You can use the Resource Query Language (RQL) to perform configuration checks across cloud services as well as gain real-time insights into user and network events to gain security visibility and create policy guardrails in your cloud environment. See the [Prisma Cloud documentation](https://docs.paloaltonetworks.com/prisma/prisma-cloud.html) for more information.
openapi: 3.2.0
info:
title: Palo Alto Networks Search API
contact: {}
version: '1.0'
description: 'Operations tagged Search across 2 of this provider''s published API definitions: palo-alto-cspm-consolidated-spec-cspm-spec-openapi.json, palo-alto-cspm-searchmicroservice-openapi.json. Each path carries the servers of the definition it was published in.'
servers:
- url: https://api.prismacloud.io
- url: https://api2.prismacloud.io
- url: https://api3.prismacloud.io
- url: https://api4.prismacloud.io
- url: https://api.anz.prismacloud.io
- url: https://api.eu.prismacloud.io
- url: https://api2.eu.prismacloud.io
- url: https://api.gov.prismacloud.io
- url: https://api.prismacloud.cn
- url: https://api.ca.prismacloud.io
- url: https://api.sg.prismacloud.io
- url: https://api.uk.prismacloud.io
- url: https://api.ind.prismacloud.io
- url: https://api.jp.prismacloud.io
- url: https://api.fr.prismacloud.io
tags:
- description: "You can use the Resource Query Language (RQL) to perform configuration checks across cloud services as well as \ngain real-time insights into user and network events to gain security visibility and create policy guardrails \nin your cloud environment. See the [Prisma Cloud documentation](https://docs.paloaltonetworks.com/prisma/prisma-cloud.html) for more information.\n"
name: Search
paths:
/search/config:
post:
description: "Returns the results of an RQL config query. With config queries, you can retrieve resource information, identify misconfigurations, gain operational insights, and uncover policy and compliance violations. \n\n### Download Config Search CSV \nIn addition to performing a config search, this endpoint can perform the config \nsearch and download the results as a CSV file. To download the config search CSV, \nadd the request HTTP header **Accept: text/csv**.\n\nAn example request body is:\n```json\n{\n \"query\":\"config where api.name = 'aws-iam-get-account-summary' \",\n \"timeRange\":{\n \"type\":\"relative\",\n \"value\":{\n \"unit\":\"hour\",\n \"amount\":24\n }\n }\n}\n```\n"
operationId: search-config
requestBody:
content:
application/json; charset=UTF-8:
schema:
$ref: '#/components/schemas/ConfigRuleSearchParams'
description: Config rule search parameters model
required: true
responses:
'200':
content:
application/json; charset=UTF-8:
schema:
$ref: '#/components/schemas/SearchResponseModelPagedResultsResourceMetaModel'
description: success
'400':
description: conflict_saved_search
'404':
description: not_found
'500':
description: internal_error
security:
- x-redlock-auth: []
summary: Perform Config Search
tags:
- Search
servers:
- url: https://api.prismacloud.io
- url: https://api2.prismacloud.io
- url: https://api3.prismacloud.io
- url: https://api4.prismacloud.io
/search:
post:
description: "Perform a search against flow logs with an RQL query. \n\nThis endpoint ignores the body param **default**. \n\n### Download Network Search CSV \nIn addition to performing a network search, this API can perform the network \nsearch and download the results as a CSV file. To download the network search CSV, \nadd the request HTTP header **Accept: text/csv**.\n\nAn example request body is:\n```json\n{\n \"cloudType\": \"\",\n \"id\":\"\",\n \"name\":\"\",\n \"description:\"\",\n \"saved\":false,\n \"default\":false,\n \"query\": \"\",\n \"timeRange\": {\n \"type\": \"\",\n \"value\": \"\"\n }\n}\n```\n"
operationId: search-network
requestBody:
content:
application/json; charset=UTF-8:
schema:
$ref: '#/components/schemas/SearchModel'
description: Search model
required: true
responses:
'200':
content:
application/json; charset=UTF-8:
schema:
$ref: '#/components/schemas/SearchResponseModel'
description: success
'400':
description: invalid_parameter_value
'404':
description: not_found
'500':
description: internal_error
security:
- x-redlock-auth: []
summary: Perform Network Search
tags:
- Search
servers:
- url: https://api.prismacloud.io
- url: https://api2.prismacloud.io
- url: https://api3.prismacloud.io
- url: https://api4.prismacloud.io
/search/event:
post:
description: Returns the results of an RQL audit event query. You can use event queries to detect and investigate console and API access, monitor privileged activities, and detect account compromise and unusual user behavior in your cloud environment.
