RQL to identify if logging is disabled within a project in GCP

[FAjah]

Need help with the RQL to alert when the "state": "DISABLED"

{"name": "*/logging.googleapis.com",

"state": "ENABLED",

"parent": "projects/*"

},

[JayGolf]

Hi @FAjah ,

Here is the Prisma Cloud Resource Query Language Reference that may assist you. Hope this helps!

[OOmotayo]

Hello,

You can use the below RQL to list projects with logging APIs. However, you may need to check the resource config JSOn to confirm it enabled or disabled.

config from cloud.resource where api.name = 'gcloud-services-list' AND json.rule = services[*].name contains "logging.googleapis.com"