topic Re: RQL query to check for any Change in role for Instance in Prisma Cloud Discussions

RQL query to check for any Change in role for Instance

APaul — Fri, 11 Mar 2022 16:51:38 GMT

I am trying to create an RQL query, which will check if anyone attaches or modify roles to an AWS instance.

I am using the below Query :

event where cloud.account = 'My-AWS' AND operation = 'AddRoleToInstanceProfile'

I did some testing on one of the instances. However, I am not able to get any result.

Please help on the correct RQL

kchen — Fri, 21 Jun 2019 14:56:53 GMT

I was able to find results with that operation, so I don't think RQL is the issue. Are you sure the events for your AWS instance is being ingested?

VPackeriswamy — Fri, 18 Feb 2022 18:24:01 GMT

Hi Kchn

If possible can you please share your RQL for our reference to identify the recently modified roles to an AWS instance,?

JJoly — Wed, 09 Mar 2022 14:29:31 GMT

Hello @APaul,

Thanks for your good question. I will reuse your query 😀

You could use also 'AttachRolePolicy' or 'AttachSecurityProfile' if you want to be inform on attachment policy on "critical" role.

VPackeriswamy — Wed, 09 Mar 2022 15:09:01 GMT

I am new to the RQL, can you please share some example queries, please.

Appreciate your help...

Thanks,

JJoly — Wed, 09 Mar 2022 15:28:06 GMT

Hey,

event from cloud.audit_logs where cloud.type = 'AWS' AND operation in ('AttachSecurityProfile', 'AttachRolePolicy')

Could be interesting for monitoring role and policy but you should specify a list a critical roles that you want to monitor.