operationId: search-events
requestBody:
content:
application/json; charset=UTF-8:
schema:
$ref: '#/components/schemas/AuditEventSearchParamsModel'
description: Audit event search parameters model
required: true
responses:
'200':
content:
application/json; charset=UTF-8:
schema:
$ref: '#/components/schemas/SearchResponseModelPagedResultsAuditEvent'
description: success
'400':
description: conflict_saved_search
'404':
description: not_found
'500':
description: internal_error
security:
- x-redlock-auth: []
summary: Perform Event Search
tags:
- Search
servers:
- url: https://api.prismacloud.io
- url: https://api2.prismacloud.io
- url: https://api3.prismacloud.io
- url: https://api4.prismacloud.io
/search/event/aggregate:
post:
description: Returns the results of an RQL aggregated audit events query. This RQL query is similar to an RQL event query, but the data returned includes location and service data.
operationId: search-events-aggregated
requestBody:
content:
application/json; charset=UTF-8:
schema:
$ref: '#/components/schemas/AuditEventSearchParamsModel'
description: Audit event search parameters model
required: true
responses:
'200':
content:
application/json; charset=UTF-8:
schema:
$ref: '#/components/schemas/SearchResponseModelListAggregateAuditEvent'
description: success
'400':
description: internal_error
security:
- x-redlock-auth: []
summary: Aggregated Event Search
tags:
- Search
servers:
- url: https://api.prismacloud.io
- url: https://api2.prismacloud.io
- url: https://api3.prismacloud.io
- url: https://api4.prismacloud.io
/search/event/filtered:
post:
description: Filters the results of an event log search according to the specified parameters. You can use this call to refine the results of an aggregated search.
operationId: search-events-filtered
requestBody:
content:
application/json; charset=UTF-8:
schema:
$ref: '#/components/schemas/AuditEventSearchParamsModel'
description: Audit event search parameters model
required: true
responses:
'200':
content:
application/json; charset=UTF-8:
schema:
$ref: '#/components/schemas/SearchResponseModelPagedResultsAuditEvent'
description: success
'400':
description: internal_error
security:
- x-redlock-auth: []
summary: Filter Event Search Results
tags:
- Search
servers:
- url: https://api.prismacloud.io
- url: https://api2.prismacloud.io
- url: https://api3.prismacloud.io
- url: https://api4.prismacloud.io
/search/event/page:
post:
description: "Returns the next page of search results, using a token provided from the previous page. Used for when there are over 100 search results for a given RQL query. \n\nAn initial request to perform an event search will return a **data.nextPageToken** that you \ncan use as the initial **pageToken**.\n"
operationId: search-events-page
requestBody:
content:
application/json; charset=UTF-8:
schema:
$ref: '#/components/schemas/AuditEventPageParams'
description: Audit event page parameters model
required: true
responses:
'200':
content:
application/json; charset=UTF-8:
schema:
$ref: '#/components/schemas/PagedResultsAuditEvent'
description: success
'500':
description: internal_error
security:
- x-redlock-auth: []
summary: Get The Next Event Search Page
tags:
- Search
servers:
- url: https://api.prismacloud.io
- url: https://api2.prismacloud.io
- url: https://api3.prismacloud.io
- url: https://api4.prismacloud.io
/search/event/raw/{id}:
get:
description: Returns the audit event data for the specified ID as raw metadata.
