topic Re: RQL query to detect external port exposure across AWS, GCP, Azure in Prisma Cloud Discussions

RQL query to detect external port exposure across AWS, GCP, Azure

JVasquez5 — Fri, 25 Feb 2022 16:40:00 GMT

Hello Everyone,

Wanting to see if anyone has queries for each cloud provider in relation to checking for external exposure to ports such as 443, 22, 3389, etc..

We would like to be able to see what ports/endpoints we have open to the world from a 0.0.0.0/0 context.

Many thanks in advance!

Re: RQL query to detect external port exposure across AWS, GCP, Azure

JJoly — Wed, 09 Mar 2022 14:10:59 GMT

Hello @JVasquez5

I think you can use this queries :

config from network where source.network = UNTRUST_INTERNET and dest.resource.type = 'Instance' and dest.cloud.type = 'AWS' and protocol.ports in ( 'tcp/0:79', 'tcp/81:442', 'tcp/444:65535' )

You can update the dest.cloud.type with the cloud account you want to test and also add new ports in protocol.ports parameter.

I hope this helps you,

Jean-Baptiste

Re: RQL query to detect external port exposure across AWS, GCP, Azure

RPrasadi — Thu, 14 Jul 2022 01:34:08 GMT

Q1: Wanting to see if anyone has queries for each cloud provider in relation to checking for external exposure to ports such as 443, 22, 3389, etc..
We would like to be able to see what ports/endpoints we have open to the world from a 0.0.0.0/0 context.
A1: Here is the link to the queries to review and build from there - https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-rql-reference/rql-reference/rql-examples