# List alerts Source: https://docs.plerion.com/api-reference/alerts/list /api-reference/openapi.yaml get /v1/tenant/alerts Use the list alerts API to get alerts for the tenant. # API categories Source: https://docs.plerion.com/api-reference/api-categories This page provides a comprehensive overview of all Plerion API categories. Each category contains related endpoints for specific functionality within the Plerion platform. Understand what each API category does and access specific endpoints. ## Categories ### Findings Findings are the results of the Plerion Detection Engine (PDE) Detection reporting a finding and rating the severity of the finding as it relates to best practices or a relevant compliance standard. Plerion Findings enable customers to reduce the risk to their environments by continuously highlighting areas for improvement. [Explore findings APIs](https://docs.plerion.com/api-reference/findings/list) ### Vulnerabilities Vulnerabilities are known CVEs Plerion detects in the operating systems, packages and container images running in your cloud workloads. Each one carries the affected package and version, its severity, and whether a public exploit or a known-exploited-vulnerability record exists, so remediation can be ordered by real exposure rather than by CVSS score alone. Vulnerability exemptions record a CVE you have accepted or judged not applicable for a profile, with a reason, so it stops surfacing on later scans. [Explore vulnerabilities APIs](https://docs.plerion.com/api-reference/vulnerabilities/list) ### Profiles A profile holds the detection configuration Plerion applies to a set of integrations: which detections run, at what severity, and the exemptions that stop them reporting. Every tenant has a default profile covering the integrations that have not been given one of their own. [Explore profiles APIs](https://docs.plerion.com/api-reference/profiles/list) ### Detection exemptions A detection exemption stops one detection reporting findings against the assets it matches, so an accepted risk or a confirmed false positive stays closed. Match on the asset's name, its tags, or its region, on the principal for Cloud Detection and Response (CDR) detections, or on the API Gateway routes you have accepted. Exemptions apply to the findings Plerion has already stored, not only to the next scan. An exemption is part of a detection's configuration inside a profile, not a record of its own. There is no exemption ID and no endpoint for a single entry, so the unit of operation is the whole exemption set for one detection: read it, change it, and write all of it back. There are five exemption types. The `type` field decides which other fields apply. | Type | Exempts | Fields | | --------------------- | -------------------------------------------- | -------------------- | | `NAME_EXEMPTION` | Assets whose name matches | `condition`, `value` | | `TAG_EXEMPTION` | Assets carrying a matching tag | `tagKey`, `tagValue` | | `REGION_EXEMPTION` | Assets in the listed regions | `regions` | | `PRINCIPAL_EXEMPTION` | Findings raised against a matching principal | `condition`, `value` | | `ROUTE_EXEMPTION` | One API Gateway route | `apiId`, `routeKey` | Not every detection accepts exemptions, and of the ones that do, none accepts every type, so read the detection first. `supportsExemptions` and `supportedExemptionTypes` report what it takes, and a write using anything else is rejected rather than stored where it would never take effect. CDR detections report an actor rather than a misconfigured asset, so those that accept exemptions take `PRINCIPAL_EXEMPTION` only. `PLERION-AWS-530` and `PLERION-AWS-564` report a set of failing API Gateway routes, so they also take `ROUTE_EXEMPTION`. Where a detection accepts none, as those reporting external access grants do, close findings by recording a trusted principal on the profile instead. The read reports stored exemptions verbatim and the write accepts the same shape, so you can send a read's response straight into a write. Entries created in the Plerion platform may carry no `reason`, which is why it is optional. Set one on the entries you add. #### Quick start Follow the guide to replace a detection's exemptions using `curl`. **Note:** Replace `{$PLERION_API_KEY}` with your API key. ##### 1. List your profiles A profile applies to a set of integrations, and the exemption endpoints take its ID. You can pass `default` in place of an ID to address the tenant's default profile, but the default profile covers only the integrations that have not been given a profile of their own. On a tenant with more than one profile, a write against `default` returns `200` and leaves every integration covered by another profile still reporting the finding. Read the `integrations` array on each profile, then write to each profile that covers the accounts you mean to change. ```bash theme={"system"} export PLERION_API_URL=au.api.plerion.com export PLERION_API_KEY={$PLERION_API_KEY} curl "https://$PLERION_API_URL/v1/tenant/profiles" -H "Authorization: Bearer $PLERION_API_KEY" ``` ##### 2. Read the current exemption set Take the detection ID from a finding's `detectionId` field. Keep the `version`: it is how the write below detects a concurrent change. Treat it as an opaque string and pass it back unchanged, rather than parsing or comparing it, because its format can change. It is `null` when the detection has never been configured on the profile. ```bash theme={"system"} export PLERION_PROFILE_ID=default export PLERION_DETECTION_ID=PLERION-AWS-16 export PLERION_EXEMPTIONS_URL="https://$PLERION_API_URL/v1/tenant/profiles/$PLERION_PROFILE_ID/detection-settings/$PLERION_DETECTION_ID/exemptions" # Capture the version to send back in step 3. `// empty` leaves the variable # empty when version is null, rather than setting it to the string "null". export PLERION_EXEMPTIONS_VERSION=$(curl -s "$PLERION_EXEMPTIONS_URL" \ -H "Authorization: Bearer $PLERION_API_KEY" | jq -r '.data.version // empty') ``` ##### 3. Write the whole set back Send the exemptions you read plus your addition. Anything you leave out is removed, and an empty array clears the set. Pass the version as `If-Match`. Without that header the write applies unconditionally and overwrites a concurrent change with no `412`, so omit it only when the version was `null`. Step 2 leaves the variable empty in that case, and `curl` sends no header for an empty value, so the same command works on a detection that has never been configured. ```bash theme={"system"} curl -X PUT "$PLERION_EXEMPTIONS_URL" \ -H "Authorization: Bearer $PLERION_API_KEY" \ -H "Content-Type: application/json" \ -H "If-Match: $PLERION_EXEMPTIONS_VERSION" \ -d '{ "exemptions": [ { "type": "NAME_EXEMPTION", "reason": "ACCEPTED_RISK", "condition": "starts-with", "value": "acme-sandbox-" }, { "type": "TAG_EXEMPTION", "reason": "COMPENSATING_CONTROL", "tagKey": { "option": "equals", "value": "environment" }, "tagValue": { "option": "equals", "value": "test" } } ] }' ``` A `412` means the detection's configuration changed after the version you supplied. That covers a change to its exemptions, and also a change to its severity or parameters, including one made by saving the profile in the Plerion platform. Read the exemptions again, reapply your change to what comes back, and write once more. [Explore detection exemptions APIs](https://docs.plerion.com/api-reference/detection-exemptions/get) ### Assets Plerion Assets form the basis upon which all Plerion contextual security is reported. Every unique cloud resource on which Plerion collects information is classified as a single asset on the Plerion platform. A detailed asset view combines various sources of security, compliance, and risk-related metrics to empower customers to make high-impact decisions when evaluating a single asset in relation to their overall cloud environments. [Explore assets APIs](https://docs.plerion.com/api-reference/assets/list) ### Asset groups Asset Group is classifying assets into specific group based on the different criteria such as integration, asset tag, resource type and resource name. This helps users to manage, organize, and analyze their assets more efficiently. User can group assets based on the teams, projects, business units, environments, tech stack etc. [Explore asset groups APIs](https://docs.plerion.com/api-reference/asset-groups/list) ### Alerts The