operationId: search-events-raw
parameters:
- description: Audit Event ID
in: path
name: id
required: true
schema:
format: int64
type: integer
responses:
'200':
content:
application/json; charset=UTF-8:
schema:
$ref: '#/components/schemas/AuditEvent'
description: success
'404':
description: not_found
'500':
description: internal_error
security:
- x-redlock-auth: []
summary: Get Raw Event Data
tags:
- Search
servers:
- url: https://api.prismacloud.io
- url: https://api2.prismacloud.io
- url: https://api3.prismacloud.io
- url: https://api4.prismacloud.io
/search/suggest:
post:
description: "Returns the possible options—including expressions, values, and operators—to append to a partial RQL query. \n\nSpecifying a partial RQL query in the query parameter will result in a list of suggested \noptions to append to your partial query. No other parameters are required.\n"
operationId: search-suggest
requestBody:
content:
application/json; charset=UTF-8:
schema:
$ref: '#/components/schemas/SearchModel'
description: Search model
required: true
responses:
'200':
content:
application/json; charset=UTF-8:
schema:
$ref: '#/components/schemas/AutocompleteInfo'
description: success
security:
- x-redlock-auth: []
summary: Autocomplete Search
tags:
- Search
servers:
- url: https://api.prismacloud.io
- url: https://api2.prismacloud.io
- url: https://api3.prismacloud.io
- url: https://api4.prismacloud.io
/search/alert:
get:
description: "Returns search data that can be used to investigate the alert with the specified ID. \n\nThis request returns data for only the following types of alerts:\n* Anomaly alerts\n* Network alerts \n"
operationId: search-for-alert-by-id
parameters:
- description: Alert ID
in: query
name: alertId
required: true
schema:
type: string
responses:
'200':
content:
application/json; charset=UTF-8:
schema:
$ref: '#/components/schemas/SearchResponseModelListObject'
description: success
'404':
description: not_found
'500':
description: internal_error
security:
- x-redlock-auth: []
summary: Search Alerts by ID
tags:
- Search
servers:
- url: https://api.prismacloud.io
- url: https://api2.prismacloud.io
- url: https://api3.prismacloud.io
- url: https://api4.prismacloud.io
/search/config/page:
post:
description: Returns the next page of search results, using a token provided from the previous page. Used for when there are over 100 search results for a given RQL query.
operationId: search-config-page
requestBody:
content:
application/json; charset=UTF-8:
schema:
$ref: '#/components/schemas/ConfigRulePageParams'
description: Config rule page parameters model
required: true
responses:
'200':
content:
application/json; charset=UTF-8:
schema:
$ref: '#/components/schemas/PagedResultsResourceMetaModel'
description: success
'500':
description: internal_error
security:
- x-redlock-auth: []
summary: Get The Next Config Search Page
tags:
- Search
servers:
- url: https://api.prismacloud.io
- url: https://api2.prismacloud.io
- url: https://api3.prismacloud.io
- url: https://api4.prismacloud.io
/search/event/filtered/download:
post:
description: Performs an event log search with an RQL query and downloads the result as a CSV file.
operationId: search-events-csv
requestBody:
content:
application/json; charset=UTF-8:
schema:
$ref: '#/components/schemas/AuditEventSearchParamsModel'
description: Audit event search parameters model
required: true
responses:
'200':
description: successful operation
'400':
description: internal_error
security:
- x-redlock-auth: []
summary: Download Event Search CSV
tags:
- Search
servers:
- url: https://api.prismacloud.io
- url: https://api2.prismacloud.io
- url: https://api3.prismacloud.io
- url: https://api4.prismacloud.io
/search/config/jobs:
post:
description: "Submits a job to generate an RQL config query results list that matches the constraints in the body parameters and is downloadable as a CSV file. Returns the job ID and job submission status. \n\nTo identify your config query, specify either (1) a saved search **id**, (2) a recent search **id** plus a unique **searchName**, \nor (3) a **query** plus a unique **searchName**.\n\nIf you identify your search through a saved search **id**, the following request body parameters apply:\n* **id** - The search ID that corresponds to an existing saved search. You can [View Search History](//prisma-cloud/api/cspm/search-history) with a filter \nto get a list of your recent search IDs. (Required)\n* **searchName** - A unique name that identifies the search (Required)\n* **sort** - An array of sort field data (Optional)\n* **timeRange** - A time range filter. Default is the past seven days. (Optional) \n\nIf you identify your search through a **query** and **searchName**, the following request body parameters apply:\n* **query** - A valid RQL config query that defines your search (Required)\n* **searchName** - A unique name that identifies the search (Required)\n* **searchDescription** - A description for your search (Optional)\n* **sort** - An array of sort field data (Optional)\n* **timeRange** - A time range filter. Default is the past seven days. (Optional)\n"
operationId: submit-an-search-config-csv-download-job
requestBody:
content:
application/json; charset=UTF-8:
schema:
$ref: '#/components/schemas/ConfigRuleSearchParams'
description: Config rule search parameters model
required: true
responses:
'200':
content:
application/json; charset=UTF-8:
schema:
$ref: '#/components/schemas/ConfigCsvJobResponseModel'
description: success
'202':
description: in_process
'400':
description: invalid_parameter_value
'500':
description: internal_error
security:
- x-redlock-auth: []
summary: Submit Search Config CSV Generation Job
tags:
- Search
servers:
- url: https://api.prismacloud.io
- url: https://api2.prismacloud.io
- url: https://api3.prismacloud.io
- url: https://api4.prismacloud.io
/search/config/jobs/{id}/download:
get:
description: "Returns the results of an RQL Config query as a CSV. With Config queries, you can retrieve resource information, identify misconfigurations, gain operational insights, and uncover policy and compliance violations. \n\nThis request requires the HTTP header **Accept: text/csv**.\n"
operationId: async-search-config-csv
parameters:
- description: Job ID
in: path
name: id
required: true
schema:
type: string
responses:
'200':
description: successful operation
'202':
description: in_process
'400':
description: conflict_saved_search
'404':
description: not_found
'500':
description: internal_error
security:
- x-redlock-auth: []
summary: Download Async Config Search CSV
tags:
- Search
servers:
- url: https://api.prismacloud.io
- url: https://api2.prismacloud.io
- url: https://api3.prismacloud.io
- url: https://api4.prismacloud.io
/search/api/v1/config:
post:
tags:
- Search
summary: Perform Config Search by Query
description: 'Returns the results of an RQL config query. With config queries, you can retrieve resource information, identify misconfigurations, gain operational insights, and uncover policy and compliance violations.
