Cloud Security Policies

Manage security policies that define which rules apply to which assets.

Create Cloud Security Policy

post

Create a new cloud security policy.

Body

namestringRequired

Name of the policy

descriptionstringRequired

Description of the policy

labelsstring[] · nullableOptional

Labels associated with the policy

rule_matching_typestring · enumRequired

Type of rule matching for the policy

Possible values:

associated_rule_filterany of · nullableOptional

Rule filter for the policy, required if rule_matching_type is RULE_FILTER

or

associated_rule_idsstring · uuid[] · max: 500 · nullableOptional

List of rule IDs, required if rule_matching_type is RULES

asset_matching_typestring · enumRequired

Type of asset matching for the policy

Possible values:

associated_asset_group_idsinteger[] · max: 10 · nullableOptional

List of asset group IDs, required if asset_matching_type is ASSET_GROUPS

associated_cloud_account_idsstring[] · nullableOptional

List of cloud account IDs associated with the policy

enabledbooleanOptional

Whether the policy is enabled or not

Default: true

Responses

201

Policy created successfully

application/json

idstring · uuidRequired

namestringRequired

descriptionstring · nullableOptional

labelsstring[] · nullableOptional

rule_matching_typestring · enumRequired

method of selecting the applicable rules for this policy

Possible values:

associated_rule_filterany of · nullableOptional

present if Rule Matching Type is RULE_FILTER

or

associated_rule_idsstring · uuid[] · nullableOptional

present if Rule Matching Type is RULES

asset_matching_typestring · enumRequired

method of selecting the assets in scope for this policy

Possible values:

associated_asset_group_idsinteger[] · nullableOptional

present if Asset Matching Type is ASSET_GROUPS

associated_cloud_account_idsstring[] · nullableOptional

present if Asset Matching Type is CLOUD_ACCOUNTS

enabledbooleanRequired

modestring · enumRequired

whether the policy is built-in (DEFAULT) or user-created (CUSTOM)

Possible values:

creation_timeintegerRequired

in Unix epoch milliseconds

created_bystringRequired

modification_timeintegerRequired

in Unix epoch milliseconds

modified_bystringRequired

400

Bad Request

application/json

401

Unauthorized

403

Forbidden

404

Not Found

409

Conflict

application/json

422

Unprocessable Content

429

Too Many Requests

500

Internal Server Error

application/json

502

Bad Gateway

503

Service Unavailable

post/public_api/v1/policy

POST /public_api/v1/policy HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 791

{
  "name": "API Request with rule_matching_type RULE_FILTER",
  "description": "API Request with rule_matching_type RULE_FILTER",
  "labels": [
    "vm_automation"
  ],
  "rule_matching_type": "RULE_FILTER",
  "associated_rule_filter": {
    "AND": [
      {
        "OR": [
          {
            "SEARCH_FIELD": "severity",
            "SEARCH_TYPE": "EQ",
            "SEARCH_VALUE": "low"
          },
          {
            "SEARCH_FIELD": "severity",
            "SEARCH_TYPE": "EQ",
            "SEARCH_VALUE": "medium"
          }
        ]
      },
      {
        "OR": [
          {
            "SEARCH_FIELD": "cloudType",
            "SEARCH_TYPE": "EQ",
            "SEARCH_VALUE": "aws"
          },
          {
            "SEARCH_FIELD": "cloudType",
            "SEARCH_TYPE": "EQ",
            "SEARCH_VALUE": "azure"
          }
        ]
      },
      {
        "SEARCH_FIELD": "labels",
        "SEARCH_TYPE": "ARRAY_CONTAINS",
        "SEARCH_VALUE": "test"
      },
      {
        "SEARCH_FIELD": "complianceStandards",
        "SEARCH_TYPE": "ARRAY_CONTAINS",
        "SEARCH_VALUE": "Australian Energy Sector Cyber Security Framework (AESCSF)"
      }
    ]
  },
  "asset_matching_type": "ALL_ASSETS",
  "enabled": true
}

{
  "id": "5988e7f2-ed6a-40cf-98b4-a05175f0db53",
  "name": "Automation policy rule filter with all assets",
  "description": "Test policy rule filter with all assets",
  "labels": [
    "vm_automation"
  ],
  "rule_matching_type": "RULE_FILTER",
  "associated_rule_filter": {
    "AND": [
      {
        "OR": [
          {
            "SEARCH_FIELD": "severity",
            "SEARCH_TYPE": "EQ",
            "SEARCH_VALUE": "low"
          },
          {
            "SEARCH_FIELD": "severity",
            "SEARCH_TYPE": "EQ",
            "SEARCH_VALUE": "medium"
          }
        ]
      },
      {
        "OR": [
          {
            "SEARCH_FIELD": "cloudType",
            "SEARCH_TYPE": "EQ",
            "SEARCH_VALUE": "aws"
          },
          {
            "SEARCH_FIELD": "cloudType",
            "SEARCH_TYPE": "EQ",
            "SEARCH_VALUE": "azure"
          }
        ]
      },
      {
        "SEARCH_FIELD": "labels",
        "SEARCH_TYPE": "ARRAY_CONTAINS",
        "SEARCH_VALUE": "test"
      }
    ]
  },
  "asset_matching_type": "ALL_ASSETS",
  "enabled": true,
  "mode": "CUSTOM",
  "creation_time": 1678886400000,
  "created_by": "mock_user",
  "modification_time": 1678886400000,
  "modified_by": "mock_user"
}

List Cloud Security Policies

post

Get all cloud security policies.

