topic CloudWatch RQL in Prisma Cloud Discussions

CloudWatch RQL

John.Halstead — Wed, 02 Sep 2020 17:18:18 GMT

Hi all,

Relatively new with Prisma and playing with the RQL. Would anyone be able to tell me if there's a query i can run that tells me if cloudwatch is enabled within an AWS environment?

Report wise, I tried running something against CIS compliance and it's really just telling me that cloud trail is not integrated with cloud watch which doesn't directly answer the question, for compliance purposes.

Re: CloudWatch RQL

ebeuerlein — Tue, 13 Aug 2019 14:05:20 GMT

You can use this to see the various alarms that might be setup in CloudWatch: config where api.name = 'aws-cloudwatch-describe-alarms'

There is a policy that will also look to see if cloudtrail is not integrated with cloudwatch: config where cloud.type = 'aws' AND api.name = 'aws-cloudtrail-describe-trails' AND json.rule = 'cloudWatchLogsRoleArn equals null or cloudWatchLogsRoleArn does not exist'