topic Re: Query to alert when EBS data volume is de-attached from and EC2 instance in Prisma Cloud Discussions

Query to alert when EBS data volume is de-attached from and EC2 instance

bmurali — Wed, 02 Sep 2020 17:16:33 GMT

Looking for help with the right RQL to

alert when any EBS data volume is de-attached from an EC2 instance

Re: Query to alert when EBS data volume is de-attached from and EC2 instance

jrieger — Mon, 03 Jun 2019 00:42:48 GMT

This is a built-in policy:

"AWS EBS Volume is unattached"

RQL:

config where cloud.type = 'aws' AND api.name = 'aws-ec2-describe-volumes' AND json.rule = attachments[*] all empty or attachments[*].state does not contain "attached"

Re: Query to alert when EBS data volume is de-attached from and EC2 instance

bmurali — Mon, 03 Jun 2019 02:29:58 GMT

Thanks for the query.

However, Question was about the detection event, if there was any volume de-attached. Later on, maybe that was left in the de-attached state or may be attached to another machine or attached to the same machine.

This query provided simply returns the de-attached volume list.

We might have to look at audit events.

Re: Query to alert when EBS data volume is de-attached from and EC2 instance

ebeuerlein — Mon, 03 Jun 2019 14:19:33 GMT

This should get you started:

event where operation = 'DetachVolume'

If you are looking for a specific user doing the action, you can add subject or role using the AND function.