Plerion Risk Score (PRS) Engine has calculated Alerts that are the highest priority items based on the available information across Identity, Configuration, and Vulnerability Management. Alerts offer the highest value CONTEXT from across the Plerion Platform. Alerts are accompanied by a narrative to guide customers on the overall risk and the recommended remediation steps to take to improve, reduce, or eradicate the identified risk. [Explore alerts APIs](https://docs.plerion.com/api-reference/alerts/list) ### Integrations Integrations enable customers to connect their own cloud environments to the Plerion platform. Integrations allow for the collection of data from the integrated environment, e.g. Connecting Plerion to your cloud service provider will facilitate Plerion to collect, analyze, and prioritize the most significant risks across your cloud operating environments. [Explore integrations APIs](https://docs.plerion.com/api-reference/integrations/list-inbound-integrations) ### Tenant The Plerion platform caters for multi-tenancy. Multi-tenancy within the Plerion platform delivers isolation for the integrations supported by Plerion. Each Tenancy (Tenant) allows for multiple inbound or outbound integrations, like integrating with Cloud Service Providers (AWS, Azure, GCP), and their corresponding Audit log service (AWS: CloudTrail, Azure: AuditLog, GCP: Cloud Audit Log). [Explore tenant APIs](https://docs.plerion.com/api-reference/tenant/get) ### Risks In a cloud environment there are usually many hundreds or thousands of misconfigurations, but which of those pose a clear and present danger of a breach? That's what the Plerion risk is about. [Explore risks APIs](https://docs.plerion.com/api-reference/risks/list) ### AWS integration In order to connect your AWS account to Plerion or update existing account, you will need, 1. **CloudFormation Template URL**. Retrieve the template from [Get CloudFormation template](https://docs.plerion.com/api-reference/aws-integration/get-cloudformation-template) 2. **External Id** of the tenant. Retrieve the External Id from [Get the external id of the tenant](https://docs.plerion.com/api-reference/aws-integration/get-external-id) 3. **Plerion AWS Account Id**. The value will always be `588158338731` 4. **Tenant Id**. Identifies your tenant when the stack registers itself with Plerion. Retrieve the tenant Id from [Get tenant details](https://docs.plerion.com/api-reference/tenant/get) 5. **Plerion API URL**. The host used by the API calls above. The value will always be `au.api.plerion.com` 6. Select **Capabilities**. Select CSPM for CSPM only capability or ALL for both CSPM and CWPP capability. 7. Select **KMSKeyAccessMode**. When CWPP is enabled, you can choose the KMS Key access mode to facilitate Plerion's access to keys for decrypting volumes, images, and lambda code. In the **ALL\_KEYS** mode, Plerion is granted access to all KMS keys in the account. However, you have the option to restrict access to certain keys by applying the "PlerionAccess: Denied" tag. Alternatively, the **SELECTED\_KEYS** mode allows Plerion access solely to the KMS keys that have been tagged with "PlerionAccess: Granted". Passing the parameters to the CloudFormation template will create a new AWS integration or update existing integration. #### Quick start Follow the guide to create a new AWS integration or update existing integration using `curl` command. **Note:** Replace `{$PLERION_API_KEY}` with your API key. ##### Create a new AWS integration ```bash theme={"system"} export PLERION_API_URL=au.api.plerion.com export PLERION_API_KEY={$PLERION_API_KEY} export PLERION_AWS_ACCOUNT_ID=588158338731 # Fetch the template URL export TEMPLATE_URL=$(curl -s GET "https://$PLERION_API_URL/v1/tenant/cloudformation-templates?type=AWSAccount" -H "Authorization: Bearer $PLERION_API_KEY" | jq -r '.data.templateURL') # Fetch the external ID export EXTERNAL_ID=$(curl -s -X GET "https://$PLERION_API_URL/v1/tenant/external-id" -H "Authorization: Bearer $PLERION_API_KEY" | jq -r '.data.externalId') # Fetch the tenant ID export TENANT_ID=$(curl -s -X GET "https://$PLERION_API_URL/v1/tenant" -H "Authorization: Bearer $PLERION_API_KEY" | jq -r '.data.tenantId') # Create the stack export PLERION_STACK_NAME=plerion-aws-integration aws cloudformation create-stack --stack-name $PLERION_STACK_NAME --template-url $TEMPLATE_URL --capabilities CAPABILITY_NAMED_IAM \ --parameters ParameterKey=ExternalId,ParameterValue=$EXTERNAL_ID \ ParameterKey=PlerionAccountId,ParameterValue=$PLERION_AWS_ACCOUNT_ID \ ParameterKey=TenantId,ParameterValue=$TENANT_ID \ ParameterKey=Capabilities,ParameterValue=ALL \ ParameterKey=KMSKeyAccessMode,ParameterValue="ALL_KEYS" # Wait for the stack to complete aws cloudformation wait stack-create-complete --stack-name $PLERION_STACK_NAME ``` ##### Update an existing AWS integration ```bash theme={"system"} export PLERION_API_URL=au.api.plerion.com export PLERION_API_KEY={$PLERION_API_KEY} export PLERION_AWS_ACCOUNT_ID=588158338731 # Fetch the template URL export TEMPLATE_URL=$(curl -s GET "https://$PLERION_API_URL/v1/tenant/cloudformation-templates?type=AWSAccount" -H "Authorization: Bearer $PLERION_API_KEY" | jq -r '.data.templateURL') # Fetch the external ID export EXTERNAL_ID=$(curl -s -X GET "https://$PLERION_API_URL/v1/tenant/external-id" -H "Authorization: Bearer $PLERION_API_KEY" | jq -r '.data.externalId') # Fetch the tenant ID export TENANT_ID=$(curl -s -X GET "https://$PLERION_API_URL/v1/tenant" -H "Authorization: Bearer $PLERION_API_KEY" | jq -r '.data.tenantId') # Update an existing stack export PLERION_STACK_NAME=plerion-aws-integration aws cloudformation update-stack --stack-name $PLERION_STACK_NAME --template-url $TEMPLATE_URL --capabilities CAPABILITY_NAMED_IAM \ --parameters ParameterKey=ExternalId,ParameterValue=$EXTERNAL_ID \ ParameterKey=PlerionAccountId,ParameterValue=$PLERION_AWS_ACCOUNT_ID \ ParameterKey=TenantId,ParameterValue=$TENANT_ID \ ParameterKey=Capabilities,ParameterValue=ALL \ ParameterKey=KMSKeyAccessMode,ParameterValue="ALL_KEYS" # Wait for the stack to complete aws cloudformation wait stack-update-complete --stack-name $PLERION_STACK_NAME ``` [Explore AWS integration APIs](https://docs.plerion.com/api-reference/aws-integration/get-external-id) ### Compliance frameworks Compliance Frameworks help our customers meet their regulatory and compliance obligations, and reduce compliance risk, enabling them to achieve their strategic objectives. Plerion offers customers hundreds of prebuilt detections delivering continuous assurance against industry standards and best practices. [Explore compliance frameworks APIs](https://docs.plerion.com/api-reference/compliance-frameworks/list) ### Well-Architected frameworks The AWS Well-Architected Framework helps customers design secure, high-performing, resilient, and efficient cloud infrastructure. Plerion continuously assesses your environment against the AWS Well-Architected pillars, aligning your architecture with AWS best practices and accelerating improvement. [Explore Well-Architected frameworks APIs](https://docs.plerion.com/api-reference/well-architected-frameworks/list) ### Code security Code security scans infrastructure-as-code before it reaches a cloud environment, so a misconfiguration is caught in the pull request rather than after deployment. Upload a Terraform, CloudFormation or Kubernetes archive to start a scan, then retrieve the findings it produced and any vulnerabilities detected in container images the templates reference. [Explore code security APIs](https://docs.plerion.com/api-reference/code-security/upload-iac) ### Audit logs Audit logs provide a comprehensive trail of user activities and system operations within a tenant. These logs capture important events such as user logins, API calls, configuration changes, and other security-relevant activities. Audit logs help with compliance, security monitoring, and troubleshooting. [Explore audit logs APIs](https://docs.plerion.com/api-reference/audit-logs/list) ### AWS access grants An access grant records the access that one of your AWS resources gives to a single principal. Plerion derives grants from resource policies, IAM role trust policies, AWS Resource Access Manager shares and cross-account share attributes, capturing the principal, the actions allowed and any conditions attached. Use these APIs to pull the inventory