> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/discovery-catalog/cortex-cloud-discovery-catalog/event-based-asset-ingestion-eai-resource-ingestion-templates-rits.md). # Event-based Asset Ingestion (EAI) Resource Ingestion Templates (RITs) | API | Service | Permissions | | -------------------------------------------------- | --------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | aws-ec2-describe-instances | Amazon EC2 | ec2:DescribeInstances, ec2:DescribeInstanceStatus,ec2:DescribeInstanceAttribute | | aws-ec2-describe-network-interfaces | Amazon EC2 | ec2:DescribeNetworkInterfaces | | aws-ec2-describe-images | Amazon EC2 | ec2:DescribeImages ec2:DescribeImageAttribute | | aws-ec2-describe-snapshots | Amazon EC2 | ec2:DescribeSnapshots, ec2:DescribeSnapshotAttribute | | aws-ec2-describe-volumes | Amazon EC2 | ec2:DescribeVolumes | | aws-ec2-key-pair | Amazon EC2 | ec2:DescribeKeyPairs | | aws-ec2-elastic-address | Amazon EC2 | ec2:DescribeAddresses | | aws-ec2-describe-vpcs | Amazon VPC | ec2:DescribeVpcs | | aws-ec2-describe-subnets | Amazon VPC | ec2:DescribeSubnets | | aws-ec2-describe-security-groups | Amazon VPC | ec2:DescribeSecurityGroups | | aws-ec2-describe-flow-logs | Amazon VPC | ec2:DescribeFlowLogs, ec2: DescribeTags | | aws-ec2-describe-internet-gateways | Amazon VPC | ec2:DescribeInternetGateways | | aws-describe-vpc-endpoints | Amazon VPC | ec2:DescribeVpcEndpoints | | aws-ec2-describe-network-acls | Amazon VPC | ec2:DescribeNetworkAcls | | aws-ec2-describe-vpc-peering-connections | Amazon VPC | ec2:DescribeVpcPeeringConnections | | aws-ec2-describe-vpn-gateways | Amazon VPC | ec2:DescribeVpnGateways | | aws-ec2-describe-vpn-connections | Amazon VPC | ec2:DescribeVpnConnections | | aws-ec2-describe-route-tables | Amazon VPC | ec2:DescribeRouteTables | | aws-vpc-dhcp-options | Amazon VPC | ec2:DescribeDhcpOptions | | aws-vpc-nat-gateway | Amazon VPC | ec2:DescribeNatGateways | | aws-vpc-transit-gateway | Amazon VPC | ec2:DescribeTransitGateways | | aws-vpc-transit-gateway-route-table | Amazon VPC | ec2:DescribeTransitGatewayRouteTables, ec2:SearchTransitGatewayRoutes | | aws-route53-list-hosted-zones | Amazon Route53 | route53:ListHostedZones, route53:ListResourceRecordSets, route53:GetDNSSEC | | aws-rds-describe-db-instances | Amazon RDS | rds:DescribeDBInstances, rds:ListTagsForResource | | aws-rds-describe-db-snapshots | Amazon RDS | rds:DescribeDBSnapshots, rds:DescribeDBSnapshotAttributes | | aws-rds-describe-event-subscriptions | Amazon RDS | rds:DescribeEventSubscriptions | | aws-rds-db-cluster-snapshots | Amazon RDS | rds:DescribeDBClusterSnapshots, rds:DescribeDBClusterSnapshotAttributes | | aws-rds-db-cluster | Amazon RDS | rds:DescribeDBClusters | | aws-rds-db-cluster-parameter-group | Amazon RDS | rds:DescribeDBClusterParameters rds:DescribeDBClusterParameterGroups rds:ListTagsForResource | | aws-kms-get-key-rotation-status | AWS KMS | kms:ListAliases, kms:ListKeys, kms:DescribeKey, kms:GetKeyRotationStatus, kms:ListKeyPolicies, kms:GetKeyPolicy, kms:ListResourceTags | | aws-cloudtrail-describe-trails | AWS CloudTrail | cloudtrail:DescribeTrails, cloudtrail:ListTags | | aws-cloudtrail-get-trail-status | AWS CloudTrail | cloudtrail:GetTrailStatus | | aws-cloudtrail-get-event-selectors | AWS CloudTrail | cloudtrail:GetEventSelectors | | aws-cloudwatch-describe-alarms | Amazon CloudWatch | cloudwatch:describeAlarms, cloudwatch:ListTagsForResource | | aws-logs-describe-metric-filters | Amazon CloudWatch | logs:DescribeMetricFilters | | aws-cloudwatch-log-group | Amazon CloudWatch | logs:DescribeLogGroups, logs:ListTagsLogGroup, logs:DescribeSubscriptionFilters | | aws-dynamodb-describe-table | Amazon DynamoDB | - dynamodb:ListTables - dynamodb:DescribeTable - dynamodb:ListTagsOfResource - dynamodb:DescribeTimeToLive - dynamodb:DescribeContinuousBackups - dynamodb:GetResourcePolicy | | aws-configservice-describe-configuration-recorders | AWS Config | config:DescribeConfigurationRecorders, config:DescribeConfigurationRecorderStatus | | aws-es-describe-elasticsearch-domain | Amazon Elasticsearch Service | es:ListDomainNames, es:DescribeElasticsearchDomains | | aws-apigateway-get-stages | Amazon API Gateway | apigateway:GET | | aws-apigateway-method | Amazon API Gateway | apigateway:GET | | aws-describe-mount-targets | Amazon EFS | elasticfilesystem:DescribeFileSystems, elasticfilesystem:DescribeMountTargets, elasticfilesystem:DescribeMountTargetSecurityGroups, elasticfilesystem:DescribeTags, elasticfilesysttem:DescribeFileSystemPolicy, elasticfilesystem:DescribeBackupPolicy | | aws-emr-security-configuration | Amazon EMR | elasticmapreduce:ListSecurityConfigurations, elasticmapreduce:DescribeSecurityConfiguration | | aws-acm-describe-certificate | AWS Certificate Manager | acm:ListCertificates, acm:DescribeCertificate, acm:ListTagsForCertificate | | aws-secretsmanager-describe-secret | AWS Secrets Manager | secretsmanager:ListSecrets, secretsmanager:GetResourcePolicy | | aws-ssm-parameter | AWS Systems Manager | ssm:DescribeParameters, ssm:ListTagsForResource | | aws-ecs-service | Amazon ECS | ecs:DescribeServices | | aws-ecs-cluster | Amazon ECS | ecs:DescribeClusters, ecs:ListTagsForResource | | aws-ecs-container-instance | Amazon ECS | ecs:ListContainerInstances,ecs:DescribeContainerInstances | | aws-ecr-get-repository-policy | Amazon ECR | ecr:DescribeRepositories, ecr:GetRepositoryPolicy, ecr:GetLifecyclePolicy | | aws-sqs-get-queue-attributes | Amazon SQS | sqs:ListQueues, sqs:GetQueueAttributes | | aws-sns-get-topic-attributes | Amazon SNS | sns:ListTopics, sns:GetTopicAttributes | | aws-describe-auto-scaling-groups | AWS Auto Scaling | autoscaling:DescribeAutoScalingGroups | | aws-ec2-autoscaling-launch-configuration | AWS Auto Scaling | autoscaling:DescribeLaunchConfigurations | | aws-elasticache-describe-replication-groups | Amazon ElastiCache | elasticache:DescribeReplicationGroups | | aws-elasticache-cache-clusters | Amazon ElastiCache | elasticache:DescribeCacheClusters | | aws-kinesis-list-streams | Amazon Kinesis | kinesis:ListStreams, kinesis:DescribeStream, kinesis:ListTagsForStream | | aws-elb-describe-load-balancers | Amazon Elastic Load Balancing | elasticloadbalancing:DescribeLoadBalancers, elasticloadbalancing:DescribeLoadBalancerPolicies, elasticloadbalancing:DescribeLoadBalancerAttributes, elasticloadbalancing:DescribeTags | | aws-elbv2-describe-load-balancers | Amazon Elastic Load Balancing | elasticloadbalancing:DescribeLoadBalancers, elasticloadbalancing:DescribeListeners, elasticloadbalancing:DescribeTargetGroups, elasticloadbalancing:DescribeTargetHealth, elasticloadbalancing:DescribeTags, elasticloadbalancing:DescribeLoadBalancerAttributes | | aws-elbv2-target-group | Amazon Elastic Load Balancing | elasticloadbalancing:DescribeTargetGroups, elasticloadbalancing:DescribeTags | | aws-mq-broker | Amazon MQ | mq:ListBrokers, mq:DescribeBroker | | aws-glue-connection | AWS Glue | glue:GetConnections | | aws-waf-v2-web-acl-resource | AWS WAF | wafv2:ListWebACLs, wafv2:ListResourcesForWebACL,wafv2:GetLoggingConfiguration | | aws-waf-classic-web-acl-resource | AWS WAF | waf-regional:ListWebACLs, waf-regional:ListResourcesForWebACL,waf-regional:GetLoggingConfiguration | | aws-waf-classic-global-web-acl-resource | AWS WAF | waf:ListWebACLs,waf:GetWebACL, waf:ListTagsForResource, waf:GetLoggingConfiguration | | aws-sagemaker-notebook-instance | Amazon SageMaker | sagemaker:ListNotebookInstances, sagemaker:DescribeNotebookInstance, sagemaker:ListTags | | aws-dms-certificate | AWS Database Migration Service | dms:DescribeCertificates, dms:ListTagsForResource | | aws-dms-endpoint | AWS Database Migration Service | dms:DescribeEndpoints, dms:ListTagsForResource | | aws-kinesis-firehose-delivery-stream | Amazon Kinesis Firehose | firehose:DescribeDeliveryStream, firehose:ListDeliveryStreams, firehose:ListTagsForDeliveryStream | | aws-access-analyzer | AWS Access Analyzer | access-analyzer:ListAnalyzers | | aws-appsync-graphql-api | AWS AppSync | appsync:ListGraphqlApis appsync:GetGraphqlApi appsync:GetApiCache | | aws-docdb-db-cluster-parameter-group | Amazon DocumentDB | rds:DescribeDBClusterParameters rds:DescribeDBClusterParameterGroups rds:ListTagsForResource | | aws-neptune-db-cluster | Amazon Neptune | rds:DescribeDBClusters rds:ListTagsForResource | | aws-apigateway-get-rest-apis | Amazon API Gateway | "apigateway:GET" | | aws-cloudfront-list-distributions | Amazon CloudFront | "cloudfront:ListDistributions" "cloudfront:GetDistributionConfig" "cloudfront:ListTagsForResource" | | aws-eks-describe-cluster | Amazon Elastic Kubernetes Service | "eks:ListClusters" "eks:DescribeCluster" "eks:ListTagsForResource" | | aws-waf-v2-global-web-acl-resource | AWS WAF | "wafv2:GetWebACL" "wafv2:ListTagsForResource" "wafv2:GetLoggingConfiguration" | | gcloud-compute-instances-list | Google Compute Engine | compute.instances.list compute.instances.getIamPolicy | | gcp-compute-disk-list | Google Compute Engine | compute.disks.list, compute.disks.get, compute.disks.getIamPolicy | | gcloud-compute-router | Google Compute Engine | compute.routers.list, compute.routers.get | | gcloud-compute-image | Google Compute Engine | compute.images.list, compute.images.getIamPolicy | | gcloud-compute-target-ssl-proxy | Google Compute Engine | compute.targetSslProxies.list | | gcloud-compute-instance-template | Google Compute Engine | compute.instanceTemplates.list, compute.instanceTemplates.get, compute.instanceTemplates.getIamPolicy | | gcloud-ssl-certificate | Google Compute Engine | compute.sslCertificates.list, compute.sslCertificates.get | | gcloud-compute-networks-list | Google VPC | compute.networks.list, compute.networks.get | | gcloud-compute-networks-subnets-list | Google VPC | compute.subnetworks.list, compute.subnetworks.get | | gcloud-compute-firewall-rules-list | Google VPC | compute.firewalls.list | | gcloud-sql-instances-list | Google Cloud SQL | cloudsql.instances.list | | gcloud-iam-service-accounts-list | Google Cloud IAM | iam.serviceAccounts.list, iam.serviceAccounts.get | | gcloud-iam-service-accounts-keys-list | Google Cloud IAM | iam.serviceAccountKeys.list | | gcloud-storage-buckets-list | Google Cloud Storage | storage.buckets.list, storage.buckets.get, storage.buckets.getIamPolicy | | gcloud-container-describe-clusters | Google Kubernetes Engine | container.clusters.list, container.clusters.get | | gcloud-monitoring-policies-list | Google Stackdriver Monitoring | monitoring.alertPolicies.list, monitoring.alertPolicies.get | | gcloud-logging-metric | Google Stackdriver Monitoring | logging.logMetrics.list, monitoring.metricDescriptors.get, logging.logMetrics.get | | gcloud-logging-sinks-list | Google Stackdriver Logging | logging.sinks.list, logging.sinks.get | | gcloud-bigquery-table | Google BigQuery | cloudasset.assets.searchAllResources, cloudasset.assets.searchAllIamPolicies | | gcloud-kms-keyring-list | Google Cloud KMS | cloudasset.assets.searchAllResources, cloudasset.assets.searchAllIamPolicies, cloudkms.keyRings.get, cloudkms.keyRings.getIamPolicy | | gcloud-kms-crypto-keys-list | Google Cloud KMS | cloudasset.assets.searchAllResources cloudasset.assets.searchAllIamPolicies, cloudkms.cryptoKeys.get, cloudkms.cryptoKeys.getIamPolicy | | gcloud-compute-target-https-proxies | Google Cloud Load Balancing | compute.targetHttpsProxies.list | | gcloud-compute-ssl-policies | Google Cloud Load Balancing | compute.sslPolicies.list, compute.sslPolicies.get | | gcloud-redis-instances-list | Google Cloud Memorystore | redis.instances.list, redis.instances.get | | gcloud-cloud-function | Google Cloud Function | cloudfunctions.functions.list, cloudfunctions.functions.getIamPolicy, cloudasset.assets.searchAllIamPolicies,cloudfunctions.functions.get, cloudfunctions.functions.getIamPolicy | | gcloud-api-key | Google API Keys | apikeys.keys.list, apikeys.keys.get | | gcloud-dataproc-clusters-list | Google Dataproc Clusters | dataproc.clusters.list, dataproc.clusters.getIamPolicy, cloudasset.assets.searchAllIamPolicies,dataproc.clusters.get, dataproc.clusters.getIamPolicy | | gcloud-cloud-run-services-list | Google Cloud Run | run.services.list, run.locations.list cloudasset.assets.searchAllIamPolicies | | gcloud-pubsub-subscription | Google Pubsub | pubsub.subscriptions.list, pubsub.subscriptions.get, pubsub.subscriptions.getIamPolicy, cloudasset.assets.searchAllIamPolicies | | gcloud-pubsub-topic | Google Pubsub | pubsub.topics.list, pubsub.topics.get pubsub.topics.getIamPolicy cloudasset.assets.searchAllIamPolicies | | gcloud-healthcare-dataset | Google HealthCare | healthcare.locations.list, healthcare.datasets.list, healthcare.datasets.get, healthcare.datasets.getIamPolicy | | gcloud-composer-environment | Google Cloud Composer | composer.environments.list, composer.environments.get | | gcloud-ai-platform-job | Google AI Platform | ml.jobs.getIamPolicy ml.jobs.list, ml.jobs.get | | gcloud-apigateway-gateway | Google API Gateway | apigateway.gateways.getIamPolicy, apigateway.gateways.list, apigateway.gateways.get | | gcloud-armor-security-policy | Google Cloud Armor | compute.securityPolicies.list, compute.securityPolicies.get | | gcloud-compute-interfaces-list | Google Compute Engine | compute.networks.list | | gcloud-sql-virtual-network-interface | Google Cloud SQL | cloudsql.instances.list | --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/discovery-catalog/cortex-cloud-discovery-catalog/event-based-asset-ingestion-eai-resource-ingestion-templates-rits.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.