DXiao

‎05-27-2019

since

L0 Member

1
Post
0
Likes
0
Solutions
May 27, 2019
Last Visited

User Activity

User Profile

Prisma Public Cloud Query - Exclude AWS security group that is not associated with any resources

1514

‎04-16-2019 06:51 PM

User Badges

Public Statistics

Date Registered	‎04-15-2019 06:19 AM
Date Last Visited	‎05-27-2019 03:05 PM
Total Messages Posted	1

Hi, Some policies are producing alerts against SGs that are not associated with any resources. Can you please advise how to customize the query and exclude those SGs? For example, policy "AWS Security Groups allow internet traffic from internet to MYSQL port (3306)" is defined as follows: config where cloud.type = 'aws' AND api.name='aws-ec2-describe-security-groups' AND json.rule = (((ipPermissions[?(@.toPort > 3306 && @.fromPort < 3306)].ipRanges[*] contains 0.0.0.0/0) or (ipPermissions[?(@.toPort == 3306 || @.fromPort == 3306)].ipRanges[*] contains 0.0.0.0/0)) or ((ipPermissions[?(@.toPort > 3306 && @.fromPort < 3306)].ipv6Ranges[*].cidrIpv6 contains ::/0) or (ipPermissions[?(@.toPort == 3306 || @.fromPort == 3306)].ipv6Ranges[*].cidrIpv6 contains ::/0))) Thank you

When I use the API to pull the device-state - am I getting the latest ?

In another article here, from 2014 (precambrian...
Merging of security policies result in sequence gotten out of order

Hi all, I've got 2 different sets of PAN...
Chinese characters are populating automatically in GP username

I am having experience in the global protect...

Strata

Prisma

Cortex

About DXiao

Prisma Public Cloud Query - Exclude AWS security group that is not associated with any resources

Prisma Public Cloud Query - Exclude AWS security group that is not associated with any resources