https://live.paloaltonetworks.com/t5/%E9%85%8D%E7%BD%AE%E5%92%8C%E5%AE%9E%E6%96%BD/%E5%A6%82%E4%BD%95%E9%80%9A%E8%BF%87%E8%AD%A6%E6%8A%A5%E8%A7%84%E5%88%99%E9%AB%98%E7%BA%A7%E8%AE%BE%E7%BD%AE%E6%8E%92%E9%99%A4%E4%BA%91%E8%B4%A6%E6%88%B7/ta-p/527873 <DIV class="lia-message-template-content-zone"> <P><FONT color="#FF6600"><STRONG>目标</STRONG></FONT></P> <P>问题 - 用户正试图通过RQL排除调查页面上的一个云账户。当他试图在查询中添加 cloud.account != "XXX "时，他无法排除来自云账户的结果。</P> <P>&nbsp;</P> <P><FONT color="#FF6600"><STRONG>环境</STRONG></FONT></P> <P>Prisma Cloud</P> <P><SPAN>&nbsp;</SPAN></P> <P><FONT color="#FF6600"><STRONG>流程</STRONG></FONT></P> <P>配置扫描器会忽略cloud.account, cloud.accountgroup, cloud.region以及任何其他限制账户或区域的条件。这是因为那些应该由警报规则(Alert Rule)来配置。因此，要使自定义策略不产生云帐户，必须在警报规则中排除它。</P> <P>&nbsp;</P> <P>要在警报规则中排除云账户，请通过 "高级设置"。这将为该警报规则的云资源触发警报添加更多的粒度：排除云账户 - 如果在选定的账户组中有一些云账户您不想触发警报，请从列表中选择这些账户。</P> <P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="1.png" style="width: 999px;"><img src="https://live.paloaltonetworks.com/t5/image/serverpage/image-id/47241i7D7127E65FFCE73F/image-size/large?v=v2&amp;px=999" role="button" title="1.png" alt="1.png" /></span></P> <P>&nbsp;</P> <P><STRONG>其他信息</STRONG></P> <P><A href="https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-admin/manage-prisma-cloud-alerts/create-an-alert-rule" target="_blank" rel="noopener">为运行时检查创建一个警报规则(Create an Alert Rule for Run-Time Checks)</A></P> </DIV> Fri, 20 Jan 2023 02:12:30 GMT Wei_Zhang 2023-01-20T02:12:30Z https://live.paloaltonetworks.com/t5/%E9%85%8D%E7%BD%AE%E5%92%8C%E5%AE%9E%E6%96%BD/%E5%A6%82%E4%BD%95%E9%80%9A%E8%BF%87%E8%AD%A6%E6%8A%A5%E8%A7%84%E5%88%99%E9%AB%98%E7%BA%A7%E8%AE%BE%E7%BD%AE%E6%8E%92%E9%99%A4%E4%BA%91%E8%B4%A6%E6%88%B7/ta-p/527873 <DIV class="lia-message-template-content-zone"> <P><FONT color="#FF6600"><STRONG>目标</STRONG></FONT></P> <P>问题 - 用户正试图通过RQL排除调查页面上的一个云账户。当他试图在查询中添加 cloud.account != "XXX "时，他无法排除来自云账户的结果。</P> <P>&nbsp;</P> <P><FONT color="#FF6600"><STRONG>环境</STRONG></FONT></P> <P>Prisma Cloud</P> <P><SPAN>&nbsp;</SPAN></P> <P><FONT color="#FF6600"><STRONG>流程</STRONG></FONT></P> <P>配置扫描器会忽略cloud.account, cloud.accountgroup, cloud.region以及任何其他限制账户或区域的条件。这是因为那些应该由警报规则(Alert Rule)来配置。因此，要使自定义策略不产生云帐户，必须在警报规则中排除它。</P> <P>&nbsp;</P> <P>要在警报规则中排除云账户，请通过 "高级设置"。这将为该警报规则的云资源触发警报添加更多的粒度：排除云账户 - 如果在选定的账户组中有一些云账户您不想触发警报，请从列表中选择这些账户。</P> <P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="1.png" style="width: 999px;"><img src="https://live.paloaltonetworks.com/t5/image/serverpage/image-id/47241i7D7127E65FFCE73F/image-size/large?v=v2&amp;px=999" role="button" title="1.png" alt="1.png" /></span></P> <P>&nbsp;</P> <P><STRONG>其他信息</STRONG></P> <P><A href="https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-admin/manage-prisma-cloud-alerts/create-an-alert-rule" target="_blank" rel="noopener">为运行时检查创建一个警报规则(Create an Alert Rule for Run-Time Checks)</A></P> </DIV> Fri, 20 Jan 2023 02:12:30 GMT https://live.paloaltonetworks.com/t5/%E9%85%8D%E7%BD%AE%E5%92%8C%E5%AE%9E%E6%96%BD/%E5%A6%82%E4%BD%95%E9%80%9A%E8%BF%87%E8%AD%A6%E6%8A%A5%E8%A7%84%E5%88%99%E9%AB%98%E7%BA%A7%E8%AE%BE%E7%BD%AE%E6%8E%92%E9%99%A4%E4%BA%91%E8%B4%A6%E6%88%B7/ta-p/527873 Wei_Zhang 2023-01-20T02:12:30Z