Need RQL to exclude NAT Gateway in alerts

LaserFocus — Wed, 02 Sep 2020 17:19:15 GMT

I’m looking at some rules that detect traffic on ports and it seems to flag a lot of traffic to AWS resource like the NAT gateway that we do not control.

Is it possible to exclude these based on the resource type?

For example:

Remove Network - Internet traffic over insecure port (22)
Exclude Network - Internet traffic (21,23,80,443,8444,8443,22)

How do I compose the RQL?

Re: Need RQL to exclude NAT Gateway in alerts

jeisenhart — Wed, 21 Aug 2019 19:21:29 GMT

The RQL needs constraints to exclude NAT Gateway and ELB.

Please try:

network where src.ip=0.0.0.0 AND protocol=‘TCP’ AND dest.port not IN (21,23,80,443,8444,8443,22) AND source.publicnetwork IN ( ‘Internet IPs’ , ‘Suspicious IPs’ ) AND dest.resource IN ( resource where role not in ( ‘AWS NAT Gateway’ , ‘AWS ELB’ )

network where src.ip=0.0.0.0 AND protocol=‘TCP’ AND dest.port IN (21,22,23,80) AND source.publicnetwork IN ( ‘Internet IPs’ , ‘Suspicious IPs’ ) AND dest.resource IN ( resource where role not in ( ‘AWS NAT Gateway’ , ‘AWS ELB’ ) )

topic Need RQL to exclude NAT Gateway in alerts in Prisma Cloud Discussions

Need RQL to exclude NAT Gateway in alerts

Re: Need RQL to exclude NAT Gateway in alerts