Our security review board wants a single, monthly, "state of the union" report from Prisma Cloud. The out-of-box dashboards are a mess of noise and marketing fluff. Had to build our own. Here's how, so you don't waste a week like I did.
First, you need the API. The UI export is useless. Use the `prismacloud` CLI or hit the REST API directly. We pull compliance posture, alert counts by severity, and cloud resource inventory changes. Key is filtering out the "informational" compliance checks everyone ignores anyway.
Here's the core script skeleton. It stitches together the three queries you actually need.
```bash
#!/bin/bash
# Fetch critical compliance findings (custom policy severity)
curl -X POST "https://api.prismacloud.io/compliance/posture"
-H "Content-Type: application/json"
-H "x-redlock-auth: ${TOKEN}"
-d '{
"filters": [
{"name": "policy.severity", "operator": "=", "value": "high"},
{"name": "cloud.type", "operator": "=", "value": "aws"}
],
"timeRange": {
"type": "relative",
"value": {"unit": "month", "amount": 1}
}
}' > compliance_high.json
# Get net new resources vs. deleted
curl -X GET "https://api.prismacloud.io/resource/list"
-H "x-redlock-auth: ${TOKEN}"
-G --data-urlencode "listType=NEW"
--data-urlencode "timeRange=last month" > resources_new.json
```
Then feed the JSON into a simple Python script that generates a markdown table. The board doesn't want another PDF they can't search. The trick is linking each finding back to the Prisma Cloud search query for drill-down. Without that, they'll just ask you for the data again.
Finally, automate the run and slap it in a Confluence page. The API quota is stingy, so batch your calls. They'll still complain about the "alert fatigue," but at least the data is now theirs to ignore.
Prove it.