plerion profiles

With plerion profiles, you can list the profiles in your tenant and read or replace the exemptions on one detection in a profile.

For more about exemptions in the Plerion dashboard, see Exempting findings.

These are the profiles that decide which detections run on your integrations. They’re unrelated to the global --profile option, which picks a set of saved CLI credentials.

Synopsis

plerion profiles <subcommand> [options]

Subcommands

list

plerion profiles list

Lists each profile and the number of integrations it applies to. Use --output json to see the integrations.

detection-exemptions get

plerion profiles detection-exemptions get --profile-id <id> --detection-id <id>

Returns the detection’s exemptions, the exemption types it accepts, and its current version.

Option	Type	Description
`--profile-id`	string	(required) Profile ID, or `default` for the tenant’s default profile
`--detection-id`	string	(required) Detection ID (e.g. `PLERION-AWS-16`)

detection-exemptions replace

plerion profiles detection-exemptions replace --profile-id <id> --detection-id <id> \
  (--exemptions <json> | --file <path> | --clear) [--if-match <version>]

Replaces the detection’s whole exemption set. Any exemption you leave out is removed, so read the set with get --output json, edit it, and send all of it back.

Option	Type	Description
`--profile-id`	string	(required) Profile ID, or `default` for the tenant’s default profile
`--detection-id`	string	(required) Detection ID (e.g. `PLERION-AWS-16`)
`--exemptions`	string	The complete exemption set as JSON: an array, or an object with an `exemptions` array (such as the output of `get --output json`). Can’t be combined with `--file`
`--file`	string	Read the exemption set JSON from a file, or `-` for stdin
`--clear`	flag	Remove every exemption on the detection. Can’t be combined with `--exemptions` or `--file`
`--if-match`	string	The `version` from your last `get`. Omit it only when that version was empty

Pass --if-match whenever get returned a version. The replace is then refused if the detection changed since you read it, so re-read and try again. Without it, the replace overwrites any change made in the meantime.

An empty set is rejected so that you can’t remove every exemption by accident. Use --clear to do that.

Exemption types

Each exemption is a JSON object with a type and an optional reason (ACCEPTED_RISK, FALSE_POSITIVE, or COMPENSATING_CONTROL). A detection only accepts the types listed under SUPPORTED TYPES in the get output.

Type	Fields
`NAME_EXEMPTION`	`condition` (`equals`, `starts-with`, `ends-with`, `contains`) and `value`, matched against the asset name
`TAG_EXEMPTION`	`tagKey` (`{"option": "equals", "value": "<key>"}`) and `tagValue` (`option` is `equals`, `starts-with`, `ends-with`, `contains`, or `any`, plus `value`)
`REGION_EXEMPTION`	`regions`, a list of region names
`PRINCIPAL_EXEMPTION`	`condition` and `value`, matched against the principal. Cloud Detection and Response (CDR) detections only
`ROUTE_EXEMPTION`	`apiId` and `routeKey` for one API Gateway route

Examples

# List profiles
plerion profiles list

# Read a detection's exemptions on the default profile
plerion profiles detection-exemptions get --profile-id default --detection-id PLERION-AWS-16

# Save the set, edit it, and send it back with the version you read
plerion profiles detection-exemptions get --profile-id default --detection-id PLERION-AWS-16 \
  --output json > exemptions.json
plerion profiles detection-exemptions replace --profile-id default --detection-id PLERION-AWS-16 \
  --file exemptions.json --if-match "$(jq -r .version exemptions.json)"

# Replace the set with one name exemption
plerion profiles detection-exemptions replace --profile-id default --detection-id PLERION-AWS-16 \
  --exemptions '[{"type":"NAME_EXEMPTION","condition":"starts-with","value":"acme-sandbox-","reason":"ACCEPTED_RISK"}]'

# Remove every exemption on the detection
plerion profiles detection-exemptions replace --profile-id default --detection-id PLERION-AWS-16 --clear

Output columns (list)

Column	Description
PROFILE ID	Profile ID
NAME	Profile name
DEFAULT	Whether this is the tenant’s default profile
INTEGRATIONS	Number of integrations the profile applies to
DESCRIPTION	Profile description

Output columns (detection-exemptions)

Table output shows a summary row, then one row per exemption.

Column	Description
PROFILE ID	Profile ID. `default` is reported as the ID it resolved to
DETECTION ID	Detection ID
PROVIDER	Provider the detection belongs to
SUPPORTS EXEMPTIONS	Whether the detection accepts exemptions
SUPPORTED TYPES	Exemption types the detection accepts
EXEMPTIONS	Number of exemptions
VERSION	Version to pass to `--if-match`

Column	Description
TYPE	Exemption type
REASON	Exemption reason
MATCH	What the exemption matches
CREATED BY	User who created the exemption
CREATED AT	Creation timestamp

Getting started

Commands

Synopsis

Subcommands

list

detection-exemptions get

detection-exemptions replace

Exemption types

Examples

Output columns (list)

Output columns (detection-exemptions)

​Synopsis

​Subcommands

​list

​detection-exemptions get

​detection-exemptions replace

​Exemption types

​Examples

​Output columns (list)

​Output columns (detection-exemptions)

Synopsis

Subcommands

list

detection-exemptions get

detection-exemptions replace

Exemption types

Examples

Output columns (list)

Output columns (detection-exemptions)