- Access exclusive content
- Connect with peers
- Share your expertise
- Find support resources
12-11-2023 06:04 PM - edited 12-11-2023 06:05 PM
Hello. I am asking if you can give some help about creating a RQL for a custom policy.
I was trying to create a RQL about AWS security groups that tries to find if the description in userIdGroupPairs[*] for each inbound or outbound rules('ipPermissions' / 'ipPermissionsEgress') does not include these two strings, "SAC*" or "ACE*".
(After each strings, it each has some unique numbers so we want to find by the common strings of each SAC and ACE)
As you can see from the resource config and if you know how the RQL queries, the each of the Security Group Rules are separated with four fields (ipv4Ranges, ipv6Ranges, prefixListIds, userIdGroupPairs) and the related information are just arranged under each fields.(Check the example screenshot)
I want to check if each of these lists of descriptions one by one whether they contain SAC or ACE but from my RQL below,
I could only check if either or not 'userIdGroupPairs' contain SAC or ACE from the whole list.
Hope you give some tips about this RQL or if there are some other useful operators can be used that I couldn't find.
Thank you.
12-15-2023 10:23 AM
Hello,
Testing this on an example resource in my lab you should be able to select multiple fields under the ipPermissions array, as well as select AND, and OR for each items under that ray as you build out the RQL query. I did notice an small syntax error at the beginning of the query. Fix that and give it another attempt and try using the auto complete from the JSON rule viewer to help as well.
config from cloud.resource where api.name =
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!