About lpingali

lpingali · ‎03-12-2020

The guides attached provide customized direction, advice, and recommendations by job function for implementing Prisma Cloud into operation in your organization. Attachments below are as follows: Compliance Operationalization for Prisma Cloud DevOps Operationalization for Prisma Cloud SecOps Operationalization for Prisma Cloud SOC-IR Operationalization for Prisma Cloud

lpingali · ‎11-12-2019

I suspect in this case, the event info is captured prior to getting the login info. We have an internal team looking into geo location issues.

lpingali · ‎11-06-2019

Can you please open a ticket with screenshots of the results from both API calls, so we can debug further?

lpingali · ‎11-06-2019

We are still working on implementing multiple CLIs in remediation. There is no ETA on it.

lpingali · ‎11-06-2019

Prisma CLoud best practices.

lpingali · ‎11-06-2019

Can you please open a support ticket with a screenshot of the query results, so we can debug? We'd need to understand if any of those IPs might be generated from internal events or classified as Private.

lpingali · ‎11-05-2019

GeoLocation is not determined in some scenarios, such as Cloud Service Provider's (CSP) internal events OR Originate from a private IP address. These are determined based on the CSP. Which account type were you querying on? It is possible that based on the above two points, the location couldn't be determined.

lpingali · ‎10-29-2019

Try this RQL ( with double quotes for filter): config where api.name = 'azure-network-nic-list' as X; config where api.name = 'azure-vm-list' as Y; filter "$.['X'].['properties.virtualMachine'].['id'] == $.['Y'].['properties.networkProfile'].networkInterfaces[*].['id'] and $.X.tags.owner exists"; show X;

lpingali · ‎10-16-2019

Dismissal Range is for the new snooze feature to specify the time range for keeping the alert in dismissed status. If you are dismissing without snoozing, then Dismissal Range is not needed.

lpingali · ‎10-15-2019

Yes, that's right.. PrismaCloud can only monitor accounts that are added to it. So, RQL can only be run on accounts that are added to PrismaCloud.

lpingali · ‎10-09-2019

Junaid, Please try this RQL to get information on specific actions on S3 buckets: event where cloud.account = 'SRA-B2B San Jose' AND operation IN ('DeleteBucket', 'PutBucketAcl', 'PutBucketLogging', 'PutBucketPolicy') You can add more options from the drop down options.

lpingali · ‎09-26-2019

@ebeuerlein wrote: By default, cloudtrail records s3 bucket operations only. You would need to enable object logging per bucket to capture detailed events. Refer here for the various API calls that are enabled by default for cloudtrail: https://docs.aws.amazon.com/AmazonS3/latest/dev/cloudtrail-logging.html Junaid, Once you have enabled object logging for the bucket in the specific account, try the following RQL to see if you get the results. event where cloud.account = 'SRA-B2B San Jose' AND operation = 'GetBucketLogging'

lpingali · ‎08-19-2019

Are these alerts present in RedLock/Prisma Cloud or elsewhere? Prisma Cloud will resolve the open alerts, if the resource has been deleted or updated with recommended steps.

lpingali · ‎08-13-2019

True.. The json output from the AWS CLI and Prisma CLoud API (with same name) can be different. Thanks for pointing this out to be documented for clarity. We'll let the doc team know.

lpingali · ‎08-01-2019

Yes, JIRA cloud menu optitons have changed. We have an existing doc defect to update the documentation to reflect the changes.

Member Since	‎09-05-2018 12:57 PM
Date Last Visited	‎03-29-2021 03:20 PM
Posts	24
Total Likes Received	11

Online Status	Offline
Date Last Visited	‎03-29-2021 03:20 PM

About lpingali

Prisma Cloud Operationalization Guides by Job Function

Re: IP address to Location

Re: Error with RQL joint and atributes with dot

Re: Multiline-awscli command in auto-remedation

Re: How to check a resource still exists and not been deleted

Re: IP address to Location

Re: IP address to Location

Re: Error with RQL joint and atributes with dot

Re: Alert Dismissal Error response via API

Re: How to find Accounts not monitored

Prisma Cloud Operationalization Guides by Job Function

Re: RQL query for S3 Bucket activity

Re: Prisma Public Cloud (formerly RedLock) setting warning

Prisma Cloud Operationalization Guides by Job Function

Prisma Certified Cloud Security Engineer (PCCSE) Certification - New Cloud Security Certificate Offered!

Coming Soon: UI Change with Left Navigation Panel

Important Updates to Prisma Cloud

Prisma Cloud Release Notes October 2, 2019

Prisma Cloud Operationalization Guides by Job Function

Re: IP address to Location

Re: Error with RQL joint and atributes with dot

Re: Multiline-awscli command in auto-remedation

Re: How to check a resource still exists and not been deleted

Re: IP address to Location

Re: IP address to Location

Re: Error with RQL joint and atributes with dot

Re: Alert Dismissal Error response via API

Re: How to find Accounts not monitored

Re: RQL query for S3 Bucket activity

Re: RQL query for S3 Bucket activity

Re: How to check a resource still exists and not been deleted

Re: "aws-elb(v2)-describe-load-balancers" ingest API

Re: Has anyone succeeded at integrating Prisma cloud with Jira Cloud?

Unlock your full community experience!

About lpingali