topic Would love some filter help for IP Address in Prisma Cloud Discussions

Would love some filter help for IP Address

MHale4 — Wed, 20 Apr 2022 15:33:09 GMT

Hi guys,

So I know how to query EC2 instances for the private IP address, and that works fine.

I've come across a situation where I see an IP address in our AWS subnets doing something, but I can't track down what it is. It is not attached to an EC2 instance, it's something else. But I can't find any type of query that basically says: Give me any and all objects that contain IP 1.2.3.4.

How would I go about doing this?

Thank you much!

Re: Would love some filter help for IP Address

JJoly — Wed, 09 Mar 2022 15:25:28 GMT

Hello @MHale4,

Is this query could help you ?

config from cloud.resource where cloud.type = 'AWS' AND json.rule = privateIpAddress exists AND privateIpAddress contains "X.X.X.X"

Replace "X.X.X.X" with your IP adsress.

Re: Would love some filter help for IP Address

MHale4 — Thu, 07 Apr 2022 06:19:02 GMT

YOU ROCK. This was exactly the query that I needed.