into your own audits or SIEM, and to record review decisions without signing in to Plerion. [Explore AWS access grants APIs](https://docs.plerion.com/api-reference/aws-access-grants/list) # Create an asset group Source: https://docs.plerion.com/api-reference/asset-groups/create /api-reference/openapi.yaml post /v1/tenant/asset-groups Create a new asset group within the tenant. You can create an asset group using filters available in Plerion or by using your existing AWS resource group. # Delete an asset group Source: https://docs.plerion.com/api-reference/asset-groups/delete /api-reference/openapi.yaml delete /v1/tenant/asset-groups/{assetGroupId} Delete a specific asset group by its ID within a tenant. This endpoint allows you to remove a particular asset group from the tenant. # Get an asset group Source: https://docs.plerion.com/api-reference/asset-groups/get /api-reference/openapi.yaml get /v1/tenant/asset-groups/{assetGroupId} Retrieve a specific asset group by its ID within a tenant. This endpoint allows you to get detailed information about a particular asset group. # List asset groups Source: https://docs.plerion.com/api-reference/asset-groups/list /api-reference/openapi.yaml get /v1/tenant/asset-groups Retrieve a list of asset groups within the tenant. By default, 20 asset groups are returned per request. # Update an asset group Source: https://docs.plerion.com/api-reference/asset-groups/update /api-reference/openapi.yaml patch /v1/tenant/asset-groups/{assetGroupId} Update a specific asset group by its ID within a tenant. This endpoint allows you to update the name and rules of a particular asset group. # Get an asset Source: https://docs.plerion.com/api-reference/assets/get /api-reference/openapi.yaml get /v1/tenant/assets/{assetId} Retrieve a specific asset by its ID within a tenant. This endpoint allows you to get detailed information about a particular asset, including optional raw data if requested. # Get an asset's SBOM Source: https://docs.plerion.com/api-reference/assets/get-sbom /api-reference/openapi.yaml get /v1/tenant/assets/{assetId}/sbom Retrieve the Software Bill of Materials (SBOM) for a specific asset identified by its ID within a tenant. This endpoint returns a URL that allows you to download the SBOM file. Asset IDs that contain a forward slash, such as GCP Cloud Functions, cannot be passed in the path; use GET /v1/tenant/assets/sbom?assetId= for those. # Get an SBOM by asset ID Source: https://docs.plerion.com/api-reference/assets/get-sbom-by-asset-id /api-reference/openapi.yaml get /v1/tenant/assets/sbom Retrieve the Software Bill of Materials (SBOM) for a specific asset, identified by its asset ID passed as a query parameter. Use this endpoint instead of GET /v1/tenant/assets/{assetId}/sbom when the asset ID contains a forward slash, such as GCP Cloud Functions. # List assets Source: https://docs.plerion.com/api-reference/assets/list /api-reference/openapi.yaml get /v1/tenant/assets Use the list assets API to filter assets across the tenant with many options from Provider, Service, Severity, Integration, etc. By default all assets are returned. # List audit logs Source: https://docs.plerion.com/api-reference/audit-logs/list /api-reference/openapi.yaml get /v1/tenant/audit-logs Use the list audit logs API to retrieve audit trail information for a tenant with filtering options. By default, all audit logs are returned with a page size of 100. You can filter by date range, user, and operation type. Date range filtering is supported using the `operationTimeStart` and `operationTimeEnd` parameters: - `operationTimeStart` alone: Includes audit logs from the specified date to the present. - `operationTimeEnd` alone: Includes audit logs up to the specified date. - Both provided: Includes audit logs within the specified date range. Date strings must follow ISO 8601 format (e.g., `2023-02-01T18:09:07Z`). # List external principals with access Source: https://docs.plerion.com/api-reference/aws-access-grants/external-principals /api-reference/openapi.yaml get /v1/tenant/aws/access-grants/external-principals Retrieve the external principals that hold access to the tenant's resources, each with its number of active grants. Ordered by grant count descending, then alphabetically by principal. # Get an AWS access grant Source: https://docs.plerion.com/api-reference/aws-access-grants/get /api-reference/openapi.yaml get /v1/tenant/aws/access-grants/{id} Fetch a single access grant by its ID. # List AWS access grants Source: https://docs.plerion.com/api-reference/aws-access-grants/list /api-reference/openapi.yaml get /v1/tenant/aws/access-grants Retrieve the tenant's active access grants, ordered by `firstObservedAt` descending. Supports filtering by origin, trust status, scope, resource and review state, with cursor-based pagination. # Get access grant counts Source: https://docs.plerion.com/api-reference/aws-access-grants/stats /api-reference/openapi.yaml get /v1/tenant/aws/access-grants/stats Retrieve totals for the tenant's active access grants, including how many are external, untrusted and cross-account. # Review an AWS access grant Source: https://docs.plerion.com/api-reference/aws-access-grants/update /api-reference/openapi.yaml patch /v1/tenant/aws/access-grants/{id} Record a review decision on a single access grant. Send only the fields you want to change. Each accepted request updates the current review state and appends an entry to the grant's review history. # Create an onboarding token for a new integration Source: https://docs.plerion.com/api-reference/aws-integration/generate-temporary-token /api-reference/openapi.yaml post /v1/tenant/integrations/token Use the API to generate a temporary token that grants restricted access to a small set of Plerion APIs. The AWS account CloudFormation template no longer takes this token. Pass your tenant Id instead, as shown in the AWS Integration quick start. ```bash curl -X POST https://au.api.plerion.com/v1/tenant/integrations/token -H "Authorization: Bearer $PLERION_API_KEY" ``` # Get the onboarding CloudFormation template Source: https://docs.plerion.com/api-reference/aws-integration/get-cloudformation-template /api-reference/openapi.yaml get /v1/tenant/cloudformation-templates Use the API to get the CloudFormation template required for creating / updating AWS integrations in Plerion. ```bash curl https://au.api.plerion.com/v1/tenant/cloudformation-templates?type=AWSAccount -H "Authorization: Bearer $PLERION_API_KEY" ``` # Get the tenant's external ID Source: https://docs.plerion.com/api-reference/aws-integration/get-external-id /api-reference/openapi.yaml get /v1/tenant/external-id Use the API to get the external ID of the tenant. The external ID is fixed for a tenant and used for cross-account access to AWS role. Read more about External Id purpose. ```bash curl "https://au.api.plerion.com/v1/tenant/external-id" -H "Authorization: Bearer $PLERION_API_KEY" ``` # List a code scan's findings Source: https://docs.plerion.com/api-reference/code-security/list-findings /api-reference/openapi.yaml get /v1/tenant/shiftleft/iac/scans/{scanId}/findings Retrieve all the findings for a scanId # List code scans Source: https://docs.plerion.com/api-reference/code-security/list-scans /api-reference/openapi.yaml get /v1/tenant/shiftleft/iac/scans Retrieve all the scans for the tenant. # List a code scan's vulnerabilities Source: https://docs.plerion.com/api-reference/code-security/list-vulnerabilities /api-reference/openapi.yaml get /v1/tenant/shiftleft/iac/scans/{scanId}/vulnerabilities Retrieve all the Vulnerabilities for a scanId # Upload infrastructure code for scanning Source: https://docs.plerion.com/api-reference/code-security/upload-iac /api-reference/openapi.yaml post /v1/tenant/shiftleft/iac/scan Use Plerion Code security IaC to scan for security vulnerabilities and compliance issues. Use the following command to upload your IaC files to the Plerion Code security IaC scanning queue: ```bash export PLERION_API_KEY=YOUR_API_KEY curl --request POST \ --location 'https://au.api.plerion.com/v1/tenant/shiftleft/iac/scan?artifactName=YOUR-ARTIFACT-NAME.zip' \ --header "Authorization: Bearer $PLERION_API_KEY" \ --header 'Content-Type: application/zip' \ --data-binary '@/Users/example.user/examples-iac/terraform.zip' ``` Replace `YOUR_API_KEY` with your actual API key and `/Users/example.user/examples-iac/terraform.zip` with the actual path to your zip file. After receiving a 202 message, retrieve the scanId and proceed to check the results by repeatedly polling [the findings endpoint](/api-reference/code-security/list-findings) with exponential backoff until the data field is not empty. **This endpoint supports the following public cloud platforms and IaC templates:** 1. Amazon Web Services (AWS) 2. Microsoft Azure 3. Google Cloud Platform (GCP) 4. Kubernetes manifests 5. Helm charts 6. Dockerfile definitions 7. Terraform configurations 8. Bicep configurations 9. Azure Resource Manager (ARM) templates 10. CloudFormation templates **Please note that this API endpoint has following limitations:** 1. Maximum file size that can be uploaded is **4.4MB.