rql to bring back account_names that are not running a 'named' CloudTrail

MPestell — Mon, 07 Feb 2022 23:56:20 GMT

Hello team.

I have a named CloudTrail which every account must have. aws-landing-zone-logs-us-east-1

Some accounts have additional CloudTrails in addition to the above for there own purposes.

I want an alert that tells me if 'any' account does not have a CloudTrail called aws-landing-zone-logs-us-east-1 but IMPORTANTLY ignoring any other CloudTrail they may already have.

The problem is that the below is alerting even though an account has aws-landing-zone-logs-us-east-1 because it is alerting for the additional CloudTrails also on that account.

config where api.name='aws-cloudtrail-describe-trails' AND cloud.type = 'aws' AND json.rule = "(s3BucketName!= aws-landing-zone-logs-us-east-1)"

Your help welcome and can't figure how to do it.

Re: rql to bring back account_names that are not running a 'named' CloudTrail

ebeuerlein — Thu, 17 Oct 2019 15:10:57 GMT

RQL is built for looking for resources that exist and have a certain configuration. There isn't a good way to detect for resources that should exist without also alerting on other matching resources. Using a script or a SIEM to further filter out the resources you don't care about is also an option.

topic Re: rql to bring back account_names that are not running a 'named' CloudTrail in Prisma Cloud Discussions

rql to bring back account_names that are not running a 'named' CloudTrail

Re: rql to bring back account_names that are not running a 'named' CloudTrail