About ebeuerlein

ebeuerlein · ‎01-09-2020

Yes you can. It does require additional steps including installing agents called Defenders. This also counts against your workload count. Please refer to our 3 Compute documents for further details or contact your sales person for more details. Thanks, Eddie

ebeuerlein · ‎12-10-2019

We don't support AWS Organizations via RQL as of yet - this support is coming in first quarter of next year. Thanks, Eddie

ebeuerlein · ‎12-10-2019

Once the scan is completed, the config scan kicks off that actually generates the alerts. Once that is finished, another ingestion cycle kicks off. So you data will be pulled in about once an hour. Thanks, Eddie

ebeuerlein · ‎12-09-2019

I would recommend disabling the policy for 91 days and only have the custom policy enabled. Also, make sure this policy is added to any alert rules since alert rules are what causes policies to alert. In regards to frequency of scans, it is usually between 15 and 45 mins per scan.

ebeuerlein · ‎12-08-2019

Yes, as I mentioned earlier, you would need two RQL statements to get you both inline and attached. To get the username and specific items you are looking for, you would need to use an API call with some filtering with a scripting language like python.

ebeuerlein · ‎12-02-2019

You won't be able to do that within the UI due to the sheer number of actions that could be returned. I would suggest using our API to pull the data you want and export it into CSV format. Thanks, Eddie

ebeuerlein · ‎12-02-2019

This should get you what you are looking for (you were missing the brackets for the array (attachedPolicies): config where api.name = 'aws-iam-list-attached-user-policies' as X; config where api.name = 'aws-iam-get-policy-version' as Y; filter "$.X.attachedPolicies[*].policyArn==$.Y.policyArn and $.Y.document.Statement[?(@.Effect=='Allow')].Action is not empty"; show Y;

ebeuerlein · ‎11-26-2019

So users can have inline policies as well as attached policies. It would be difficult to show it all in one pane due to the joins that would need to be used. Do you only want to list users that have inline or attached policies? Or a complete list of users regardless of policies? Thanks, Eddie

ebeuerlein · ‎11-25-2019

Hi Sultan, What cloud provider are you trying to pull a list of users for? Thanks, Eddie

ebeuerlein · ‎11-15-2019

The product is now called Prisma Cloud (formerly Redlock). There is no customization to the test messages. Thanks, Eddie

ebeuerlein · ‎11-05-2019

Looks like at the time this events was ingested, that we were unable to determine the location data for the IPs. What is the time range for these events?

ebeuerlein · ‎10-31-2019

This RQL might do the trick: config where api.name = 'aws-ec2-describe-instances' AND json.rule = keyName contains "KEYNAME"

ebeuerlein · ‎10-28-2019

Your start time is Oct 28th and your end time is Sept 28th. Have you tried flipping the values to see if it still results in a 400?

ebeuerlein · ‎10-17-2019

RQL is built for looking for resources that exist and have a certain configuration. There isn't a good way to detect for resources that should exist without also alerting on other matching resources. Using a script or a SIEM to further filter out the resources you don't care about is also an option.

ebeuerlein · ‎10-15-2019

Policies array might be required - here's mine that works and it seems to be the only major thing missing from your payload. Also make sure it's a POST. Payload: { "alerts" : [ "P-1424086" ] , "policies" : [ ] , "filter" : { "filters" : [ { "operator" : "=" , "name" : "alert.status" , "value" : "open" } , { "operator" : "=" , "name" : "policy.type" , "value" : "config" } ] , "timeRange" : { "type" : "relative" , "value" : { "amount" : 1 , "unit" : "week" } } } , "dismissalNote" : "Test2" }

ebeuerlein · ‎09-27-2019

It depends on when you made the change - you may need to widen the time range to capture the exact event of when it was changed.

ebeuerlein · ‎09-26-2019

By default, cloudtrail records s3 bucket operations only. You would need to enable object logging per bucket to capture detailed events. Refer here for the various API calls that are enabled by default for cloudtrail: https://docs.aws.amazon.com/AmazonS3/latest/dev/cloudtrail-logging.html

ebeuerlein · ‎09-25-2019

You need to adjust your time frame to pull less data or restrict it to a specific cloud account. Thanks, Eddie

ebeuerlein · ‎09-23-2019

If you are using SAML, you will need to add the user with the access keys to SSO bypass list at the bottom of the SSO page.

ebeuerlein · ‎09-16-2019

Are you looking generically for errorCode? Otherwise, specifying a specific operation would help the auto help to determine what you are looking for. Also, you will need to specify a operator for errorCode such as contains/does not contain, etc. Thanks, Eddie

ebeuerlein · ‎09-13-2019

I think this should work for you: event where cloud.type = 'aws' AND json.rule = errorCode contains UnauthorizedOperation or errorCode contains AccessDenied

ebeuerlein · ‎09-12-2019

I would file a support ticket for this issue. Without more info, it would be tough to guess what might be going on there...

ebeuerlein · ‎09-11-2019

We don't support lists at this time. However, we will be adding support for that in the near future. Currently, you would need to list out manually all the AMIs you are looking to watch for...

ebeuerlein · ‎09-10-2019

What do you mean by multi-line cli?

ebeuerlein · ‎08-19-2019

For this specific circumstance, I would disable all alert rules and let the alerts auto-resolve themselves(this could take a couple of hours). Then I would re-enable the alerts. This will cause the system to re-evaluate the alerts based on the most current data and it will re-open any alerts that still have existing resources triggering them. I would not advise doing this normally but since this implementation hasn't been really used in over a year this might be a good way to go.

ebeuerlein · ‎08-19-2019

I don't see anything wrong with header1 (header 2 is missing the content-type so that would throw the 500 as expected). If you are getting a 401, then the token has expired. FYI, there is a syntax issue with your "query" line - you have an open single quote.

ebeuerlein · ‎08-13-2019

You can use this to see the various alarms that might be setup in CloudWatch: config where api.name = 'aws-cloudwatch-describe-alarms' There is a policy that will also look to see if cloudtrail is not integrated with cloudwatch: config where cloud.type = 'aws' AND api.name = 'aws-cloudtrail-describe-trails' AND json.rule = 'cloudWatchLogsRoleArn equals null or cloudWatchLogsRoleArn does not exist'

ebeuerlein · ‎07-22-2019

Unfortunately no, it's highly dependent on number of resources scanned, which can change based on permissions granted, how active the account is, etc.

ebeuerlein · ‎07-22-2019

It depends on the data source (configuration metadata, events or flow logs). For configuration metadata, we pull the data about every 45 minutes but this can vary depending on number of objects, rate limits imposed by the cloud service providers and latency. When an account is first onboarded, you will see a large amount of API calls since this is the first time we have seen any of the data so we pull more. As time goes on, we pull less since we have an established pattern of data to work from (there are some caveats here). Hope that answered the question!

ebeuerlein · ‎06-03-2019

This should get you started: event where operation = 'DetachVolume' If you are looking for a specific user doing the action, you can add subject or role using the AND function.

Date Registered	‎04-16-2019 10:26 AM
Date Last Visited	a week ago
Total Messages Posted	32
Total Likes Received	7

Online Status	Offline
Date Last Visited	a week ago

Strata

Prisma

Cortex

About ebeuerlein