** **To work around these limitations, please consider the following:** 1. Split your IaC zip archive into smaller zip files and upload them individually. 2. If you are unable to work within these limitations, please contact support for assistance. Note: If you encounter the error code "x422Z" while using cURL, it's possible that the error is related to missing the "@" symbol when specifying the file path in the --data or --data-binary option. To resolve this error, you should double-check that you have included the "@" symbol before the file path when uploading files with cURL. # Download a compliance report Source: https://docs.plerion.com/api-reference/compliance-frameworks/download-report /api-reference/openapi.yaml get /v1/tenant/integrations/{integrationId}/compliance-frameworks/{complianceId}/download Use the download compliance framework API to receive a pre-signed URL to download a compliance framework summary report for an integration within the tenant. This URL will be valid for 1 hour. To download the report, use `curl` or any other tool of your choice. # List compliance frameworks Source: https://docs.plerion.com/api-reference/compliance-frameworks/list /api-reference/openapi.yaml get /v1/tenant/compliance-frameworks Use the list compliance frameworks API to list compliance frameworks across the tenant along with the compliance posture for each framework as well as the total compliance posture of the tenant. # Request a compliance report Source: https://docs.plerion.com/api-reference/compliance-frameworks/request-a-framework-report /api-reference/openapi.yaml post /v1/tenant/integrations/{integrationId}/frameworks/{complianceFrameworkId}/reports Starts the generation of a compliance framework report for the specified integration. Once requested, poll using the download report endpoint. # Create a custom check Source: https://docs.plerion.com/api-reference/custom-checks/create /api-reference/openapi.yaml post /v1/tenant/custom-checks Create a new custom (rego) check. The created check is returned, including its generated `customCheckId` and initial `version`. # Delete a custom check Source: https://docs.plerion.com/api-reference/custom-checks/delete /api-reference/openapi.yaml delete /v1/tenant/custom-checks/{customCheckId} Delete a custom check. The check is removed immediately; cleanup of any findings it produced drains asynchronously, so a 202 is returned. # Get a custom check Source: https://docs.plerion.com/api-reference/custom-checks/get /api-reference/openapi.yaml get /v1/tenant/custom-checks/{customCheckId} Fetch a single custom check by its ID. # Get a dry run's status Source: https://docs.plerion.com/api-reference/custom-checks/get-dry-run-status /api-reference/openapi.yaml get /v1/tenant/custom-check-dry-runs/{dryRunId} Poll a dry-run and, once complete, retrieve its preview findings. Findings are returned inline and are never persisted. # List custom checks Source: https://docs.plerion.com/api-reference/custom-checks/list /api-reference/openapi.yaml get /v1/tenant/custom-checks Retrieve the custom checks defined in the tenant. Supports filtering by asset type and target scope, with cursor-based pagination. # Start a custom check dry run Source: https://docs.plerion.com/api-reference/custom-checks/start-dry-run /api-reference/openapi.yaml post /v1/tenant/custom-check-dry-runs Execute a custom check against live assets in preview mode, without persisting findings or moving compliance state. Returns a `dryRunId`; poll the dry-run status endpoint for results. The check is supplied inline so an unsaved edit can be tested before it is created. # Replace a custom check Source: https://docs.plerion.com/api-reference/custom-checks/update /api-reference/openapi.yaml put /v1/tenant/custom-checks/{customCheckId} Replace an existing custom check in full. The updated check is returned with an incremented `version`. # Get a detection's exemptions Source: https://docs.plerion.com/api-reference/detection-exemptions/get /api-reference/openapi.yaml get /v1/tenant/profiles/{profileId}/detection-settings/{detectionId}/exemptions Read the exemptions configured for one detection on one profile, together with whether that detection accepts exemptions and which types it accepts. `version` is an opaque token to send back unchanged as `If-Match` when replacing the set. It is `null` when the detection has never been configured on this profile, and a replace request must then omit the header. Exemptions are reported as stored. A detection whose `supportsExemptions` is `false` can still hold entries written while it supported them, and you need to see them to clear them. # Replace a detection's exemptions Source: https://docs.plerion.com/api-reference/detection-exemptions/replace /api-reference/openapi.yaml put /v1/tenant/profiles/{profileId}/detection-settings/{detectionId}/exemptions Replace the whole exemption set for one detection on one profile. The body is the set you want to end up with, so read the current set, change it, and send all of it back. An empty array clears the set; there is no endpoint for a single entry and no exemption ID. Send the `version` from the read as `If-Match`. The write is then rejected with a `412` (`VersionMismatch`) if the detection's configuration changed in the meantime, so re-read and retry. Without the header the write applies unconditionally: a concurrent change is overwritten and no `412` is returned. Send it whenever the read returned a version, and omit it only when `version` was `null`, since there is then no stored configuration to match against. `version` covers the detection's whole configuration, not just its exemptions, so a change to its severity or parameters also invalidates it. Saving the profile in the Plerion platform rewrites every detection configured on it, which invalidates any version held against that profile. A non-empty set is rejected with a `400` when the detection does not accept exemptions (`ExemptionsNotSupported`) or when an entry's `type` is outside the detection's `supportedExemptionTypes` (`UnsupportedExemptionType`). Both would otherwise be stored and then never take effect. Clearing is always allowed, whatever the detection supports today. Only the exemptions change. A severity override or parameter set on the same detection is left alone, and exemptions written here apply to findings Plerion has already stored rather than waiting for the next scan. # Get one attribute schema Source: https://docs.plerion.com/api-reference/discovery/get-one-attribute-schema /api-reference/scim-openapi.yaml get /v1/organization/scim/v2/Schemas/{schemaUri} # Get one resource type Source: https://docs.plerion.com/api-reference/discovery/get-one-resource-type /api-reference/scim-openapi.yaml get /v1/organization/scim/v2/ResourceTypes/{resourceTypeId} # List attribute schemas Source: https://docs.plerion.com/api-reference/discovery/list-attribute-schemas /api-reference/scim-openapi.yaml get /v1/organization/scim/v2/Schemas # List supported resource types Source: https://docs.plerion.com/api-reference/discovery/list-supported-resource-types /api-reference/scim-openapi.yaml get /v1/organization/scim/v2/ResourceTypes # Supported SCIM protocol features Source: https://docs.plerion.com/api-reference/discovery/supported-scim-protocol-features /api-reference/scim-openapi.yaml get /v1/organization/scim/v2/ServiceProviderConfig # List findings Source: https://docs.plerion.com/api-reference/findings/list /api-reference/openapi.yaml get /v1/tenant/findings Use the list findings API to filter findings across the tenant with many options from Provider, Service, Detection, Severity, Integration, etc. By default