rql to bring back account_names that are not running a 'named' CloudTrail

[MPestell]

Hello team.

I have a named CloudTrail which every account must have.  aws-landing-zone-logs-us-east-1

Some accounts have additional CloudTrails in addition to the above for there own purposes.

I want an alert that tells me if 'any' account does not have a CloudTrail called aws-landing-zone-logs-us-east-1 but IMPORTANTLY ignoring any other CloudTrail they may already have.

The problem is that the below is alerting even though an account has aws-landing-zone-logs-us-east-1 because it is alerting for the additional CloudTrails also on that account.

config where api.name='aws-cloudtrail-describe-trails' AND cloud.type = 'aws' AND json.rule = "(s3BucketName!= aws-landing-zone-logs-us-east-1)"

Your help welcome and can't figure how to do it. 

[ebeuerlein · Accepted solution]

RQL is built for looking for resources that exist and have a certain configuration.  There isn't a good way to detect for resources that should exist without also alerting on other matching resources.  Using a script or a SIEM to further filter out the resources you don't care about is also an option.