topic Re: RQL to identify if logging is disabled within a project in GCP in Prisma Cloud Discussions

RQL to identify if logging is disabled within a project in GCP

FAjah — Fri, 11 Aug 2023 10:54:22 GMT

Need help with the RQL to alert when the "state": "DISABLED"

{"name": "*/logging.googleapis.com",

"state": "ENABLED",

"parent": "projects/*"

Re: RQL to identify if logging is disabled within a project in GCP

JayGolf — Tue, 15 Aug 2023 08:11:00 GMT

Hi @FAjah ,

Here is the Prisma Cloud Resource Query Language Reference that may assist you. Hope this helps!

Re: RQL to identify if logging is disabled within a project in GCP

OOmotayo — Tue, 12 Sep 2023 04:24:49 GMT

Hello,

You can use the below RQL to list projects with logging APIs. However, you may need to check the resource config JSOn to confirm it enabled or disabled.

config from cloud.resource where api.name = 'gcloud-services-list' AND json.rule = services[*].name contains "logging.googleapis.com"