Hi All,
I am looking for some support for the RQL.
I am trying to detect if any firewall rule on GCP allows SSH port 22 traffic from except the PSM IP addresses. I developed some queries but it's not able to catch every scenario. I am trying to develop a query that should check exact match with the IP addresses that I've write. Need your comments for this use-case. Thank you !
Example Query :
config from cloud.resource where cloud.type = 'gcp' AND api.name = 'gcloud-compute-firewall-rules-list' AND json.rule = disabled is false and direction equals INGRESS and sourceRanges[*] is not member of (IP Addresses separeted with comma) and allowed[?any(ports is member of (22) or ports contains _Port.inRange(22,22) and (ports does not exist and (IPProtocol contains tcp)))] exists
Kind Regards
