How to check a resource still exists and not been deleted

[MPestell]

Hi guys.

I am looking at a implementation that has been running for over a year - however little work has been done just yet.  The system has 54000 OPEN alerts.  I want to check which alerts are still valid (ie. do the resource at the end of the alert even exist anymore?)  Is it possible to do that from within REDLOCK/Prism please?

[ebeuerlein · Accepted solution]

For this specific circumstance, I would disable all alert rules and let the alerts auto-resolve themselves(this could take a couple of hours).  Then I would re-enable the alerts.  This will cause the system to re-evaluate the alerts based on the most current data and it will re-open any alerts that still have existing resources triggering them.  I would not advise doing this normally but since this implementation hasn't been really used in over a year this might be a good way to go.  

[ebeuerlein · Accepted solution]

For this specific circumstance, I would disable all alert rules and let the alerts auto-resolve themselves(this could take a couple of hours).  Then I would re-enable the alerts.  This will cause the system to re-evaluate the alerts based on the most current data and it will re-open any alerts that still have existing resources triggering them.  I would not advise doing this normally but since this implementation hasn't been really used in over a year this might be a good way to go.  

[lpingali]

Are these alerts present in RedLock/Prisma Cloud or  elsewhere? Prisma Cloud will resolve the open alerts, if the resource has been deleted or updated with recommended steps.

[MPestell]

Thank you a good tip and appreciate not perhaps best practise but a good way to clear the old info.

[MPestell]

Thank you.  For clarity where are those recommended steps??  Do you mean just AWS/AZURE steps or something specific with Prisma please?

[lpingali]

Prisma CLoud best practices.