When a query returns over 100 results, the response includes the `nextPageToken` field which can be used as the request parameter `pageToken` in the [Get The Next Search Page](/prisma-cloud/api/cspm/search-config-page/) endpoint to retrieve the next page of search results.'
operationId: search-config-by-query
requestBody:
description: Config rule search by query request parameters model
content:
application/json; charset=UTF-8:
schema:
$ref: '#/components/schemas/ConfigSearchByQueryV1Request'
required: true
responses:
'200':
description: success
content:
application/json; charset=UTF-8:
schema:
$ref: '#/components/schemas/ConfigSearchV1ResponseResourceMetaModel'
'400':
description: conflict_saved_search
content: {}
'404':
description: not_found
content: {}
security:
- x-redlock-auth: []
x-microservice”: 'true'
x-public: 'true'
x-codegen-request-body-name: body
servers:
- url: https://api.prismacloud.io
- url: https://api2.prismacloud.io
- url: https://api3.prismacloud.io
- url: https://api4.prismacloud.io
- url: https://api.anz.prismacloud.io
- url: https://api.eu.prismacloud.io
- url: https://api2.eu.prismacloud.io
- url: https://api.gov.prismacloud.io
- url: https://api.prismacloud.cn
- url: https://api.ca.prismacloud.io
- url: https://api.sg.prismacloud.io
- url: https://api.uk.prismacloud.io
- url: https://api.ind.prismacloud.io
- url: https://api.jp.prismacloud.io
- url: https://api.fr.prismacloud.io
/search/api/v1/config/async:
post:
tags:
- Search
summary: Perform Asynchronous Config Search
description: Receive the results of an RQL config query from reporting service asynchronously in CSV format. With config queries, you can retrieve resource information, identify misconfigurations, gain operational insights, and uncover policy and compliance violations.
operationId: search-config-async-csv-download
requestBody:
description: Config rule search for asynchronous csv download request parameters model
content:
application/json; charset=UTF-8:
schema:
$ref: '#/components/schemas/ConfigSearchByQueryWithDownloadV1Request'
required: true
responses:
'200':
description: successful operation
content:
application/json; charset=UTF-8:
schema:
$ref: '#/components/schemas/ConfigSearchAsyncDownloadV1Response'
'202':
description: successful operation
content: {}
'400':
description: bad_request
content: {}
'404':
description: not_found
content: {}
security:
- x-redlock-auth: []
x-microservice”: 'true'
x-public: 'true'
x-codegen-request-body-name: body
servers:
- url: https://api.prismacloud.io
- url: https://api2.prismacloud.io
- url: https://api3.prismacloud.io
- url: https://api4.prismacloud.io
- url: https://api.anz.prismacloud.io
- url: https://api.eu.prismacloud.io
- url: https://api2.eu.prismacloud.io
- url: https://api.gov.prismacloud.io
- url: https://api.prismacloud.cn
- url: https://api.ca.prismacloud.io
- url: https://api.sg.prismacloud.io
- url: https://api.uk.prismacloud.io
- url: https://api.ind.prismacloud.io
- url: https://api.jp.prismacloud.io
- url: https://api.fr.prismacloud.io
/search/api/v1/config/download:
post:
tags:
- Search
summary: Download Config Search as CSV
description: Returns the results of an RQL Config query as a CSV. With Config queries, you can retrieve resource information, identify misconfigurations, gain operational insights, and uncover policy and compliance violations.
