Question about RQL 'userIDGroupPairs[*]' from security group

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements

Question about RQL 'userIDGroupPairs[*]' from security group

L0 Member

Hello. I am asking if you can give some help about creating a RQL for a custom policy.

 

I was trying to create a RQL about AWS security groups that tries to find if the description in userIdGroupPairs[*] for each inbound or outbound rules('ipPermissions' / 'ipPermissionsEgress') does not include these two strings, "SAC*" or "ACE*".

(After each strings, it each has some unique numbers so we want to find by the common strings of each SAC and ACE)

 

As you can see from the resource config and if you know how the RQL queries, the each of the Security Group Rules are separated with four fields (ipv4Ranges, ipv6Ranges, prefixListIds, userIdGroupPairs) and the related information are just arranged under each fields.(Check the example screenshot)

AmYoon_1-1702346131035.png

 

I want to check if each of these lists  of descriptions one by one whether they contain SAC or ACE but from my RQL below,

I could only check if either or not 'userIdGroupPairs' contain SAC or ACE from the whole list.

 

  • The RQL example is like below :
    config from cloud.resource api.name = 'aws-ec2-describe-security-groups' AND json.rule = (ipPermissions[*].userIdGroupPairs[*] is not empty and ipPermissions[?all(userIdGroupPairs[*].description does not contain SAC and userIdGroupPairs[*].description does not contain ACE)] exists) or (ipPermissionsEgress[*].userIdGroupPairs[*] is not empty and ipPermissionsEgress[?all(userIdGroupPairs[*].description does not contain SAC and userIdGroupPairs[*].description does not contain ACE)] exists)

 

Hope you give some tips about this RQL or if there are some other useful operators can be used that I couldn't find.

 

Thank you.

Prisma Cloud 

1 REPLY 1

L3 Networker

Hello,

Testing this on an example resource in my lab you should be able to select multiple fields under the ipPermissions array, as well as select AND, and OR for each items under that ray as you build out the RQL query.  I did notice an small syntax error at the beginning of the query.  Fix that and give it another attempt and try using the auto complete from the JSON rule viewer to help as well.
config from cloud.resource where api.name =

  • 853 Views
  • 1 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!