cortex.paloaltonetworks.com/r/Cortex-Cloud-Discovery-Catalog/Cortex-Cloud-discovery-catalog). | Cloud Service Provider | RIT Name | Service | Permission Required | Asset Type ID | Action | | ---------------------- | -------------------------------------------------------------------------------- | ------------------------ | --------------------------------------------------------------- | ------------------------------------------------------- | --------------------------------------- | | Alibaba Cloud | alibaba-cloud-apsaradb-for-mongodb | dds | dds:DescribeDBInstances | ALIBABA\_CLOUD\_APSARADB\_FOR\_MONGODB | DescribeDBInstances | | Alibaba Cloud | alibaba-cloud-apsaradb-for-mongodb | dds | dds:DescribeDBInstanceAttribute | ALIBABA\_CLOUD\_APSARADB\_FOR\_MONGODB | DescribeDBInstanceAttribute | | Alibaba Cloud | alibaba-cloud-apsaradb-for-mongodb | dds | dds:DescribeSecurityIps | ALIBABA\_CLOUD\_APSARADB\_FOR\_MONGODB | DescribeSecurityIps | | Alibaba Cloud | alibaba-cloud-apsaradb-for-mongodb | dds | dds:DescribeAuditPolicy | ALIBABA\_CLOUD\_APSARADB\_FOR\_MONGODB | DescribeAuditPolicy | | Alibaba Cloud | alibaba-cloud-apsaradb-for-mongodb | dds | dds:DescribeBackupPolicy | ALIBABA\_CLOUD\_APSARADB\_FOR\_MONGODB | DescribeBackupPolicy | | Alibaba Cloud | alibaba-cloud-apsaramq-for-kafka | alikafka | alikafka:ListInstance | ALIBABA\_CLOUD\_APSARAMQ\_FOR\_KAFKA | ListInstance | | Alibaba Cloud | alibaba-cloud-apsaramq-for-kafka | alikafka | alikafka:ListTopic | ALIBABA\_CLOUD\_APSARAMQ\_FOR\_KAFKA | ListTopic | | Alibaba Cloud | alibaba-cloud-apsaramq-for-kafka | alikafka | alikafka:ListGroup | ALIBABA\_CLOUD\_APSARAMQ\_FOR\_KAFKA | ListGroup | | Alibaba Cloud | alibaba-cloud-bastionhost-instance | yundun-bastionhost | yundun-bastionhost:DescribeInstanceBastionhost | ALIBABA\_CLOUD\_BASTION\_HOST\_INSTANCE | DescribeInstanceBastionhost | | Alibaba Cloud | alibaba-cloud-bastionhost-instance | yundun-bastionhost | yundun-bastionhost:DescribeInstanceAttribute | ALIBABA\_CLOUD\_BASTION\_HOST\_INSTANCE | DescribeInstanceAttribute | | Alibaba Cloud | alibaba-cloud-bastionhost-instance | yundun-bastionhost | yundun-bastionhost:ListTagResources | ALIBABA\_CLOUD\_BASTION\_HOST\_INSTANCE | ListTagResources | | Alibaba Cloud | alibaba-cloud-cbn-transit-router-attachment | cbn | cen:ListTransitRouterVpcAttachments | ALIBABA\_CLOUD\_CBN\_TRANSIT\_ROUTER\_ATTACHMENT | ListTransitRouterVpcAttachments | | Alibaba Cloud | alibaba-cloud-cbn-transit-router-attachment | cbn | cen:ListTransitRouterVbrAttachments | ALIBABA\_CLOUD\_CBN\_TRANSIT\_ROUTER\_ATTACHMENT | ListTransitRouterVbrAttachments | | Alibaba Cloud | alibaba-cloud-cbn-transit-router-attachment | cbn | cen:ListTransitRouterPeerAttachments | ALIBABA\_CLOUD\_CBN\_TRANSIT\_ROUTER\_ATTACHMENT | ListTransitRouterPeerAttachments | | Alibaba Cloud | alibaba-cloud-cbn-transit-router-attachment | cbn | cen:ListTransitRouterVpnAttachments | ALIBABA\_CLOUD\_CBN\_TRANSIT\_ROUTER\_ATTACHMENT | ListTransitRouterVpnAttachments | | Alibaba Cloud | alibaba-cloud-cbn-transit-router-attachment | cbn | cen:ListTransitRouterRouteTables | ALIBABA\_CLOUD\_CBN\_TRANSIT\_ROUTER\_ATTACHMENT | ListTransitRouterRouteTables | | Alibaba Cloud | alibaba-cloud-cbn-transit-router-attachment | cbn | cen:ListTransitRouterRouteTableAssociations | ALIBABA\_CLOUD\_CBN\_TRANSIT\_ROUTER\_ATTACHMENT | ListTransitRouterRouteTableAssociations | | Alibaba Cloud | alibaba-cloud-cbn-transit-router-attachment | cbn | cen:ListTransitRouterRouteTablePropagations | ALIBABA\_CLOUD\_CBN\_TRANSIT\_ROUTER\_ATTACHMENT | ListTransitRouterRouteTablePropagations | | Alibaba Cloud | alibaba-cloud-data-transmission-job | dts | dts:DescribeDtsJobs | ALIBABA\_CLOUD\_DATA\_TRANSMISSION\_JOB | DescribeDtsJobs | | Alibaba Cloud | alibaba-cloud-dns-domain | alidns | alidns:DescribeDomains | ALIBABA\_CLOUD\_DNS\_DOMAIN | DescribeDomains | | Alibaba Cloud | alibaba-cloud-dns-domain | alidns | alidns:DescribeDomainDnssecInfo | ALIBABA\_CLOUD\_DNS\_DOMAIN | DescribeDomainDnssecInfo | | Alibaba Cloud | alibaba-cloud-dns-record | alidns | alidns:DescribeDomainRecords | ALIBABA\_CLOUD\_DNS\_RECORD | DescribeDomainRecords | | Alibaba Cloud | alibaba-cloud-eiam-conditional-access-policy | eiam | eiam:ListConditionalAccessPolicies | ALIBABA\_CLOUD\_EIAM\_CONDITIONAL\_ACCESS\_POLICY | ListConditionalAccessPolicies | | Alibaba Cloud | alibaba-cloud-hbr-vault | hbr | hbr:DescribeVaults | ALIBABA\_CLOUD\_HBR\_VAULT | DescribeVaults | | Alibaba Cloud | alibaba-cloud-hbr-vault | hbr | hbr:DescribeBackupPlans | ALIBABA\_CLOUD\_HBR\_VAULT | DescribeBackupPlans | | Alibaba Cloud | alibaba-cloud-privatelink-vpc-endpoint | privatelink | privatelink:ListVpcEndpoints | ALIBABA\_CLOUD\_PRIVATELINK\_VPC\_ENDPOINT | ListVpcEndpoints | | Alibaba Cloud | alibaba-cloud-privatelink-vpc-endpoint | privatelink | privatelink:ListVpcEndpointSecurityGroups | ALIBABA\_CLOUD\_PRIVATELINK\_VPC\_ENDPOINT | ListVpcEndpointSecurityGroups | | Alibaba Cloud | alibaba-cloud-privatelink-vpc-endpoint | privatelink | privatelink:ListVpcEndpointZones | ALIBABA\_CLOUD\_PRIVATELINK\_VPC\_ENDPOINT | ListVpcEndpointZones | | Alibaba Cloud | alibaba-cloud-privatelink-vpc-endpoint-service | privatelink | privatelink:ListVpcEndpointServices | ALIBABA\_CLOUD\_PRIVATELINK\_VPC\_ENDPOINT\_SERVICE | ListVpcEndpointServices | | AWS | aws-sagemaker-model-card | sagemaker | sagemaker:ListModelCards | AMAZON\_SAGEMAKER\_MODEL\_CARD | ListModelCards | | AWS | aws-sagemaker-model-card | sagemaker | sagemaker:DescribeModelCard | AMAZON\_SAGEMAKER\_MODEL\_CARD | DescribeModelCard | | AWS | aws-sagemaker-model-card | sagemaker | sagemaker:ListTags | AMAZON\_SAGEMAKER\_MODEL\_CARD | ListTags | | AWS | aws-apigateway-client-certificate | apigateway | apigateway:GET | AWS\_API\_GATEWAY\_CLIENT\_CERTIFICATE | GET | | AWS | aws-datazone-environment | datazone | datazone:ListEnvironments | AWS\_DATAZONE\_ENVIRONMENT | ListEnvironments | | AWS | aws-datazone-environment-blueprint-configuration | datazone | datazone:ListEnvironmentBlueprintConfigurations | AWS\_DATAZONE\_ENVIRONMENT\_BLUEPRINT\_CONFIGURATION | ListEnvironmentBlueprintConfigurations | | AWS | aws-ec2-verified-access-endpoint | ec2 | ec2:DescribeVerifiedAccessEndpoints | AWS\_EC2\_VERIFIED\_ACCESS\_ENDPOINT | DescribeVerifiedAccessEndpoints | | AWS | aws-ec2-verified-access-instance | ec2 | ec2:DescribeVerifiedAccessInstances | AWS\_EC2\_VERIFIED\_ACCESS\_INSTANCE | DescribeVerifiedAccessInstances | | AWS | aws-ec2-verified-access-trust-provider | ec2 | ec2:DescribeVerifiedAccessTrustProviders | AWS\_EC2\_VERIFIED\_ACCESS\_TRUST\_PROVIDER | DescribeVerifiedAccessTrustProviders | | AWS | aws-s3-bucket-replication | s3 | s3:GetReplicationConfiguration | AWS\_S3\_BUCKET\_REPLICATION | GetReplicationConfiguration | | AWS | aws-sagemaker-experiment | sagemaker | sagemaker:ListExperiments | AWS\_SAGEMAKER\_EXPERIMENT | ListExperiments | | AWS | aws-sagemaker-experiment | sagemaker | sagemaker:DescribeExperiment | AWS\_SAGEMAKER\_EXPERIMENT | DescribeExperiment | | AWS | aws-sagemaker-experiment | sagemaker | sagemaker:ListTags | AWS\_SAGEMAKER\_EXPERIMENT | ListTags | | AWS | aws-sagemaker-model-package | sagemaker | sagemaker:ListModelPackages | AWS\_SAGEMAKER\_MODEL\_PACKAGE | ListModelPackages | | AWS | aws-sagemaker-model-package | sagemaker | sagemaker:DescribeModelPackage | AWS\_SAGEMAKER\_MODEL\_PACKAGE | DescribeModelPackage | | AWS | aws-sagemaker-model-package | sagemaker | sagemaker:ListTags | AWS\_SAGEMAKER\_MODEL\_PACKAGE | ListTags | | Azure | azure-data-factory-v2-private-endpoint-connection | Microsoft.DataFactory | Microsoft.DataFactory/factories/privateEndpointConnections/read | AZURE\_DATA\_FACTORY\_V2\_PRIVATE\_ENDPOINT\_CONNECTION | read | | Azure | azure-documentdb-mongo-clusters | Microsoft.DocumentDB | Microsoft.DocumentDB/mongoClusters/read | AZURE\_DOCUMENT\_DB\_MONGO\_CLUSTERS | read | | Azure | azure-monitor-private-link-scope | Microsoft.Insights | Microsoft.Insights/PrivateLinkScopes/ScopedResources/Read | AZURE\_MONITOR\_PRIVATE\_LINK\_SCOPE | Read | | Azure | azure-monitor-private-link-scope | Microsoft.Insights | Microsoft.Insights/PrivateLinkScopes/Read | AZURE\_MONITOR\_PRIVATE\_LINK\_SCOPE | Read | | Azure | azure-saas-resource | Microsoft.ResourceGraph | Microsoft.ResourceGraph/resources/read | AZURE\_SAAS\_RESOURCE | read | | GCP | gcloud-dataproc-metastore-service | metastore | metastore.services.getIamPolicy | DATAPROC\_METASTORE\_SERVICE | getIamPolicy | | GCP | gcloud-dataproc-metastore-service | metastore | metastore.services.list | DATAPROC\_METASTORE\_SERVICE | list | | GCP | gcloud-dataproc-metastore-federation | metastore | metastore.federations.getIamPolicy | DATAPROC\_METASTORE\_FEDERATION | getIamPolicy | | GCP | gcloud-dataproc-metastore-federation | metastore | metastore.federations.list | DATAPROC\_METASTORE\_FEDERATION | list | | GCP | gcloud-ai-applications-cmek-config | discoveryengine | discoveryengine.cmekConfigs.list | GCLOUD\_AI\_APPLICATIONS\_CMEK\_CONFIG | list | | GCP | gcloud-security-command-center-organization-event-threat-detection-custom-module | securitycentermanagement | securitycentermanagement.eventThreatDetectionCustomModules.list | GOOGLE\_SCC\_EVENT\_THREAT\_DETECTION\_CUSTOM\_MODULE | list | ## Updated API Ingestions These are the Cortex Cloud API ingestions introduced in the September 2026 release. For the complete list of API ingestions see the [Cortex Cloud Discovery Catalog](https://docs-cortex.paloaltonetworks.com/r/Cortex-Cloud-Discovery-Catalog/Cortex-Cloud-discovery-catalog). | Cloud Service Provider | RIT Name | Service | Permission Required | Asset Type ID | Action | | ---------------------- | ------------------------------------------------------ | ----------------------- | -------------------------------------------------------------- | --------------------------------------------------------- | ---------------------------------------- | | Alibaba Cloud | alibaba-cloud-ecs-instance | ecs | ecs:DescribeInstances | ALIBABA\_CLOUD\_ECS\_INSTANCE | DescribeInstances | | Alibaba Cloud | alibaba-cloud-ecs-instance | ecs | ecs:DescribeInstanceRamRole | ALIBABA\_CLOUD\_ECS\_INSTANCE | DescribeInstanceRamRole | | Alibaba Cloud | alibaba-cloud-ecs-disk | ecs | ecs:DescribeDisks | ALIBABA\_CLOUD\_DISK | DescribeDisks | | Alibaba Cloud | alibaba-cloud-eiam-instance | eiam | eiam:ListInstances | ALIBABA\_CLOUD\_EIAM\_INSTANCE | ListInstances | | Alibaba Cloud | alibaba-cloud-eiam-instance | eiam | eiam:GetPasswordComplexityConfiguration | ALIBABA\_CLOUD\_EIAM\_INSTANCE | GetPasswordComplexityConfiguration | | Alibaba Cloud | alibaba-cloud-eiam-instance | eiam | eiam:GetPasswordExpirationConfiguration | ALIBABA\_CLOUD\_EIAM\_INSTANCE | GetPasswordExpirationConfiguration | | Alibaba Cloud | alibaba-cloud-eiam-instance | eiam | eiam:GetInstanceControlConfiguration | ALIBABA\_CLOUD\_EIAM\_INSTANCE | GetInstanceControlConfiguration | | Alibaba Cloud | alibaba-cloud-enterprise-network | cen | cen:DescribeCens | ALIBABA\_CLOUD\_ENTERPRISE\_NETWORK | DescribeCens | | Alibaba Cloud | alibaba-cloud-enterprise-network | cen | cen:DescribeCenInterRegionBandwidthLimits | ALIBABA\_CLOUD\_ENTERPRISE\_NETWORK | DescribeCenInterRegionBandwidthLimits | | AWS | aws-api-gateway-authorizer | apigateway | apigateway:GET | AMAZON\_API\_GATEWAY\_AUTHORIZER | GET | | AWS | aws-apigateway-get-rest-apis | apigateway | apigateway:GET | AMAZON\_API\_GATEWAY\_REST\_API | GET | | AWS | aws-apigateway-get-stages | apigateway | apigateway:GET | AMAZON\_API\_GATEWAY\_REST\_API\_STAGE | GET | | AWS | aws-apigateway-method | apigateway | apigateway:GET | AMAZON\_API\_GATEWAY\_METHOD | GET | | AWS | aws-apigateway-spec-export | apigateway | apigateway:GET | AWS\_STAGE\_SPEC | GET | | AWS | aws-apigatewayv2-api | apigateway | apigateway:GET | AWS\_APIGATEWAYV2\_API | GET | | AWS | aws-apigatewayv2-route | apigateway | apigateway:GET | AWS\_API\_GATEWAYV2\_ROUTE | GET | | AWS | aws-apigatewayv2-stage | apigateway | apigateway:GET | AWS\_APIGATEWAYV2\_STAGE | GET | | AWS | aws-athena-workgroup | athena | athena:ListWorkGroups | AMAZON\_ATHENA\_WORKGROUP | ListWorkGroups | | AWS | aws-athena-workgroup | athena | athena:GetWorkGroup | AMAZON\_ATHENA\_WORKGROUP | GetWorkGroup | | AWS | aws-budgets-budget | budgets | budgets:ViewBudget | AWS\_BUDGETS\_BUDGET | ViewBudget | | AWS | aws-cloudfront-list-distributions | cloudfront | cloudfront:ListDistributions | CLOUDFRONT\_DISTRIBUTION | ListDistributions | | AWS | aws-cloudfront-list-distributions | cloudfront | cloudfront:GetDistributionConfig | CLOUDFRONT\_DISTRIBUTION | GetDistributionConfig | | AWS | aws-cloudfront-list-distributions | cloudfront | cloudfront:ListTagsForResource | CLOUDFRONT\_DISTRIBUTION | ListTagsForResource | | AWS | aws-cloudfront-origin-access-control | cloudfront | cloudfront:ListOriginAccessControls | AMAZON\_CLOUDFRONT\_ORIGIN\_ACCESS\_CONTROL | ListOriginAccessControls | | AWS | aws-cloudfront-response-headers-policy | cloudfront | cloudfront:ListResponseHeadersPolicies | AMAZON\_CLOUDFRONT\_RESPONSE\_HEADERS\_POLICY | ListResponseHeadersPolicies | | AWS | aws-cloudfront-response-headers-policy | cloudfront | cloudfront:GetResponseHeadersPolicy | AMAZON\_CLOUDFRONT\_RESPONSE\_HEADERS\_POLICY | GetResponseHeadersPolicy | | AWS | aws-cloudwatch-insight-rule | cloudwatch | cloudwatch:DescribeInsightRules | AMAZON\_CLOUDWATCH\_INSIGHT\_RULE | DescribeInsightRules | | AWS | aws-cloudwatch-insight-rule | cloudwatch | cloudwatch:ListTagsForResource | AMAZON\_CLOUDWATCH\_INSIGHT\_RULE | ListTagsForResource | | AWS | aws-code-build-report-group | codebuild | codebuild:BatchGetReportGroups | AWS\_CODE\_BUILD\_REPORT\_GROUP | BatchGetReportGroups | | AWS | aws-code-build-report-group | codebuild | codebuild:ListReportGroups | AWS\_CODE\_BUILD\_REPORT\_GROUP | ListReportGroups | | AWS | aws-code-commit-repository | codecommit | codecommit:ListRepositories | AWS\_CODE\_COMMIT\_REPOSITORY | ListRepositories | | AWS | aws-code-commit-repository | codecommit | codecommit:GetRepository | AWS\_CODE\_COMMIT\_REPOSITORY | GetRepository | | AWS | aws-code-deploy-application | codedeploy | codedeploy:ListApplications | AWS\_CODE\_DEPLOY\_APPLICATION | ListApplications | | AWS | aws-code-deploy-application | codedeploy | codedeploy:BatchGetApplications | AWS\_CODE\_DEPLOY\_APPLICATION | BatchGetApplications | | AWS | aws-code-deploy-application | codedeploy | codedeploy:ListTagsForResource | AWS\_CODE\_DEPLOY\_APPLICATION | ListTagsForResource | | AWS | aws-cognito-sync-pool-usage | cognito-sync | cognito-sync:ListIdentityPoolUsage | AMAZON\_COGNITO\_SYNC\_POOL\_USAGE | ListIdentityPoolUsage | | AWS | aws-comprehend-document-classifier-summary | comprehend | comprehend:ListDocumentClassifiers | AMAZON\_COMPREHEND\_DOCUMENT\_CLASSIFIER\_SUMMARY | ListDocumentClassifiers | | AWS | aws-configservice-describe-configuration-recorders | config | config:DescribeConfigurationRecorders | AWS\_CONFIG\_SERVICE\_CONFIGURATION\_RECORDER | DescribeConfigurationRecorders | | AWS | aws-configservice-describe-configuration-recorders | config | config:DescribeConfigurationRecorderStatus | AWS\_CONFIG\_SERVICE\_CONFIGURATION\_RECORDER | DescribeConfigurationRecorderStatus | | AWS | aws-datazone-data-source | datazone | datazone:ListDataSources | AWS\_DATAZONE\_DATA\_SOURCE | ListDataSources | | AWS | aws-datazone-domain | datazone | datazone:ListDomains | AWS\_DATAZONE\_DOMAIN | ListDomains | | AWS | aws-dax-parameter-group | dax | dax:DescribeParameterGroups | AMAZON\_DAX\_PARAMETER\_GROUP | DescribeParameterGroups | | AWS | aws-describe-account-attributes | ec2 | ec2:DescribeAccountAttributes | AWS\_EC2\_ACCOUNT\_ATTRIBUTE | DescribeAccountAttributes | | AWS | aws-describe-delivery-channels | config | config:DescribeDeliveryChannels | AWS\_CONFIG\_SERVICE\_DELIVERY\_CHANNEL | DescribeDeliveryChannels | | AWS | aws-describe-mount-targets | elasticfilesystem | elasticfilesystem:DescribeMountTargets | AWS\_EFS\_MOUNT\_TARGET | DescribeMountTargets | | AWS | aws-describe-vpc-endpoints | ec2 | ec2:DescribeVpcEndpoints | AWS\_VPC\_ENDPOINT | DescribeVpcEndpoints | | AWS | aws-describe-workspace-directories | workspaces | workspaces:DescribeWorkspaceDirectories | AWS\_WORKSPACE\_DIRECTORY | DescribeWorkspaceDirectories | | AWS | aws-ds-directory | ds | ds:DescribeDirectories | AWS\_DIRECTORY\_SERVICE | DescribeDirectories | | AWS | aws-ec2-customer-gateway | ec2 | ec2:DescribeCustomerGateways | AWS\_CUSTOMER\_GATEWAY | DescribeCustomerGateways | | AWS | aws-ec2-describe-flow-logs | ec2 | ec2:DescribeFlowLogs | AWS\_EC2\_FLOW\_LOG | DescribeFlowLogs | | AWS | aws-ec2-describe-images | ec2 | ec2:DescribeImages | AWS\_EC2\_IMAGE | DescribeImages | | AWS | aws-ec2-describe-internet-gateways | ec2 | ec2:DescribeInternetGateways | AWS\_INTERNET\_GATEWAY | DescribeInternetGateways | | AWS | aws-ec2-describe-network-acls | ec2 | ec2:DescribeNetworkAcls | AWS\_EC2\_NETWORK\_ACL | DescribeNetworkAcls | | AWS | aws-ec2-describe-network-interfaces | ec2 | ec2:DescribeNetworkInterfaces | AWS\_EC2\_NETWORK\_INTERFACE | DescribeNetworkInterfaces | | AWS | aws-ec2-describe-route-tables | ec2 | ec2:DescribeRouteTables | AWS\_EC2\_ROUTE\_TABLE | DescribeRouteTables | | AWS | aws-ec2-describe-vpc-peering-connections | ec2 | ec2:DescribeVpcPeeringConnections | AWS\_VPC\_PEERING\_CONNECTION | DescribeVpcPeeringConnections | | AWS | aws-ec2-describe-vpcs | ec2 | ec2:DescribeVpcs | AWS\_VPC | DescribeVpcs | | AWS | aws-ec2-describe-vpn-connections | ec2 | ec2:DescribeVpnConnections | AWS\_VPN\_CONNECTION | DescribeVpnConnections | | AWS | aws-ec2-describe-vpn-gateways | ec2 | ec2:DescribeVpnGateways | AWS\_VPN\_GATEWAY | DescribeVpnGateways | | AWS | aws-ec2-elastic-address | ec2 | ec2:DescribeAddresses | AWS\_EIP | DescribeAddresses | | AWS | aws-ec2-key-pair | ec2 | ec2:DescribeKeyPairs | AWS\_EC2\_KEY\_PAIR | DescribeKeyPairs | | AWS | aws-ec2-launch-template-data | ec2 | ec2:DescribeLaunchTemplates | AWS\_EC2\_LAUNCH\_TEMPLATE | DescribeLaunchTemplates | | AWS | aws-ec2-launch-template | ec2 | ec2:DescribeLaunchTemplates | AWS\_EC2\_LAUNCH\_TEMPLATE | DescribeLaunchTemplates | | AWS | aws-ec2-vpc-endpoint-service-configuration | ec2 | ec2:DescribeVpcEndpointServiceConfigurations | AWS\_EC2\_VPC\_ENDPOINT\_SERVICE\_CONFIGURATION | DescribeVpcEndpointServiceConfigurations | | AWS | aws-ec2-vpc-endpoint-service-permission | ec2 | ec2:DescribeVpcEndpointServicePermissions | AWS\_VPC\_ENDPOINT\_SERVICE\_PERMISSIONS | DescribeVpcEndpointServicePermissions | | AWS | aws-ec2-vpc-endpoint-service | ec2 | ec2:DescribeVpcEndpointServices | AWS\_VPC\_ENDPOINT\_SERVICE | DescribeVpcEndpointServices | | AWS | aws-ec2-vpc-stats | ec2 | ec2:DescribeVpcs | AWS\_VPC | DescribeVpcs | | AWS | aws-ecr-image | ecr | ecr:DescribeRepositories | AWS\_ECR\_IMAGE | DescribeRepositories | | AWS | aws-ecr-image | ecr | ecr:DescribeImages | AWS\_ECR\_IMAGE | DescribeImages | | AWS | aws-ecr-registry | ecr | ecr:DescribeRegistry | AWS\_ECR\_REGISTRY | DescribeRegistry | | AWS | aws-elasticache-cache-clusters | elasticache | elasticache:DescribeCacheClusters | AWS\_ELASTICACHE\_CACHE\_CLUSTER | DescribeCacheClusters | | AWS | aws-elasticache-describe-replication-groups | elasticache | elasticache:DescribeReplicationGroups | AWS\_ELASTICACHE\_REPLICATION\_GROUP | DescribeReplicationGroups | | AWS | aws-elbv2-target-health | elasticloadbalancing | elasticloadbalancing:DescribeTargetGroups | AWS\_ELBV2\_TARGET\_HEALTH | DescribeTargetGroups | | AWS | aws-elbv2-target-health | elasticloadbalancing | elasticloadbalancing:DescribeTargetHealth | AWS\_ELBV2\_TARGET\_HEALTH | DescribeTargetHealth | | AWS | aws-emr-security-configuration | elasticmapreduce | elasticmapreduce:ListSecurityConfigurations | AWS\_EMR\_SECURITY\_CONFIGURATION | ListSecurityConfigurations | | AWS | aws-es-describe-elasticsearch-domain | es | es:ListDomainNames | AWS\_ES\_DOMAIN | ListDomainNames | | AWS | aws-es-describe-elasticsearch-domain | es | es:DescribeElasticsearchDomains | AWS\_ES\_DOMAIN | DescribeElasticsearchDomains | | AWS | aws-glue-connection | glue | glue:GetConnections | AWS\_GLUE\_CONNECTION | GetConnections | | AWS | aws-glue-crawler | glue | glue:GetCrawlers | AWS\_GLUE\_CRAWLER | GetCrawlers | | AWS | aws-glue-job | glue | glue:GetJobs | AWS\_GLUE\_JOB | GetJobs | | AWS | aws-glue-security-configuration | glue | glue:GetSecurityConfigurations | AWS\_GLUE\_SECURITY\_CONFIGURATION | GetSecurityConfigurations | | AWS | aws-iam-list-access-keys | iam | iam:ListUsers | AWS\_IAM\_ACCESS\_KEY | ListUsers | | AWS | aws-iam-list-access-keys | iam | iam:ListAccessKeys | AWS\_IAM\_ACCESS\_KEY | ListAccessKeys | | AWS | aws-iam-list-ssh-public-keys | iam | iam:ListUsers | AWS\_IAM\_USER\_SSH\_PUBLIC\_KEY | ListUsers | | AWS | aws-iam-list-ssh-public-keys | iam | iam:ListSSHPublicKeys | AWS\_IAM\_USER\_SSH\_PUBLIC\_KEY | ListSSHPublicKeys | | AWS | aws-iam-list-user-policies | iam | iam:ListUsers | AWS\_IAM\_USER\_POLICY | ListUsers | | AWS | aws-iam-list-user-policies | iam | iam:ListUserPolicies | AWS\_IAM\_USER\_POLICY | ListUserPolicies | | AWS | aws-inspector-v2-coverage | inspector2 | inspector2:ListCoverage | AWS\_INSPECTOR\_V2\_COVERAGE | ListCoverage | | AWS | aws-kms-get-key-rotation-status | kms | kms:ListKeys | AWS\_KMS\_KEY\_ROTATION\_STATUS | ListKeys | | AWS | aws-kms-get-key-rotation-status | kms | kms:GetKeyRotationStatus | AWS\_KMS\_KEY\_ROTATION\_STATUS | GetKeyRotationStatus | | AWS | aws-lexv2-bot | lex | lex:ListBots | AWS\_LEXV2\_BOT | ListBots | | AWS | aws-logs-describe-metric-filters | logs | logs:DescribeMetricFilters | AWS\_LOG\_METRIC\_FILTER | DescribeMetricFilters | | AWS | aws-mediastore-container | mediastore | mediastore:ListContainers | AWS\_MEDIASTORE\_CONTAINER | ListContainers | | AWS | aws-mediastore-container | mediastore | mediastore:GetContainerPolicy | AWS\_MEDIASTORE\_CONTAINER | GetContainerPolicy | | AWS | aws-mq-broker | mq | mq:ListBrokers | AMAZON\_MQ\_BROKER | ListBrokers | | AWS | aws-opsworks-user-profiles | opsworks | opsworks:DescribeUserProfiles | AWS\_OPSWORKS\_USER\_PROFILE | DescribeUserProfiles | | AWS | aws-pinpoint-email-channel | pinpoint | pinpoint:GetEmailChannel | AWS\_PINPOINT\_EMAIL\_CHANNEL | GetEmailChannel | | AWS | aws-pinpoint-sms-channel | pinpoint | pinpoint:GetSmsChannel | AWS\_PINPOINT\_SMS\_CHANNEL | GetSmsChannel | | AWS | aws-quicksight-account-setting | quicksight | quicksight:DescribeAccountSettings | AWS\_QUICKSIGHT\_ACCOUNT\_SETTING | DescribeAccountSettings | | AWS | aws-rds-describe-event-subscriptions | rds | rds:DescribeEventSubscriptions | AWS\_RDS\_EVENT\_SUBSCRIPTION | DescribeEventSubscriptions | | AWS | aws-route53-domain | route53domains | route53domains:ListDomains | AWS\_ROUTE53\_DOMAIN | ListDomains | | AWS | aws-route53-health-check | route53 | route53:ListHealthChecks | AWS\_ROUTE53\_HEALTH\_CHECK | ListHealthChecks | | AWS | aws-route53-query-logging-config | route53 | route53:ListQueryLoggingConfigs | AWS\_ROUTE53\_QUERY\_LOGGING\_CONFIG | ListQueryLoggingConfigs | | AWS | aws-route53resolver-query-logging-config-association | route53resolver | route53resolver:ListResolverQueryLogConfigAssociations | AWS\_ROUTE53RESOLVER\_QUERY\_LOGGING\_CONFIG\_ASSOCIATION | ListResolverQueryLogConfigAssociations | | AWS | aws-s3api-get-bucket-acl | s3 | s3:ListAllMyBuckets | AWS\_S3\_BUCKET\_ACL | ListAllMyBuckets | | AWS | aws-s3api-get-bucket-acl | s3 | s3:GetBucketAcl | AWS\_S3\_BUCKET\_ACL | GetBucketAcl | | AWS | aws-sagemaker-endpoint | sagemaker | sagemaker:ListEndpoints | AWS\_SAGEMAKER\_ENDPOINT | ListEndpoints | | AWS | aws-sagemaker-endpoint | sagemaker | sagemaker:DescribeEndpoint | AWS\_SAGEMAKER\_ENDPOINT | DescribeEndpoint | | AWS | aws-sagemaker-model | sagemaker | sagemaker:ListModels | AWS\_SAGEMAKER\_MODEL | ListModels | | AWS | aws-sagemaker-model | sagemaker | sagemaker:DescribeModel | AWS\_SAGEMAKER\_MODEL | DescribeModel | | AWS | aws-ses-configuration-set | ses | ses:ListConfigurationSets | AWS\_SES\_CONFIGURATION\_SET | ListConfigurationSets | | AWS | aws-ssm-association | ssm | ssm:ListAssociations | AWS\_SSM\_ASSOCIATION | ListAssociations | | AWS | aws-ssm-document | ssm | ssm:ListDocuments | AWS\_SSM\_DOCUMENT | ListDocuments | | AWS | aws-ssm-parameter | ssm | ssm:DescribeParameters | AWS\_SSM\_PARAMETER | DescribeParameters | | AWS | aws-storage-gateway-information | storagegateway | storagegateway:ListGateways | AWS\_STORAGE\_GATEWAY | ListGateways | | AWS | aws-storage-gateway-information | storagegateway | storagegateway:DescribeGatewayInformation | AWS\_STORAGE\_GATEWAY | DescribeGatewayInformation | | AWS | aws-storage-gateway-information | storagegateway | storagegateway:DescribeSMBSettings | AWS\_STORAGE\_GATEWAY | DescribeSMBSettings | | AWS | aws-trusted-advisor-check-result | support | support:DescribeTrustedAdvisorChecks | AWS\_TRUSTED\_ADVISOR\_CHECK\_RESULT | DescribeTrustedAdvisorChecks | | AWS | aws-vpc-dhcp-options | ec2 | ec2:DescribeDhcpOptions | AWS\_DHCP\_OPTIONS | DescribeDhcpOptions | | AWS | aws-vpc-nat-gateway | ec2 | ec2:DescribeNatGateways | AWS\_NAT\_GATEWAY | DescribeNatGateways | | AWS | aws-vpc-transit-gateway-attachment | ec2 | ec2:DescribeTransitGatewayAttachments | AWS\_TRANSIT\_GATEWAY\_ATTACHMENT | DescribeTransitGatewayAttachments | | AWS | aws-vpc-transit-gateway-route-table | ec2 | ec2:DescribeTransitGatewayRouteTables | AWS\_TRANSIT\_GATEWAY\_ROUTE\_TABLE | DescribeTransitGatewayRouteTables | | AWS | aws-waf-classic-global-ip-set | waf | waf:ListIPSets | AWS\_WAF\_CLASSIC\_GLOBAL\_IP\_SET | ListIPSets | | AWS | aws-waf-classic-regional-ip-set | waf-regional | waf-regional:ListIPSets | AWS\_WAF\_CLASSIC\_REGIONAL\_IP\_SET | ListIPSets | | AWS | aws-workspace-ip-group | workspaces | workspaces:DescribeWorkspaceIpGroups | AWS\_WORKSPACE\_IP\_GROUP | DescribeWorkspaceIpGroups | | AWS | eai-aws-apigateway-get-rest-apis | apigateway | apigateway:GET | AMAZON\_API\_GATEWAY\_REST\_API | GET | | AWS | eai-aws-apigateway-get-stages | apigateway | apigateway:GET | AMAZON\_API\_GATEWAY\_REST\_API\_STAGE | GET | | AWS | eai-aws-apigateway-method | apigateway | apigateway:GET | AMAZON\_API\_GATEWAY\_METHOD | GET | | AWS | eai-aws-cloudfront-list-distributions | cloudfront | cloudfront:GetDistribution | CLOUDFRONT\_DISTRIBUTION | GetDistribution | | AWS | eai-aws-cloudfront-list-distributions | cloudfront | cloudfront:ListTagsForResource | CLOUDFRONT\_DISTRIBUTION | ListTagsForResource | | AWS | eai-aws-configservice-describe-configuration-recorders | config | config:DescribeConfigurationRecorders | AWS\_CONFIG\_SERVICE\_CONFIGURATION\_RECORDER | DescribeConfigurationRecorders | | AWS | eai-aws-configservice-describe-configuration-recorders | config | config:DescribeConfigurationRecorderStatus | AWS\_CONFIG\_SERVICE\_CONFIGURATION\_RECORDER | DescribeConfigurationRecorderStatus | | AWS | eai-aws-describe-mount-targets | elasticfilesystem | elasticfilesystem:DescribeMountTargets | AWS\_EFS\_MOUNT\_TARGET | DescribeMountTargets | | AWS | eai-aws-describe-vpc-endpoints | ec2 | ec2:DescribeVpcEndpoints | AWS\_VPC\_ENDPOINT | DescribeVpcEndpoints | | AWS | eai-aws-ec2-describe-flow-logs | ec2 | ec2:DescribeFlowLogs | AWS\_EC2\_FLOW\_LOG | DescribeFlowLogs | | AWS | eai-aws-ec2-describe-images | ec2 | ec2:DescribeImages | AWS\_EC2\_IMAGE | DescribeImages | | AWS | eai-aws-ec2-describe-instances | ec2 | ec2:DescribeInstances | AWS\_EC2\_INSTANCE | DescribeInstances | | AWS | eai-aws-ec2-describe-internet-gateways | ec2 | ec2:DescribeInternetGateways | AWS\_INTERNET\_GATEWAY | DescribeInternetGateways | | AWS | eai-aws-ec2-describe-network-acls | ec2 | ec2:DescribeNetworkAcls | AWS\_EC2\_NETWORK\_ACL | DescribeNetworkAcls | | AWS | eai-aws-ec2-describe-network-interfaces | ec2 | ec2:DescribeNetworkInterfaces | AWS\_EC2\_NETWORK\_INTERFACE | DescribeNetworkInterfaces | | AWS | eai-aws-ec2-describe-route-tables | ec2 | ec2:DescribeRouteTables | AWS\_EC2\_ROUTE\_TABLE | DescribeRouteTables | | AWS | eai-aws-ec2-describe-security-groups | ec2 | ec2:DescribeSecurityGroups | AWS\_EC2\_SECURITY\_GROUP | DescribeSecurityGroups | | AWS | eai-aws-ec2-describe-snapshots | ec2 | ec2:DescribeSnapshots | AWS\_EBS\_SNAPSHOT | DescribeSnapshots | | AWS | eai-aws-ec2-describe-subnets | ec2 | ec2:DescribeSubnets | AWS\_SUBNET | DescribeSubnets | | AWS | eai-aws-ec2-describe-volumes | ec2 | ec2:DescribeVolumes | AWS\_EBS\_VOLUME | DescribeVolumes | | AWS | eai-aws-ec2-describe-vpc-peering-connections | ec2 | ec2:DescribeVpcPeeringConnections | AWS\_VPC\_PEERING\_CONNECTION | DescribeVpcPeeringConnections | | AWS | eai-aws-ec2-describe-vpcs | ec2 | ec2:DescribeVpcs | AWS\_VPC | DescribeVpcs | | AWS | eai-aws-ec2-describe-vpn-connections | ec2 | ec2:DescribeVpnConnections | AWS\_VPN\_CONNECTION | DescribeVpnConnections | | AWS | eai-aws-ec2-describe-vpn-gateways | ec2 | ec2:DescribeVpnGateways | AWS\_VPN\_GATEWAY | DescribeVpnGateways | | AWS | eai-aws-ec2-elastic-address | ec2 | ec2:DescribeAddresses | AWS\_EIP | DescribeAddresses | | AWS | eai-aws-ec2-key-pair | ec2 | ec2:DescribeKeyPairs | AWS\_EC2\_KEY\_PAIR | DescribeKeyPairs | | AWS | eai-aws-elasticache-cache-clusters | elasticache | elasticache:DescribeCacheClusters | AWS\_ELASTICACHE\_CACHE\_CLUSTER | DescribeCacheClusters | | AWS | eai-aws-elasticache-describe-replication-groups | elasticache | elasticache:DescribeReplicationGroups | AWS\_ELASTICACHE\_REPLICATION\_GROUP | DescribeReplicationGroups | | AWS | eai-aws-emr-security-configuration | elasticmapreduce | elasticmapreduce:DescribeSecurityConfiguration | AWS\_EMR\_SECURITY\_CONFIGURATION | DescribeSecurityConfiguration | | AWS | eai-aws-es-describe-elasticsearch-domain | es | es:DescribeElasticsearchDomains | AWS\_ES\_DOMAIN | DescribeElasticsearchDomains | | AWS | eai-aws-glue-connection | glue | glue:GetConnection | AWS\_GLUE\_CONNECTION | GetConnection | | AWS | eai-aws-kms-get-key-rotation-status | kms | kms:GetKeyRotationStatus | AWS\_KMS\_KEY\_ROTATION\_STATUS | GetKeyRotationStatus | | AWS | eai-aws-logs-describe-metric-filters | logs | logs:DescribeMetricFilters | AWS\_LOG\_METRIC\_FILTER | DescribeMetricFilters | | AWS | eai-aws-mq-broker | mq | mq:DescribeBroker | AMAZON\_MQ\_BROKER | DescribeBroker | | AWS | eai-aws-rds-db-cluster-snapshots | rds | rds:DescribeDBClusterSnapshots | AWS\_RDS\_DB\_CLUSTER\_SNAPSHOT | DescribeDBClusterSnapshots | | AWS | eai-aws-rds-db-cluster | rds | rds:DescribeDBClusters | AWS\_RDS\_DB\_CLUSTER | DescribeDBClusters | | AWS | eai-aws-rds-describe-db-snapshots | rds | rds:DescribeDBSnapshots | AWS\_RDS\_DB\_SNAPSHOT | DescribeDBSnapshots | | AWS | eai-aws-rds-describe-event-subscriptions | rds | rds:DescribeEventSubscriptions | AWS\_RDS\_EVENT\_SUBSCRIPTION | DescribeEventSubscriptions | | AWS | eai-aws-route53-list-hosted-zones | route53 | route53:GetHostedZone | AWS\_ROUTE53\_HOSTED\_ZONE | GetHostedZone | | AWS | eai-aws-ssm-parameter | ssm | ssm:GetParameters | AWS\_SSM\_PARAMETER | GetParameters | | AWS | eai-aws-vpc-dhcp-options | ec2 | ec2:DescribeDhcpOptions | AWS\_DHCP\_OPTIONS | DescribeDhcpOptions | | AWS | eai-aws-vpc-nat-gateway | ec2 | ec2:DescribeNatGateways | AWS\_NAT\_GATEWAY | DescribeNatGateways | | AWS | eai-aws-vpc-transit-gateway-route-table | ec2 | ec2:DescribeTransitGatewayRouteTables | AWS\_TRANSIT\_GATEWAY\_ROUTE\_TABLE | DescribeTransitGatewayRouteTables | | AWS | eai-aws-waf-classic-web-acl-resource | waf | waf:GetWebACL | AWS\_WAF\_CLASSIC\_GLOBAL\_WEB\_ACL | GetWebACL | | Azure | azure-data-factory-v2 | Microsoft.DataFactory | Microsoft.DataFactory/factories/read | AZURE\_DATA\_FACTORY\_V2 | read | | Azure | azure-key-vault-certificate | Microsoft.KeyVault | Microsoft.KeyVault/vaults/certificates/read | AZURE\_KEY\_VAULT\_CERTIFICATE | read | | Azure | azure-key-vault-key | Microsoft.KeyVault | Microsoft.KeyVault/vaults/keys/read | AZURE\_KEY\_VAULT\_KEY | read | | Azure | azure-management-locks | Microsoft.Authorization | Microsoft.Authorization/locks/read | AZURE\_MANAGEMENT\_LOCKS | read | | Azure | azure-storage-account-blob-container | Microsoft.Storage | Microsoft.Storage/storageAccounts/blobServices/containers/read | AZURE\_STORAGE\_BLOB\_CONTAINER | read | | Azure | azure-subscription-tenantpolicy import-state | Microsoft.Subscription | Microsoft.Subscription/policies/read | AZURE\_SUBSCRIPTION\_POLICY | read | | GCP | eai-gcloud-iam-service-accounts-keys-list | iam | iam.serviceAccountKeys.list | GCLOUD\_IAM\_SERVICE\_ACCOUNT\_KEY | list | | GCP | gcloud-apigateway-config-export | apigateway | apigateway.apis.list | GCLOUD\_API\_GATEWAY\_CONFIG | list | | GCP | gcloud-cloud-spanner-instance-backup | spanner | spanner.backups.list | GCLOUD\_CLOUD\_SPANNER\_INSTANCE\_BACKUP | list | | GCP | gcloud-compute-project-firewall-policy | compute | compute.firewallPolicies.get | GCLOUD\_COMPUTE\_FIREWALL\_POLICY | get | | GCP | gcloud-iam-service-accounts-keys-list | iam | iam.serviceAccountKeys.list | GCLOUD\_IAM\_SERVICE\_ACCOUNT\_KEY | list | | GCP | gcloud-logging-folder-sinks-list | logging | logging.sinks.list | GCLOUD\_LOGGING\_FOLDER\_SINK | list | | GCP | gcloud-network-security-address-group | networksecurity | networksecurity.addressGroups.get | GCLOUD\_NETWORK\_SECURITY\_ADDRESS\_GROUP | get | | GCP | gcloud-organization-folder | resourcemanager | resourcemanager.folders.list | GCLOUD\_ORGANIZATION\_FOLDER | list | | GCP | gcloud-service-directory-namespace-service | servicedirectory | servicedirectory.services.list | GCLOUD\_SERVICE\_DIRECTORY\_NAMESPACE\_SERVICE | list | | GCP | gcloud-vertex-ai-aiplatform-garden-model | aiplatform | aiplatform.publisherModels.get | GCLOUD\_VERTEX\_AI\_GARDEN\_MODEL | get | | OCI | oci-compartment-get | identity | COMPARTMENT\_INSPECT | OCI\_COMPARTMENT | COMPARTMENT\_INSPECT | | OCI | oci-compartment-get | identity | POLICY\_READ | OCI\_COMPARTMENT | POLICY\_READ | --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://cortex-docs.paloaltonetworks.com/cloud-posture-management-rn/cortex-cloud-posture-management-release-information/api-ingestions/september-2026.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.