operationId: search-config-csv-download
requestBody:
description: Config rule search for asynchronous csv download request parameters model
content:
application/json; charset=UTF-8:
schema:
$ref: '#/components/schemas/ConfigSearchByQueryWithDownloadV1Request'
required: true
responses:
'200':
description: success
content:
text/csv:
schema:
$ref: '#/components/schemas/CsvMessageModel'
'400':
description: invalid_parameter_value
content: {}
'403':
description: unauthorized_access
content: {}
'404':
description: not_found
content: {}
security:
- x-redlock-auth: []
x-microservice”: 'true'
x-public: 'true'
x-codegen-request-body-name: body
servers:
- url: https://api.prismacloud.io
- url: https://api2.prismacloud.io
- url: https://api3.prismacloud.io
- url: https://api4.prismacloud.io
- url: https://api.anz.prismacloud.io
- url: https://api.eu.prismacloud.io
- url: https://api2.eu.prismacloud.io
- url: https://api.gov.prismacloud.io
- url: https://api.prismacloud.cn
- url: https://api.ca.prismacloud.io
- url: https://api.sg.prismacloud.io
- url: https://api.uk.prismacloud.io
- url: https://api.ind.prismacloud.io
- url: https://api.jp.prismacloud.io
- url: https://api.fr.prismacloud.io
/search/api/v2/config:
post:
tags:
- Search
summary: Perform Config Search V2
description: "* Returns the results of an RQL config query.\n* With config queries, you can retrieve resource information, identify misconfigurations, gain operational insights, and uncover policy and compliance violations. \n* The request specification now includes the startTime value, indicating the start time for the search. Additionally, the end time is implicitly set to the current system time. \n* The response has been updated to the transition of the value associated with 'resourceType' to newer and more descriptive name. (Ex: Instance to \"EC2 Instance\" for config query to list all EC2 instances). Additionally, A new field 'resourceTypeId' is introduced, which serves as a unique identifier for the resourceType.\n* The maximum number of results is 100 items. When a query returns over 100 results, the response includes the `nextPageToken` field which can be used as the request parameter `pageToken` in the [Get The Next Search Page](/prisma-cloud/api/cspm/search-config-page/) endpoint to retrieve the next page of search results."
operationId: search-config-v2
requestBody:
description: Config rule search by query request parameters model
content:
application/json; charset=UTF-8:
schema:
$ref: '#/components/schemas/ConfigSearchByQueryV2Request'
required: true
responses:
'200':
description: success
content:
application/json; charset=UTF-8:
schema:
$ref: '#/components/schemas/ConfigSearchV1ResponseResourceMetaModelV3'
'400':
description: conflict_saved_search
'404':
description: Not Found
security:
- x-redlock-auth: []
x-microservice”: 'true'
x-public: 'true'
x-codegen-request-body-name: body
servers:
- url: https://api.prismacloud.io
- url: https://api2.prismacloud.io
- url: https://api3.prismacloud.io
- url: https://api4.prismacloud.io
- url: https://api.anz.prismacloud.io
- url: https://api.eu.prismacloud.io
- url: https://api2.eu.prismacloud.io
- url: https://api.gov.prismacloud.io
- url: https://api.prismacloud.cn
- url: https://api.ca.prismacloud.io
- url: https://api.sg.prismacloud.io
- url: https://api.uk.prismacloud.io
- url: https://api.ind.prismacloud.io
- url: https://api.jp.prismacloud.io
- url: https://api.fr.prismacloud.io
/search/api/v2/config/{id}:
post:
tags:
- Search
summary: Perform Config Search by Search Id V2
description: "* Returns the results of an RQL config query.\n* With config queries, you can retrieve resource information, identify misconfigurations, gain operational insights, and uncover policy and compliance violations. \n* The request specification now includes the startTime value, indicating the start time for the search. Additionally, the end time is implicitly set to the current system time. \n* The response has been updated to the transition of the value associated with 'resourceType' to newer and more descriptive name. (Ex: Instance to \"EC2 Instance\" for config query to list all EC2 instances). Additionally, A new field 'resourceTypeId' is introduced, which serves as a unique identifier for the resourceType"
operationId: search-config-by-search-id-v2
