topic RQL Query to search for suspicious activity on specific S3 Bucket in Prisma Cloud Discussions

RQL Query to search for suspicious activity on specific S3 Bucket

RDunsirn23 — Thu, 28 Sep 2023 16:18:30 GMT

We have a specific S3 bucket that we'd like to watch for events and alert on them. I've used this query:

event from cloud.audit_logs where operation IN ( 'AddUserToGroup', 'AttachGroupPolicy', 'AttachGroupPolicy', 'AttachUserPolicy' , 'AttachRolePolicy' , 'CreateAccessKey', 'CreateKeyPair', 'DeleteKeyPair', 'DeleteLogGroup' )

but need to modify it to only query if events happen on a specific S3 bucket (not on all buckets). Anyone know how I can add to this RQL query to only query against the specific S3 bucket?

Thanks!

Re: RQL Query to search for suspicious activity on specific S3 Bucket

srnair — Thu, 28 Sep 2023 18:43:41 GMT

Hello RDunsirn23,

Can you check if the below RQL query works for your use case

event from cloud.audit_logs where cloud.service = 's3.amazonaws.com' AND json.rule = $.requestParameters.bucketName = "<bucket_name>"

Here, replace the bucket name with the S3 bucket name and this should generate an alert anytime any event is performed on the bucket. You can filter this further such that alerts are generated only for specific events by using operation IN ( '<API name>')
Refer Event Query attributes doc to learn about the different attributes for event query.

Re: RQL Query to search for suspicious activity on specific S3 Bucket

RDunsirn23 — Thu, 28 Sep 2023 19:00:42 GMT

Thank you! I will try this out.