topic Re: How to check a resource still exists and not been deleted in Prisma Cloud Discussions

How to check a resource still exists and not been deleted

MPestell — Wed, 02 Sep 2020 18:11:10 GMT

Hi guys.

I am looking at a implementation that has been running for over a year - however little work has been done just yet. The system has 54000 OPEN alerts. I want to check which alerts are still valid (ie. do the resource at the end of the alert even exist anymore?) Is it possible to do that from within REDLOCK/Prism please?

Re: How to check a resource still exists and not been deleted

ebeuerlein — Mon, 19 Aug 2019 16:55:26 GMT

For this specific circumstance, I would disable all alert rules and let the alerts auto-resolve themselves(this could take a couple of hours). Then I would re-enable the alerts. This will cause the system to re-evaluate the alerts based on the most current data and it will re-open any alerts that still have existing resources triggering them. I would not advise doing this normally but since this implementation hasn't been really used in over a year this might be a good way to go.

Re: How to check a resource still exists and not been deleted

lpingali — Mon, 19 Aug 2019 16:57:21 GMT

Are these alerts present in RedLock/Prisma Cloud or elsewhere? Prisma Cloud will resolve the open alerts, if the resource has been deleted or updated with recommended steps.

Re: How to check a resource still exists and not been deleted

MPestell — Tue, 20 Aug 2019 10:53:00 GMT

Thank you a good tip and appreciate not perhaps best practise but a good way to clear the old info.

Re: How to check a resource still exists and not been deleted

MPestell — Tue, 20 Aug 2019 10:53:51 GMT

Thank you. For clarity where are those recommended steps?? Do you mean just AWS/AZURE steps or something specific with Prisma please?

Re: How to check a resource still exists and not been deleted

lpingali — Wed, 06 Nov 2019 19:20:09 GMT

Prisma CLoud best practices.