topic Re: RQL query for S3 Bucket activity in Prisma Cloud Discussions

RQL query for S3 Bucket activity

Junaid-Khan — Wed, 02 Sep 2020 17:21:26 GMT

Does anyone know how to write a query to look for S3 bucket activity i.e someone logging in to S3 buckets and performing some task as creating objects etc.

Re: RQL query for S3 Bucket activity

AShah12 — Thu, 26 Sep 2019 16:32:10 GMT

You will need to have cloudtrail - data events (s3) enabled for the logs to appear.

Re: RQL query for S3 Bucket activity

Junaid-Khan — Thu, 26 Sep 2019 17:06:25 GMT

Thanks, I do have cloud trail enabled. Just can't seem to find the right attribute to build the query. Here is my attempt.

event where cloud.account IN ( 'SRA-B2B San Jose' ) AND operation IN ( 'GetBucketLogging' ) ADDCOLUMN $.requestParameters.bucketName

Re: RQL query for S3 Bucket activity

ebeuerlein — Thu, 26 Sep 2019 17:58:26 GMT

By default, cloudtrail records s3 bucket operations only. You would need to enable object logging per bucket to capture detailed events.

Refer here for the various API calls that are enabled by default for cloudtrail: https://docs.aws.amazon.com/AmazonS3/latest/dev/cloudtrail-logging.html

Re: RQL query for S3 Bucket activity

lpingali — Thu, 26 Sep 2019 18:23:44 GMT

@ebeuerlein wrote:

By default, cloudtrail records s3 bucket operations only. You would need to enable object logging per bucket to capture detailed events.

Refer here for the various API calls that are enabled by default for cloudtrail: https://docs.aws.amazon.com/AmazonS3/latest/dev/cloudtrail-logging.html

Junaid,
Once you have enabled object logging for the bucket in the specific account, try the following RQL to see if you get the results.

event where cloud.account = 'SRA-B2B San Jose' AND operation = 'GetBucketLogging'

Re: RQL query for S3 Bucket activity

Junaid-Khan — Thu, 26 Sep 2019 21:43:12 GMT

Thank You,

I do have object level logging enabled on the S3's but still don't see the query executing anything. I get a blank page.

event where cloud.account = 'SRA-B2B San Jose' AND cloud.service = 's3.amazonaws.com' AND operation = 'GetBucketLogging'

Re: RQL query for S3 Bucket activity

ebeuerlein — Fri, 27 Sep 2019 14:22:05 GMT

It depends on when you made the change - you may need to widen the time range to capture the exact event of when it was changed.

Re: RQL query for S3 Bucket activity

lpingali — Wed, 09 Oct 2019 17:51:05 GMT

Junaid,

Please try this RQL to get information on specific actions on S3 buckets:

event where cloud.account = 'SRA-B2B San Jose' AND operation IN ('DeleteBucket', 'PutBucketAcl', 'PutBucketLogging', 'PutBucketPolicy')

You can add more options from the drop down options.