- Access exclusive content
- Connect with peers
- Share your expertise
- Find support resources
09-09-2020 06:56 AM - last edited on 08-12-2022 10:12 AM by RPrasadi
In my organization we have Prisma Cloud integrated into AWS Organization environment. Which is great for monitoring and pulling data from the entire AWS Org. I want to pull the count of all ec2 instances which are created using the RunInstances call. The event search works great for the number of times the RunInstances is called, but in the rawEvent data several instances can be started from one call to RunInstances. The below api call will receive the data from Prisma:
timePeriod = {
"type": "absolute",
"value": {
"startTime": 1596240000000,
"endTime": 1598918399000
}
}
rqlQuery="event where operation = 'RunInstances'"
limit=250
prismaToken = prismaAPI.prismaLogin(apiKey,apiSecret)
query = {"limit":limit, "query": rqlQuery, "timeRange": timePeriod}
totalInstances=0
prismaQueryResult = prismaAPI.prismaQuery(prismaToken, query,'event')
def prismaQuery(pToken, rql, type='config'):
url = f"https://api3.prismacloud.io/search/{type}" if type != 'network' else "https//api3.prismacloud.io/search"
print(f'rql: {rql}')
try:
headers = {
'accept': "application/json; charset=UTF-8",
'content-type': "application/json; charset=UTF-8",
'x-redlock-auth': pToken
}
response = requests.request("POST", url, headers=headers, json=rql)
response.raise_for_status()
return response.json()
except HTTPError as http_err:
print(f'HTTP error occurred: {http_err}')
except Exception as err:
print(f'Other error occurred: {err}')
else:
print('Success!')
but the raw event data is not included in the response. So then I need to make a call for every event to the https://api.prismacloud.io/search/event/raw/id endpoint. Is there some way to get the rawEvent data in the initial search api call? There is a data.items[].rawEvent shown as possible response information.
Thank you,
Trevor