topic [RQL] How to construct a query to investigate on all AWS Security Groups that has outbound to 0.0.0.0 in Prisma Cloud Discussions

[RQL] How to construct a query to investigate on all AWS Security Groups that has outbound to 0.0.0.0

rogerhuang — Mon, 26 Feb 2024 06:43:36 GMT

Reference: https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-security-groups.html

RQL that is not working: config from cloud.resource where cloud.type = 'aws' AND api.name = 'describe-security-groups' AND json.rule = "IpPermissionsEgress[IpRanges[?any (CidrIp equals 0.0.0.0/0)]]"

Does not seems to be right. Need RQL expert here! Thanks

Re: [RQL] How to construct a query to investigate on all AWS Security Groups that has outbound to 0.0.0.0

rogerhuang — Mon, 26 Feb 2024 08:21:47 GMT

Somehow figure out something like this and so far no error.

config from cloud.resource where api.name = 'aws-ec2-describe-security-groups' and json.rule = (($.ipPermissions[?(@.ipProtocol==-1)].ipRanges[*] contains 0.0.0.0/0 or $.ipPermissions[?(@.ipProtocol==-1)].ipv6Ranges[*].cidrIpv6 contains ::/0))

Re: [RQL] How to construct a query to investigate on all AWS Security Groups that has outbound to 0.0.0.0

ACurran2 — Wed, 28 Feb 2024 21:34:09 GMT

That works. Or a more simplified version of the query to only look for ipv4 outbound to 0.0.0.0/0 could be:

config from cloud.resource where cloud.type = 'aws' AND api.name = 'aws-ec2-describe-security-groups' AND json.rule = '((ipPermissionsEgress[*] equals 0.0.0.0/0))'