topic Re: RQL to check ALL the virtual machines and service accounts in differents clouds. Prisma Cloud in Prisma Cloud Discussions

RQL to check ALL the virtual machines and service accounts in differents clouds. Prisma Cloud

jquijada — Mon, 19 Feb 2024 13:37:54 GMT

Hello Community.

I need your help. I need a RQL in prisma cloud to check ALL my virtual machines and service accounts. The RQL should be work to GCP, AWS, Azure and OCI cloud.
It's possible? I wanna check in a new custom policy all my VMs and service accounts. Hope you can help me.
Regards.

Re: RQL to check ALL the virtual machines and service accounts in differents clouds. Prisma Cloud

bpachauli — Thu, 21 Mar 2024 16:52:07 GMT

Hello, not via RQL, but with the newly revamped platform, you can choose a asset-based query within investigate and perform that. (screenshot below)

Re: RQL to check ALL the virtual machines and service accounts in differents clouds. Prisma Cloud

jquijada — Thu, 21 Mar 2024 17:43:23 GMT

After worked with CES palo alto. I found the below RQLs:

The RQLs for the four cloud types would be (Virtual Machine):
1- event from cloud.audit_logs where cloud.type = 'aws' AND crud IN ( 'create', 'update', 'delete' ) and operation matches 'Instance'

2- event from cloud.audit_logs where cloud.type = 'azure' AND crud IN ( 'create', 'update', 'delete' ) AND operation matches 'virtual machine'

3- event from cloud.audit_logs where cloud.type = 'gcp' AND crud IN ( 'create', 'update', 'delete' ) and operation matches 'compute.instance'

4- OCI does not support even based RQLs, hence the RQL that we could come up with is:
config from cloud.resource where cloud.type = 'oci' AND api.name = 'oci-compute-instance'

And Service Accounts:

OCI:
config from cloud.resource where cloud.type = 'oci' AND cloud.service = 'OCI IAM' AND api.name = 'oci-iam-user' AND json.rule = (apiKeys[*] is not empty or authTokens[*] is not empty)
Azure:
config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-active-directory-app-registration' AND json.rule = servicePrincipalLockConfiguration exists