all `PASSED` and `FAILED` findings are returned. To list only failed findings filter by `statuses=FAILED` Date range filtering is supported using the `firstObservedAtStart` and `firstObservedAtEnd` parameters: - `firstObservedAtStart` alone: Includes findings with a first observed time from the specified date to the present. - `firstObservedAtEnd` alone: Includes findings with a first observed time up to the specified date. - Both provided: Includes findings with a first observed time within the specified date range. Date strings must follow ISO 8601 format (e.g., `2023-02-01T18:09:07Z`). # Create a group Source: https://docs.plerion.com/api-reference/groups/create-a-group /api-reference/scim-openapi.yaml post /v1/organization/scim/v2/Groups Creates a user group owned by the identity provider. Grant it roles in the Plerion console. # Delete a group Source: https://docs.plerion.com/api-reference/groups/delete-a-group /api-reference/scim-openapi.yaml delete /v1/organization/scim/v2/Groups/{groupId} Deletes the group and its memberships. The roles granted to the group stop reaching its members immediately; the members are otherwise unaffected. # Get one group Source: https://docs.plerion.com/api-reference/groups/get-one-group /api-reference/scim-openapi.yaml get /v1/organization/scim/v2/Groups/{groupId} # List or filter groups Source: https://docs.plerion.com/api-reference/groups/list-or-filter-groups /api-reference/scim-openapi.yaml get /v1/organization/scim/v2/Groups Returns only the groups this API created. Pass excludedAttributes=members for large groups. # Partially update a group Source: https://docs.plerion.com/api-reference/groups/partially-update-a-group /api-reference/scim-openapi.yaml patch /v1/organization/scim/v2/Groups/{groupId} add, remove, or replace operations on members and other writable attributes. A membership change takes effect on the member's next request; nobody has to sign out. # Replace a group Source: https://docs.plerion.com/api-reference/groups/replace-a-group /api-reference/scim-openapi.yaml put /v1/organization/scim/v2/Groups/{groupId} Full replace, including the complete members list. # Search groups with a request body Source: https://docs.plerion.com/api-reference/groups/search-groups-with-a-request-body /api-reference/scim-openapi.yaml post /v1/organization/scim/v2/Groups/.search The same filtering as the list endpoint, with the parameters in the body. Works with a read key. # Quick start with Plerion API Source: https://docs.plerion.com/api-reference/index This section describes how to quickly get started with the Plerion API using curl. For a more detailed guide, see the sections below. ## Getting started with curl To check if curl is installed, execute `curl --version` in the command line. If the output is information about the version of curl, it is installed. If you get a message similar to `command not found: curl`, you need to download and install `curl`. For more information, see the [curl project download page](https://curl.se/download.html) Create a Tenant API key accessing [Tenant API Keys dashboard](https://app.plerion.com/settings/api-keys) API Key
API Name Treat your API key like a password. Do not store it as plain text or expose it in any code base. Pass your API key in an Authorization header. Replace `{PLERION_API_KEY}` with your API key. ``` export PLERION_API_URL={region}.api.plerion.com export PLERION_API_KEY=PLERION_API_KEY curl --request GET \ --url "https://$PLERION_API_URL/v1/tenant/findings" \ --header "Authorization: Bearer $PLERION_API_KEY" ``` ## Overview Plerion API uses API keys to authenticate requests. You can view and manage your API keys in the Tenant API Keys dashboard. API responses are JSON-encoded. ### Authentication To authenticate to Plerion API send the API Key using bearer auth in the Authorization header. `Authorization: Bearer $PLERION_API_KEY` All API requests must be made over HTTPS. Calls made over plain HTTP will fail. API requests without authentication will also fail. ### Errors Plerion uses conventional HTTP response codes to indicate the success or failure of an API request. In general: Codes in the 2xx range indicate success. Codes in the 4xx range indicate an error that failed given the information provided (e.g. a required parameter was omitted). Codes in the 5xx range indicate an error with Plerion's servers. Some 4xx errors that could be handled programmatically include an error code that briefly explains the error reported. Detailed description for the status code can be found in the **Response Status Codes** section. ### Response Status Codes The Plerion API endpoints return the following HTTP response status codes. | Status Code | Definition | Description | | ----------- | --------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | 200 | OK | The request has succeeded. | | 201 | Created | The request has been fulfilled and resulted in a new resource being created. | | 204 | No Content | The server has fulfilled the request but does not need to return an entity-body. | | 400 | Bad Request | The request could not be understood by the server due to malformed syntax. The client SHOULD NOT repeat the request without modifications. | | 401 | Unauthorized | The request requires user authentication. If the request already included Authorization credentials, then the 401 response indicates that authorization has been refused for those credentials. | | 403 | Forbidden | The server understood the request, but is refusing to fulfill it. Authorization will not fix the issue and the request SHOULD NOT be repeated. | | 404 | Not Found | The server has not found anything matching the Request-URI. | | 405 | Method Not Allowed | The method specified in the Request-Line is not allowed for the resource identified by the Request-URI. | | 409 | Conflict | The request could not be completed due to a conflict with the current state of the resource. | | 412 | Precondition Failed | The resource changed after the version supplied in the `If-Match` header. Read the resource again and retry the request with the version returned. | | 429 | Too Many Requests | Too many requests occurred during the allotted time period and rate limiting was applied. | | 500 | Internal Server Error | The request did not complete due to an internal error on the server side. The server encountered an unexpected condition which prevented it from fulfilling the request. | | 503 | Service Unavailable | The server is currently unable to handle the request due to a temporary overloading or maintenance of the server. | # List inbound integrations Source: https://docs.plerion.com/api-reference/integrations/list-inbound-integrations /api-reference/openapi.yaml get /v1/tenant/integrations Use the list integrations API to list all inbound integrations that have been added across the tenant. # Query metrics Source: https://docs.plerion.com/api-reference/metrics/query /api-reference/openapi.yaml post /v1/tenant/metrics Use the query metrics API to read the time series behind the Plerion dashboards. Name a namespace and one or more of its metric names, a period with an interval and an aggregation, and optionally the integrations, integration groups, asset groups, or environments to restrict the query to. The response is one entry per interval, carrying the value of every requested metric at that timestamp; a metric with no data point in an interval is reported as 0. A key whose role covers specific integrations can query only those integrations; naming another integration is refused with 403. The namespaces and the metric names the Plerion dashboards read from them: | Namespace | Metric names | |---|---| | `finding` | `failed_count`, `failed_count_by_asset_group` | | `asset` | `total_count`, `number_of_scanned_workloads`, `assets_with_critical_vulnerability_count`, `assets_with_kev_count`, `public_assets_count`, `overly_permissive_assets_count`, `admin_privileged_assets_count`, `privilege_escalation_assets_count`, and the same names with the `_by_asset_group` suffix | | `vulnerabilities` | `open_critical_vulnerabilities`, `open_high_vulnerabilities`, `open_medium_vulnerabilities`, `open_low_vulnerabilities`, `open_unknown_vulnerabilities`, and the same names with the `_by_asset_group` suffix | | `risk` | `open_count`, `open_count_by_asset_group` | | `alert` | `total_open_count`, `open_count_by_asset_group` | | `attack_path` | `total_count`, `total_count_by_asset_group` | | `compliance` | `compliance_posture_score`, `well_architected_score`, or