topic Re: Expport all resource information with tags in Prisma Cloud Discussions

Expport all resource information with tags

PCouedel — Wed, 17 Jan 2024 19:45:15 GMT

Hello,

I'm trying to export information for all resource.

"/resource/scan_info"

"/v2/resource/scan_info"

do you know how I can recover --> resourceConfigJson

I can't manage to retrieve tag information from azure for example and prisma web in the api.

it takes a long time to retrieve all the information - is there a way to generate a csv like with alerts?

Re: Expport all resource information with tags

CloudEngineer — Wed, 17 Jan 2024 20:11:38 GMT

Hi PCouedel,

Allow me to share some pertinent information about gathering asset information.

The /resource API endpoint has been deprecated (See https://pan.dev/prisma-cloud/api/cspm/get-resource/)
Its replacement , also mentioned at the above URL is Get Asset (See https://pan.dev/prisma-cloud/api/cspm/get-asset-details-by-id/)
Both of those endpoints are designed to retrieve details about a single cloud object

If you are interested in retrieving lots of objects , the best choice is to use the Investigate page where you can retrieve objects based on tags and other properties or metatdata.

My team has recently published an article about gathering large amounts of data using scripting and API calls.

See: https://live.paloaltonetworks.com/t5/prisma-cloud-articles/best-practices-for-scripting-rql-queries/ta-p/570892/highlight/true

You would use the Investigate page to validate some of your search results on a smaller scale. Then you can follow the implementation of the script to gather results greater than 100k.

Please let me know how this works out.

Regards,

Brandon

Re: Expport all resource information with tags

PCouedel — Wed, 17 Jan 2024 21:04:09 GMT

Hello,

Its replacement , also mentioned at the above URL is Get Asset (See https://pan.dev/prisma-cloud/api/cspm/get-asset-details-by-id/)

thank you for your solution, but how can I retrieve the unifiedAssetId for all the assets?

Re: Expport all resource information with tags

CloudEngineer — Thu, 18 Jan 2024 17:39:19 GMT

Hi,

The mentioned API call is only used to query and respond with detail about a single resource. It is not meant to be used for returning large volumes of data.

In your original request you asked about finding tags on Azure resources. An example RQL you could start with on the investigate page is:

config from cloud.resource where cloud.type = 'azure' AND tag ( 'string' ) exists

If you are looking for information about tags, from a long list of resources, you don't need asset IDs.

Last, I'd like to recommend signing up for a free RQL training webinar where you'll be able to interact and ask questions live. Please have a look at this link and register for one that works for you:

https://paloaltonetworks.zoom.us/webinar/register/WN_biM82jcmTiGuQxp5NmOQ7w#/registration

Regards,