RQL query to detect external port exposure across AWS, GCP, Azure

[JVasquez5]

Hello Everyone, 

Wanting to see if anyone has queries for each cloud provider in relation to checking for external exposure to ports such as 443, 22, 3389, etc..

We would like to be able to see what ports/endpoints we have open to the world from a  0.0.0.0/0 context. 

Many thanks in advance!

[JJoly · Accepted solution]

Hello @JVasquez5 

I think you can use this queries :

config from network where source.network = UNTRUST_INTERNET and dest.resource.type = 'Instance' and dest.cloud.type = 'AWS' and protocol.ports in ( 'tcp/0:79', 'tcp/81:442', 'tcp/444:65535' )

You can update the dest.cloud.type with the cloud account you want to test and also add new ports in protocol.ports parameter.

I hope this helps you,

Jean-Baptiste

[RPrasadi]

Q1: Wanting to see if anyone has queries for each cloud provider in relation to checking for external exposure to ports such as 443, 22, 3389, etc..
We would like to be able to see what ports/endpoints we have open to the world from a 0.0.0.0/0 context.
A1: Here is the link to the queries to review and build from there - https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-rql-reference/rql-reference/rql-e...