a compliance framework ID as returned by the list compliance frameworks API, for that framework's score | | `risk_score` | `tenant_risk_score`, `integration_risk_score`, `asset_group_risk_score` | | `tenant_unit_consumption` | `tenant_unit_consumption` | Names with the `_by_asset_group` suffix are the same measure recorded per asset group. `vulnerability` is accepted as an alias of `vulnerabilities`. The request body accepts only the fields listed below; an unknown field is rejected with 400. # List profiles Source: https://docs.plerion.com/api-reference/profiles/list /api-reference/openapi.yaml get /v1/tenant/profiles Retrieve the tenant's profiles, each with the integrations it applies to. The default profile is never attached to an integration. It covers every integration that has not been given a profile of its own, and those are the integrations reported against it here. Read this list before configuring detections or exemptions, so a change reaches the accounts you meant it to. # Get a risk Source: https://docs.plerion.com/api-reference/risks/get /api-reference/openapi.yaml get /v1/tenant/risks/{riskId} Use the get risk API to retrieve one risk by its ID. By default the response carries every risk property; use `fields` to select a subset. A risk ID that does not exist answers 200 with an empty `data` object. A key whose role covers specific integrations can read only the risks of those integrations; a risk outside them is refused with 403. # List risks Source: https://docs.plerion.com/api-reference/risks/list /api-reference/openapi.yaml get /v1/tenant/risks Use the list risks API to retrieve and filter risks across the tenant. # Get what this key can call Source: https://docs.plerion.com/api-reference/tenant/discover /api-reference/openapi.yaml get /v1/tenant/openapi Use the discover API to learn which operations the calling key can call. The response is this API reference as an OpenAPI 3.1 document limited to the key's role: operations the role cannot call are left out, and each remaining operation carries the permission that authorizes it under `x-plerion-actions` and, where the permission applies to integrations, the integrations in scope under `x-plerion-integration-scope`. The document names the role under `x-plerion-role`. Any tenant API key can call this operation. A key with the Tenant admin role receives the whole reference. The answer is specific to the calling key, so cache it only for that key and only briefly. Send `Accept: application/yaml` to receive YAML instead of JSON. # Get this tenant Source: https://docs.plerion.com/api-reference/tenant/get /api-reference/openapi.yaml get /v1/tenant Use the get tenant details API to retrieve information about the tenant including tenant ID, organization ID, name, creation date, last updated date, and current risk score. # Get this tenant's usage Source: https://docs.plerion.com/api-reference/tenant/usage /api-reference/openapi.yaml get /v1/tenant/usage Use the get tenant usage API to get the usage details of the tenant. The API retrieves the total consumed Plerion units for the tenant for the specified period and additional information regarding whether the limit has been exceeded. # Create or adopt a user Source: https://docs.plerion.com/api-reference/users/create-or-adopt-a-user /api-reference/scim-openapi.yaml post /v1/organization/scim/v2/Users Creates a user, or adopts an existing Plerion user whose sign-in email (derived from the payload, case-insensitive) matches. Adoption returns 201 with the existing user's id, switches the user to identity-provider sign-in, stops password sign-in for them, and clears the roles they held, so their user groups decide their roles from then on. A break-glass administrator can be adopted like anyone else and keeps both password sign-in and their roles. A userName already used by another SCIM-managed user returns 409. # Deprovision a user Source: https://docs.plerion.com/api-reference/users/deprovision-a-user /api-reference/scim-openapi.yaml delete /v1/organization/scim/v2/Users/{userId} Deactivates the user (same access effects as active=false) and removes it from SCIM reads. The Plerion record and audit history are retained; re-provisioning the same email later restores the original user and id. # Get one user Source: https://docs.plerion.com/api-reference/users/get-one-user /api-reference/scim-openapi.yaml get /v1/organization/scim/v2/Users/{userId} # List or filter users Source: https://docs.plerion.com/api-reference/users/list-or-filter-users /api-reference/scim-openapi.yaml get /v1/organization/scim/v2/Users Returns every organization user visible to SCIM: managed users from their stored SCIM state, and unmanaged (pre-SCIM) users as synthesized resources so the identity provider can match them before adopting. Users deleted over SCIM never appear. # Partially update a user Source: https://docs.plerion.com/api-reference/users/partially-update-a-user /api-reference/scim-openapi.yaml patch /v1/organization/scim/v2/Users/{userId} RFC 7644 PatchOp. Setting active to false deactivates the user: sign-in blocked, sessions ended within seconds, the user's API keys revoked. The record and audit history are retained. # Replace a user Source: https://docs.plerion.com/api-reference/users/replace-a-user /api-reference/scim-openapi.yaml put /v1/organization/scim/v2/Users/{userId} Full replace of writable attributes; omitted writable attributes are cleared. id, groups, and meta are immutable. The first write to a Plerion user not yet under management adopts them, with the same effects as an adopting create. # Search users with a request body Source: https://docs.plerion.com/api-reference/users/search-users-with-a-request-body /api-reference/scim-openapi.yaml post /v1/organization/scim/v2/Users/.search Allowed with read-level keys. # Create a vulnerability exemption Source: https://docs.plerion.com/api-reference/vulnerabilities/create-a-vulnerability-exemption-in-a-profile /api-reference/openapi.yaml post /v1/tenant/profiles/{profileId}/vulnerability/exemptions Creates an exemption definition scoped to the given profile. Use it to suppress specific vulnerabilities. # Delete a vulnerability exemption Source: https://docs.plerion.com/api-reference/vulnerabilities/delete-a-vulnerability-exemption-by-id /api-reference/openapi.yaml delete /v1/tenant/profiles/{profileId}/vulnerability/exemptions/{id} Deletes a specific vulnerability exemption by its ID. # Get a vulnerability exemption Source: https://docs.plerion.com/api-reference/vulnerabilities/get-a-vulnerability-exemption-by-id /api-reference/openapi.yaml get /v1/tenant/profiles/{profileId}/vulnerability/exemptions/{id} Retrieves a specific vulnerability exemption by its ID. # List vulnerabilities Source: https://docs.plerion.com/api-reference/vulnerabilities/list /api-reference/openapi.yaml get /v1/tenant/vulnerabilities Use the list vulnerabilities API to filter vulnerabilities across the tenant with many options from Organization, Tenant, Integration, Asset, Severity, etc. By default all vulnerabilities are returned. Date range filtering is supported using the `firstObservedAtStart` and `firstObservedAtEnd` parameters: - `firstObservedAtStart` alone: Includes vulnerabilities observed from the specified date to the present. - `firstObservedAtEnd` alone: Includes vulnerabilities observed up to the specified date. - Both provided: Includes vulnerabilities observed within the specified date range. Date strings must follow ISO 8601 format (e.g., `2023-02-01T18:09:07Z`). # List vulnerability exemptions Source: https://docs.plerion.com/api-reference/vulnerabilities/list-vulnerability-exemptions-in-a-profile /api-reference/openapi.yaml get /v1/tenant/profiles/{profileId}/vulnerability/exemptions Lists all vulnerability exemptions scoped to the given profile with pagination support. # Update a vulnerability exemption Source: https://docs.plerion.com/api-reference/vulnerabilities/update-a-vulnerability-exemption-by-id /api-reference/openapi.yaml patch /v1/tenant/profiles/{profileId}/vulnerability/exemptions/{id} Updates a specific vulnerability exemption by its ID. All fields are optional for partial updates. # Download a Well-Architected report Source: https://docs.plerion.com/api-reference/well-architected-frameworks/download-report /api-reference/openapi.yaml get /v1/tenant/integrations/{integrationId}/well-architected-frameworks/{wellArchitectedFrameworkId}/download Use the download well-architected framework API to obtain a pre-signed URL for downloading a well-architected framework summary report for an integration within the tenant. This URL will be valid for 1 hour. To download the report, use `curl` or any other tool of your choice. # List Well-Architected frameworks Source: https://docs.plerion.com/api-reference/well-architected-frameworks/list /api-reference/openapi.yaml get /v1/tenant/well-architected-frameworks Returns all AWS Well-Architected Frameworks for the tenant, along with individual framework postures and the tenant’s overall Well-Architected posture. # Request a Well-Architected report Source: https://docs.plerion.com/api-reference/well-architected-frameworks/request-framework-report /api-reference/openapi.yaml post /v1/tenant/integrations/{integrationId}/frameworks/{wellArchitectedFrameworkId}/reports Starts the generation of a Well-Architected framework report for the specified integration. Once requested, poll using the download report endpoint. # Get a workload scan Source: https://docs.plerion.com/api-reference/workload-scans/get /api-reference/openapi.yaml get /v1/tenant/workload/scans/{scanId} Use the get workload scan API to read the status of a scan requested with the request workload scan API. Poll it until `status` is `SUCCESSFUL`, `COMPLETED`, `COMPLETED_WITH_ERRORS`, or `FAILED`. # Request a workload scan Source: https://docs.plerion.com/api-reference/workload-scans/request /api-reference/openapi.yaml post /v1/tenant/workload/scans Use the request workload scan API to scan one workload now instead of waiting for the next scheduled scan. Name the integration and either the Plerion asset ID of the workload or the provider's resource type, region, and ID. Supported resource types are EC2 instances (`ec2:instance`) and AMIs (`ec2:image`). The response carries the scan ID to poll with the get workload scan API. If a scan of the same workload is already pending, its ID is returned instead of starting another. A key whose role covers specific integrations can request scans only in those integrations. # Changelog Source: https://docs.plerion.com/changelog See what's new at Plerion as we deliver features to keep your code and cloud safe. *** 1. **Onboard with Terraform and scan in a service account you own:** Terraform onboarding now offers all three ways to run workload scanning, including a service account you own and Plerion operates. Scanning stays inside your organization, and the accounts being scanned run no appliances of their own. [Learn more →](/guides/integrations/aws/terraform/getting-started-with-terraform) 2. **Set the service account up with Terraform as well:** Two templates provision it. One grants the access Plerion needs, and one runs for each region you scan in, building the appliance network, the pool that grows and shrinks with the scan queue, and the key their snapshots are encrypted with. Both register with Plerion while `terraform apply` runs, so there is nothing to paste back into the console. [Learn more →](/guides/integrations/aws/terraform/getting-started-with-terraform#set-up-a-service-account-with-terraform) *** 1. **SCIM provisioning:** Okta, Microsoft Entra ID, or any SCIM 2.0 identity provider can now create, update, and deactivate Plerion users. Existing users with a matching email address are adopted and sign in through your identity provider from then on. [Learn more →](/guides/administration/scim/overview) 2. **User groups:** Grant roles to a group and every member holds them. Groups can be synced from your identity provider over SCIM or created in Plerion. [Learn more →](/guides/administration/user-groups) 3. **Organization API keys:** API keys scoped to the whole organization, with `read` or `readWrite` access. Your identity provider uses one for SCIM provisioning. [Learn more →](/guides/administration/organization-api-keys) 4. **Break-glass admins:** Organization admins who can always sign in with a password and cannot be deactivated by your identity provider. At least one is required while single sign-on or SCIM is enabled. [Learn more →](/guides/administration/scim/overview#break-glass-admins) *** 1. **Google Cloud workload security:** Plerion now scans what runs inside your GCP workloads: Compute Engine instances, managed instance groups, and custom images, plus Cloud Run services and Cloud Functions (1st and 2nd gen), for vulnerabilities, software bill of materials, and secrets left behind. Every scan runs in a scanning project inside your own organization. [Learn more →](/guides/integrations/gcp/workload-scanning/overview) Access stays keyless through workload identity federation (WIF). [Access and permissions →](/guides/integrations/gcp/workload-scanning/access-and-permissions) *** 1. **The Kubernetes collector manager runs on arm64:** The collector manager image is now published for `amd64` and `arm64`, so it runs on Graviton node pools without adding an x86 node just for Plerion. It ships as a multi-architecture image, so each node pulls the variant it needs and a cluster running both needs no `nodeSelector`. [Learn more →](/guides/integrations/kubernetes/collector-manager) 2. **Integration groups for your AWS accounts:** Choose the AWS Organizations tag keys that matter to you in `Settings` > `Integration groups`, and every value becomes a group whose membership keeps up as accounts are tagged, retagged, and onboarded. Then filter by integration group across the platform, from findings and assets to dashboards, reports, and workflows. [Learn more →](/guides/platform/integration-groups) *** 1. **Vulnerability auto-triage (experimental):** Plerion can now lower the severity of vulnerabilities whose weakness type limits the harm they can cause. Ten rules cover cases like kernel CVEs found in container images, weaknesses MITRE records as only ever exhausting memory, and faults that need physical access to the hardware. Depending on the estate, 45% to 66% of Critical and High findings move to a lower severity. Nothing is hidden or deleted, the advisory severity is kept, and each change is explained on the finding. Enable it per profile. [Learn more →](/guides/platform/cwpp/vulnerability-auto-triage) *** 1. **Kubernetes identities now carry privilege context:** Ask which identities in your estate can escalate to administrator and the answer now includes Kubernetes alongside AWS. Plerion tags Kubernetes service accounts, nodes, workloads, and the role bindings that grant them with administrator privileges, susceptible to privilege escalation, and overly permissive privileges, so they appear in the same asset filters, risk scores, notification rules, and workflow conditions your cloud assets already use. [Learn more →](/guides/platform/plerion-risk-score/asset-risk-score) 2. **Identities carry the privileges they hold:** A Deployment running as an administrator service account is an administrator, and so is the account itself. Plerion puts a privilege on the service account that holds it, on the node that holds it, and on every Deployment, DaemonSet, StatefulSet, Job, CronJob, and Pod running as that account. A workload picks it up only when the account's token is mounted into the pod, because without that token the container holds none of the account's permissions. Ten new checks ship with this: * **\[PLERION-K8S-177]** Ensure no role binding grants cluster administrator * **\[PLERION-K8S-178]** Ensure no workload runs with a service account that has cluster administrator privileges * **\[PLERION-K8S-179]** Ensure no workload runs with a service account that can escalate its privileges * **\[PLERION-K8S-180]** Ensure no workload runs with a service account that has overly permissive privileges * **\[PLERION-K8S-181]** Ensure no service account has cluster administrator privileges * **\[PLERION-K8S-182]** Ensure no service account can escalate its privileges * **\[PLERION-K8S-183]** Ensure no service account has overly permissive privileges * **\[PLERION-K8S-184]** Ensure no node has cluster administrator privileges * **\[PLERION-K8S-185]** Ensure no node can escalate its privileges * **\[PLERION-K8S-186]** Ensure no node has overly permissive privileges *** 1. **Review external access to AWS with resource access grants:** A resource access