parameters:
- name: id
in: path
description: Search ID
required: true
schema:
type: string
requestBody:
description: Config rule search by search id request parameters model
content:
application/json; charset=UTF-8:
schema:
$ref: '#/components/schemas/ConfigSearchBySearchIdV2Request'
required: true
responses:
'200':
description: success
content:
application/json; charset=UTF-8:
schema:
$ref: '#/components/schemas/ConfigSearchV1ResponseResourceMetaModelV3'
'400':
description: conflict_saved_search
'404':
description: Not Found
security:
- x-redlock-auth: []
x-microservice”: 'true'
x-public: 'true'
x-codegen-request-body-name: body
servers:
- url: https://api.prismacloud.io
- url: https://api2.prismacloud.io
- url: https://api3.prismacloud.io
- url: https://api4.prismacloud.io
- url: https://api.anz.prismacloud.io
- url: https://api.eu.prismacloud.io
- url: https://api2.eu.prismacloud.io
- url: https://api.gov.prismacloud.io
- url: https://api.prismacloud.cn
- url: https://api.ca.prismacloud.io
- url: https://api.sg.prismacloud.io
- url: https://api.uk.prismacloud.io
- url: https://api.ind.prismacloud.io
- url: https://api.jp.prismacloud.io
- url: https://api.fr.prismacloud.io
/search/api/v1/config/{id}:
post:
tags:
- Search
summary: Perform Config Search by Search Id
description: Returns the results of an RQL config query. With config search Id, you can retrieve resource information, identify misconfigurations, gain operational insights, and uncover policy and compliance violations.
operationId: search-config-by-search-id
parameters:
- name: id
in: path
description: Search ID
required: true
schema:
type: string
requestBody:
description: Config rule search by search id request parameters model
content:
application/json; charset=UTF-8:
schema:
$ref: '#/components/schemas/ConfigSearchBySearchIdV1Request'
required: true
responses:
'200':
description: success
content:
application/json; charset=UTF-8:
schema:
$ref: '#/components/schemas/ConfigSearchV1ResponseResourceMetaModel'
'400':
description: conflict_saved_search
content: {}
'404':
description: not_found
content: {}
security:
- x-redlock-auth: []
x-microservice”: 'true'
x-public: 'true'
x-codegen-request-body-name: body
servers:
- url: https://api.prismacloud.io
- url: https://api2.prismacloud.io
- url: https://api3.prismacloud.io
- url: https://api4.prismacloud.io
- url: https://api.anz.prismacloud.io
- url: https://api.eu.prismacloud.io
- url: https://api2.eu.prismacloud.io
- url: https://api.gov.prismacloud.io
- url: https://api.prismacloud.cn
- url: https://api.ca.prismacloud.io
- url: https://api.sg.prismacloud.io
- url: https://api.uk.prismacloud.io
- url: https://api.ind.prismacloud.io
- url: https://api.jp.prismacloud.io
- url: https://api.fr.prismacloud.io
components:
schemas:
UserAgentOs:
properties:
hash:
format: int32
type: integer
id:
format: int32
type: integer
name:
type: string
type: object
SortAuditEventSortField:
properties:
direction:
description: Direction
enum:
- asc
- desc
type: string
field:
enum:
- ID
- TIME
- OPERATION
- CLOUD_SERVICE
- CRUD
- USER
- CLOUD_ACCOUNT
- CLOUD_REGION
- TIMESTAMP
type: string
type: object
SearchResponseModelListAggregateAuditEvent:
properties:
alertId:
description: Alert ID
readOnly: true
type: string
async:
description: true = Is Async
readOnly: true
type: boolean
asyncResultUrl:
description: Async Result Url
example: /search/config/jobs/2df49d4f72e842b582b123bc2b7826b3/download
readOnly: true
type: string
cloudType:
description: Cloud Type
enum:
- aws
- azure
- gcp
- alibaba_cloud
- oci
type: string
cursor:
description: Cursor
format: int32
readOnly: true
type: integer
data:
items:
$ref: '#/components/schemas/AggregateAuditEvent'
type: array
default:
type: boolean
description:
description: Search Description
type: string
filters:
description: View Order
items:
$ref: '#/components/schemas/UIFilterModel'
readOnly: true
type: array
groupBy:
description: Group By
items:
type: string
readOnly: true
type: array
id:
description: Search ID
type: string
name:
description: Search Name
type: string
query:
description: RQL Query
type: string
saved:
description: Search Exists
typ
# --- truncated at 32 KB (91 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/palo-alto-networks/refs/heads/main/openapi/palo-alto-networks-search-api-openapi.yml