topic Re: RQL - display all VPC's, except DEFAULT, that do not have FlowLogs in Prisma Cloud Discussions

RQL - display all VPC's, except DEFAULT, that do not have FlowLogs

MPestell — Wed, 02 Sep 2020 17:21:13 GMT

Hello all.

New to RQL. I have the below RQL that identifies DEFAULT VPC's;

config where cloud.account IN ( 'AWS_EBU_Networked_Prod_DR_DA_01' ) and api.name = 'aws-ec2-describe-vpcs' AND json.rule = isDefault is true

I have the below RQL that shows all VPC's that do not have FlowLogs enabled;

config where cloud.account IN ( 'AWS_EBU_Networked_Prod_DR_DA_01' ) and api.name = 'aws-ec2-describe-vpcs' as X; config where api.name = 'aws-ec2-describe-flow-logs' as Y; filter ' not ($.Y.resourceId equals $.X.vpcId)'; show X;

Is it possible to combine the 2 so I only show VPC's that do not have FlowLogs enabled AND are not the DEFAULT VPC please?? You help most welcome.

Re: RQL - display all VPC's, except DEFAULT, that do not have FlowLogs

SRohatyn — Thu, 26 Sep 2019 15:06:06 GMT

Hi @MPestell

Quickly adding a filter to your second example, can you confirm if this is doing what you need:

config where api.name = 'aws-ec2-describe-vpcs' as X; config where api.name = 'aws-ec2-describe-flow-logs' as Y; filter '($.X.isDefault is false) and not($.Y.resourceId equals $.X.vpcId)'; show X;

Re: RQL - display all VPC's, except DEFAULT, that do not have FlowLogs

MPestell — Fri, 27 Sep 2019 15:31:10 GMT

Hi and thank you for your reply.

That hasn't exactly worked. What this is bringing back now is indeed those with isDefault=false, however it appears to be ignoring the RQL that looks for VPC's with 'no' Flowlog. Instead it is bringing back just all VPC's that has a isDefault=false.

Re: RQL - display all VPC's, except DEFAULT, that do not have FlowLogs

MPestell — Fri, 27 Sep 2019 15:43:53 GMT

Actually I think I have it. I don't understand 'why' this works but it does. Be great if someone could explain the logic for future reference;

config where api.name = 'aws-ec2-describe-vpcs' as X; config where api.name = 'aws-ec2-describe-flow-logs' as Y; filter 'not($.Y.resourceId equals $.X.vpcId) or ($.X.isDefault == true)'; show X;

# appears that is applies the 'not' to both conditions. Also it does not like 'and' but does work with 'or'