Body

filterany of · nullableOptional

Filter for policies

or

search_fromintegerOptional

Start index for pagination

Default: 0

search_tointegerOptional

End index for pagination

Default: 50

Responses

200

Successful Response

application/json

400

Bad Request

application/json

401

Unauthorized

403

Forbidden

404

Not Found

422

Unprocessable Content

429

Too Many Requests

500

Internal Server Error

application/json

502

Bad Gateway

503

Service Unavailable

post/public_api/v1/policy/search

POST /public_api/v1/policy/search HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 281

{
  "filter": {
    "AND": [
      {
        "SEARCH_FIELD": "id",
        "SEARCH_TYPE": "CONTAINS",
        "SEARCH_VALUE": "b2b1279e-8760-44a8-8dca-bcc4508f8ce7"
      },
      {
        "SEARCH_FIELD": "name",
        "SEARCH_TYPE": "CONTAINS",
        "SEARCH_VALUE": "Cloud Posture Security"
      }
    ]
  },
  "search_from": 0,
  "search_to": 50,
  "sort": [
    {
      "FIELD": "name",
      "ORDER": "ASC"
    }
  ]
}

{
  "data": [
    {
      "id": "b2b1279e-8760-44a8-8dca-bcc4508f8ce7",
      "name": "Default Cloud Posture Security Policy",
      "description": "Comprehensive default security policy that identifies risks across you entire cloud security estate. It leverages best practices to scan and detect attack paths, misconfigurations, vulnerabilities, identity risks, data risks, network exposures, and other security gaps across your cloud infrastructure and applications, enabling proactive management and mitigation of cloud security risks.",
      "labels": [
        "prisma_cloud"
      ],
      "rule_matching_type": "RULE_FILTER",
      "associated_rule_filter": {
        "OR": [
          {
            "AND": [
              {
                "SEARCH_FIELD": "severity",
                "SEARCH_TYPE": "EQ",
                "SEARCH_VALUE": "critical"
              }
            ]
          },
          {
            "AND": [
              {
                "SEARCH_FIELD": "severity",
                "SEARCH_TYPE": "EQ",
                "SEARCH_VALUE": "high"
              }
            ]
          }
        ]
      },
      "asset_matching_type": "ALL_ASSETS",
      "enabled": true,
      "mode": "DEFAULT",
      "creation_time": 1732557301240,
      "created_by": "Palo Alto Networks",
      "modification_time": 1732557301240,
      "modified_by": "Palo Alto Networks"
    }
  ],
  "metadata": {
    "total_count": 5,
    "filter_count": 1
  }
}

Get Cloud Security Policy

get

Get a cloud security policy by ID.

Path parameters

policy_idstring · uuidRequired

Responses

200

Successful Response

application/json

idstring · uuidRequired

namestringRequired

descriptionstring · nullableOptional

labelsstring[] · nullableOptional

rule_matching_typestring · enumRequired

method of selecting the applicable rules for this policy

Possible values:

associated_rule_filterany of · nullableOptional

present if Rule Matching Type is RULE_FILTER

or

associated_rule_idsstring · uuid[] · nullableOptional

present if Rule Matching Type is RULES

asset_matching_typestring · enumRequired

method of selecting the assets in scope for this policy

Possible values:

associated_asset_group_idsinteger[] · nullableOptional

present if Asset Matching Type is ASSET_GROUPS

associated_cloud_account_idsstring[] · nullableOptional

present if Asset Matching Type is CLOUD_ACCOUNTS

enabledbooleanRequired

modestring · enumRequired

whether the policy is built-in (DEFAULT) or user-created (CUSTOM)

Possible values:

creation_timeintegerRequired

in Unix epoch milliseconds

created_bystringRequired

modification_timeintegerRequired

in Unix epoch milliseconds

modified_bystringRequired

401

Unauthorized

403

Forbidden

404

Not Found

application/json

422

Unprocessable Content

429

Too Many Requests

500

Internal Server Error

application/json

502

Bad Gateway

503

Service Unavailable

get/public_api/v1/policy/{policy_id}

GET /public_api/v1/policy/{policy_id} HTTP/1.1
Accept: */*

{
  "id": "b2b1279e-8760-44a8-8dca-bcc4508f8ce7",
  "name": "Default Cloud Posture Security Policy",
  "description": "Comprehensive default security policy that identifies risks across you entire cloud security estate. It leverages best practices to scan and detect attack paths, misconfigurations, vulnerabilities, identity risks, data risks, network exposures, and other security gaps across your cloud infrastructure and applications, enabling proactive management and mitigation of cloud security risks.",
  "labels": [
    "prisma_cloud"
  ],
  "rule_matching_type": "RULE_FILTER",
  "associated_rule_filter": {
    "OR": [
      {
        "AND": [
          {
            "SEARCH_FIELD": "severity",
            "SEARCH_TYPE": "EQ",
            "SEARCH_VALUE": "critical"
          }
        ]
      },
      {
        "AND": [
          {
            "SEARCH_FIELD": "severity",
            "SEARCH_TYPE": "EQ",
            "SEARCH_VALUE": "high"
          }
        ]
      }
    ]
  },
  "asset_matching_type": "ALL_ASSETS",
  "enabled": true,
  "mode": "DEFAULT",
  "creation_time": 1732557301240,
  "created_by": "Palo Alto Networks",
  "modification_time": 1732557301240,
  "modified_by": "Palo Alto Networks"
}

Delete Cloud Security Policy

delete

Delete an existing cloud security policy by ID.