grant is one way a single resource grants access to a single principal, such as an AWS account, a federated identity, an AWS service, or the public. Plerion now builds this inventory for every tenant, analyzing 97 AWS resource types across four sharing mechanisms: resource policies, role trust policies, Resource Access Manager (RAM) shares, and cross-account permissions set directly as an attribute. [Learn more →](/guides/platform/resource-access-grants/overview) 2. **Perform access reviews end to end:** You can export access grants to a spreadsheet or do the whole access review inside Plerion. Name the team accountable for a grant, record a `Keep`, `Remove`, `Review later`, or `Trust until review` decision, note why the access exists, and set the date to look again. Every change is kept in the grant's history, and the `Past due` preset shows the grants whose review date has passed. [Learn more →](/guides/platform/resource-access-grants/access-review) 3. **Expect a wave of untrusted external access findings on the first scan:** Plerion raises a finding for every asset that grants access to an external principal you have not confirmed as trusted, and your trusted principals list starts almost empty. Much of that first wave is often access you meant to grant. Set your trusted principals in `Settings` > `Profiles` > `Trusted principals`, or ask Pleri for help, before working the findings one by one. [Learn more →](/guides/platform/resource-access-grants/trusted-principals) *** 1. **Detection exemptions, now over the API:** Read the exemptions on any detection, write a new set, or clear them, without opening the platform. Match on asset name, tags, region, principal, or API Gateway route, and the findings already on your dashboard are re-evaluated rather than waiting for the next scan. List your profiles first, since the default profile covers only the integrations that have no profile of their own.\ [Learn more →](/api-reference/detection-exemptions/get) *** 1. **Plerion's compliance frameworks, rebuilt against today's detections:** Plerion has re-mapped 40 of its compliance frameworks from scratch against the current detection catalog, producing 15,250 control-to-detection mappings. Eighteen move to the publisher's latest edition, including PCI DSS 4.0.1, NIST SP 800-53 Rev 5 Release 5.2.0, CSA CAIQ v4.1, UK NCSC CAF 4.0, and the FedRAMP Rev 5 CR26 baselines. The other 22 keep their edition and gain current coverage, and 29 frameworks now include Kubernetes checks alongside AWS, Azure, and GCP. Because each of these mappings was rebuilt rather than patched, your posture percentages will shift in both directions. They now reflect what Plerion detects today. [Learn more →](/guides/platform/compliance-frameworks) 2. **Superseded framework editions have been retired:** Where a newer edition now ships, the edition it replaces has been switched off so you no longer see two copies of the same standard. This covers 23 entries, among them PCI DSS 4.0 and 3.2.1, both retired by the PCI Security Standards Council, plus NIST CSF v1.1, ISO/IEC 27001:2013, and FFIEC CAT, which its publisher withdrew in August 2025. A retired edition disappears from your framework list, though its existing mappings are preserved and nothing is deleted. If you were tracking one, its successor is in your list ready to use: some are already switched on, and the jurisdiction- or sector-specific ones are yours to enable when you need them. FFIEC is the exception, as it has no successor. 3. **CIS Amazon Web Services Foundations Benchmark v7.0.0 is now available:** Measure your AWS accounts against the newest edition of the benchmark, published in March 2026. All 70 recommendations are mapped to Plerion detections, including six new AWS Organizations controls covering centralized root access, authorization guardrails, organizational unit structure, and delegated administrators, plus a new check for reaching AWS services over VPC endpoints. Every recommendation carries its CIS Level 1 or Level 2 profile. Version 4.0.1 is retired in line with the change above, so your list shows a single current edition. 4. **FedRAMP 20x Key Security Indicators is now available:** Measure your cloud against all 46 Key Security Indicators in the FedRAMP Consolidated Rules for 2026, the indicator set behind the FedRAMP 20x certification path. Plerion maps 33 of them to detections across AWS, Azure, GCP, and Kubernetes; the other 13 are process and governance controls, such as confirming that training or incident response procedures stay effective, and each says so on the control instead of showing a false pass. FedRAMP 20x runs alongside the Rev 5 baselines, so your existing FedRAMP frameworks are untouched. [Learn more →](/guides/platform/compliance-frameworks) *** 1. **GCP access is now fully Plerion-curated:** The GCP organization integration grants its organization-wide access through a Plerion-defined custom role, built from a curated, reviewed permission manifest. The role reads only configuration and metadata, never data contents. Plerion screens every new permission Google introduces before it can be granted. [Learn more →](/guides/integrations/gcp/overview) *** 1. **Pleri now raises pull requests in Azure DevOps:** Ask Pleri to fix a high or critical IaC issue in an Azure DevOps repository and she'll open the pull request for you, then check its status, request a review, or abandon it with a reason. Azure DevOps speaks its own dialect and so does Pleri: pull requests get reviewers, not assignees, and they're abandoned, not closed. [Learn more →](/guides/integrations/azure-devops#fixing-issues-with-pleri) *** 1. **Privilege escalation findings on IAM policies are now Low:** A policy has no effect until it is attached to an identity, and we already report the roles, users, and groups that hold it at full severity. Expect roughly four in ten of your **\[PLERION-AWS-1013]** findings to move to Low. Nothing is removed. *** 1. **GCP AI coverage widens further:** Plerion ships 46 new posture checks across Vertex AI, Vertex AI Workbench and Colab Enterprise, Agent Engine, Vertex AI Search and Gemini Enterprise, Model Armor, Dialogflow CX, Cloud TPU, and Gemini Code Assist, plus project-level org-policy guardrails for Vertex AI Workbench access and Model Garden model use. Asset discovery now also covers 16 new GCP resource types behind these services. *** 1. **Onboard AWS accounts with Terraform:** Deploy Plerion straight from your own Terraform. A new template provisions the IAM role and policies as native Terraform resources and registers the integration automatically, with no manual console step and no CloudFormation stack in your account. Choose whether workload scanning runs inside your account or through a Plerion-managed service account, and apply the template across every account you manage with Terraform. 2. **Know what's inside your Kubernetes workloads:** Workload scanning now builds a software bill of materials (SBOM) for every container image behind your Deployments, DaemonSets, StatefulSets, Pods, Jobs, and CronJobs, so the full package inventory sits on the asset's SBOM tab. Switch on secret scanning and Plerion also reports the API keys, tokens, and passwords left inside those images on the asset's Sensitive data tab, with severity so you know what to rotate first. Pick the scan types when you connect a cluster, or change them anytime from the integration's workload scan settings. [Learn more →](/guides/platform/cwpp/scanning-coverage/sbom) *** 1. **Connect your entire GCP organization at once:** Plerion now onboards a whole Google Cloud organization from a single generated command, with no service account keys and nothing to fill in first. The onboarding script finds your organization, creates the Plerion service project, and sets up keyless access using Workload Identity Federation. If you prefer infrastructure as code, an equivalent Terraform template does the same job. Plerion then discovers every project in the organization, including ones created later, and you choose which projects to include or let everything onboard automatically. The organization itself is scanned too, from organization details and organization-level IAM policy to folders, organization policies, and VPC Service Controls service perimeters. Revoke access anytime by deleting a single resource. [Learn more →](/guides/integrations/gcp/overview)