Path parameters

policy_idstring · uuidRequired

Responses

204

Successful Response

No content

400

Bad Request

application/json

401

Unauthorized

403

Forbidden

application/json

404

Not Found

application/json

422

Unprocessable Content

429

Too Many Requests

500

Internal Server Error

application/json

502

Bad Gateway

503

Service Unavailable

delete/public_api/v1/policy/{policy_id}

DELETE /public_api/v1/policy/{policy_id} HTTP/1.1
Accept: */*

No content

Update Cloud Security Policy

patch

Modify an existing cloud security policy by ID.

Path parameters

policy_idstring · uuidRequired

Body

namestring · nullableOptional

descriptionstring · nullableOptional

labelsstring[] · nullableOptional

rule_matching_typestring · enum · nullableOptional

method of selecting the applicable rules for this policy

Possible values:

associated_rule_filterany of · nullableOptional

required if Rule Matching Type is RULE_FILTER

or

associated_rule_idsstring · uuid[] · max: 500 · nullableOptional

required if Rule Matching Type is RULES

asset_matching_typestring · enum · nullableOptional

method of selecting the assets in scope for this policy

Possible values:

associated_asset_group_idsinteger[] · max: 10 · nullableOptional

required if Asset Matching Type is ASSET_GROUPS

associated_cloud_account_idsstring[] · nullableOptional

required if Asset Matching Type is CLOUD_ACCOUNTS

enabledboolean · nullableOptional

Responses

200

Successful Response

application/json

idstring · uuidRequired

namestringRequired

descriptionstring · nullableOptional

labelsstring[] · nullableOptional

rule_matching_typestring · enumRequired

method of selecting the applicable rules for this policy

Possible values:

associated_rule_filterany of · nullableOptional

present if Rule Matching Type is RULE_FILTER

or

associated_rule_idsstring · uuid[] · nullableOptional

present if Rule Matching Type is RULES

asset_matching_typestring · enumRequired

method of selecting the assets in scope for this policy

Possible values:

associated_asset_group_idsinteger[] · nullableOptional

present if Asset Matching Type is ASSET_GROUPS

associated_cloud_account_idsstring[] · nullableOptional

present if Asset Matching Type is CLOUD_ACCOUNTS

enabledbooleanRequired

modestring · enumRequired

whether the policy is built-in (DEFAULT) or user-created (CUSTOM)

Possible values:

creation_timeintegerRequired

in Unix epoch milliseconds

created_bystringRequired

modification_timeintegerRequired

in Unix epoch milliseconds

modified_bystringRequired

401

Unauthorized

403

Forbidden

application/json

404

Not Found

application/json

409

Conflict

application/json

422

Unprocessable Content

429

Too Many Requests

500

Internal Server Error

application/json

502

Bad Gateway

503

Service Unavailable

patch/public_api/v1/policy/{policy_id}

PATCH /public_api/v1/policy/{policy_id} HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 386

{
  "name": "API Request with rule_matching_type RULES",
  "description": "API Request with rule_matching_type RULES",
  "labels": [
    "prisma_cloud"
  ],
  "rule_matching_type": "RULES",
  "associated_rule_ids": [
    "60cf2495-32a5-401f-ba56-6bbbf80fe1e2",
    "3c16e31e-1421-4a25-854e-e5870093c99f"
  ],
  "asset_matching_type": "CLOUD_ACCOUNTS",
  "associated_cloud_account_ids": [
    "hvenkatesan-2",
    "883588134481"
  ],
  "enabled": false
}

{
  "id": "b2b1279e-8760-44a8-8dca-bcc4508f8ce6",
  "name": "API Request with rule_matching_type RULES",
  "description": "API Request with rule_matching_type RULES",
  "labels": [
    "prisma_cloud"
  ],
  "rule_matching_type": "RULES",
  "associated_rule_ids": [
    "60cf2495-32a5-401f-ba56-6bbbf80fe1e2",
    "3c16e31e-1421-4a25-854e-e5870093c99f"
  ],
  "asset_matching_type": "CLOUD_ACCOUNTS",
  "associated_cloud_account_ids": [
    "hvenkatesan-2",
    "883588134481"
  ],
  "enabled": false,
  "mode": "DEFAULT",
  "creation_time": 1732557301240,
  "created_by": "Palo Alto Networks",
  "modification_time": 1732557301240,
  "modified_by": "Palo Alto Networks"
}