Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Get Started
- News & Events
- Collaboration
- Education Services
- Technologies
- Next-Generation Firewall
- GlobalProtect
- Threat Prevention Services
- Endpoint Protection
- SSL Decryption
- 5G
- IoT Security
- Prisma SD-WAN
Network Security
- Prisma Access
- Prisma SaaS
- Prisma Cloud
- CN-Series
- VM-Series:
- Alibaba
- AWS
- GCP
- Azure
Cloud Security
- Cortex XDR
- Cortex XSOAR
- Cortex Data Lake
Security Operations
- Resources
- COVID-19 Response Center
About ebeuerlein
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- LIVEcommunity
- About ebeuerlein
07-10-2020
0Posts
7Likes
17Solutions
Jul 10, 2020Last Visited
User
Activity
User
Profile
Latest posts by ebeuerlein
| Subject | Views | Posted |
|---|---|---|
| 2188 | 01-09-2020 12:39 PM | |
| 3769 | 12-10-2019 08:39 AM | |
| 2456 | 12-10-2019 06:34 AM | |
| 2494 | 12-09-2019 08:27 AM | |
| 904 | 12-08-2019 12:09 PM |
My Liked Posts
| Subject | Likes | Posted |
|---|---|---|
| 1 Like | 11-25-2019 09:46 AM | |
| 1 Like | 11-26-2019 07:37 AM | |
| 1 Like | 10-15-2019 08:14 AM | |
| 3 Likes | 06-03-2019 07:18 AM | |
| 1 Like | 05-17-2019 08:45 AM |
Posts I Liked
| Subject | Likes | Author | Latest Post |
|---|---|---|---|
| 2 Likes |
User Badges
Community Statistics
| Member Since | 04-16-2019 10:26 AM |
| Date Last Visited | 07-10-2020 06:59 PM |
| Posts | 32 |
| Total Likes Received | 7 |
01-09-2020
12:39 PM
Yes you can. It does require additional steps including installing agents called Defenders. This also counts against your workload count. Please refer to our 3 Compute documents for further details or contact your sales person for more details. Thanks, Eddie
... View more
12-10-2019
08:39 AM
We don't support AWS Organizations via RQL as of yet - this support is coming in first quarter of next year. Thanks, Eddie
... View more
12-10-2019
06:34 AM
Once the scan is completed, the config scan kicks off that actually generates the alerts. Once that is finished, another ingestion cycle kicks off. So you data will be pulled in about once an hour. Thanks, Eddie
... View more
12-09-2019
08:27 AM
I would recommend disabling the policy for 91 days and only have the custom policy enabled. Also, make sure this policy is added to any alert rules since alert rules are what causes policies to alert. In regards to frequency of scans, it is usually between 15 and 45 mins per scan.
... View more
12-08-2019
12:09 PM
Yes, as I mentioned earlier, you would need two RQL statements to get you both inline and attached. To get the username and specific items you are looking for, you would need to use an API call with some filtering with a scripting language like python.
... View more
12-02-2019
10:28 AM
You won't be able to do that within the UI due to the sheer number of actions that could be returned. I would suggest using our API to pull the data you want and export it into CSV format. Thanks, Eddie
... View more
12-02-2019
08:14 AM
This should get you what you are looking for (you were missing the brackets for the array (attachedPolicies): config where api.name = 'aws-iam-list-attached-user-policies' as X; config where api.name = 'aws-iam-get-policy-version' as Y; filter "$.X.attachedPolicies[*].policyArn==$.Y.policyArn and $.Y.document.Statement[?(@.Effect=='Allow')].Action is not empty"; show Y;
... View more
11-26-2019
07:37 AM
1 Kudo
So users can have inline policies as well as attached policies. It would be difficult to show it all in one pane due to the joins that would need to be used. Do you only want to list users that have inline or attached policies? Or a complete list of users regardless of policies? Thanks, Eddie
... View more
11-25-2019
09:46 AM
1 Kudo
Hi Sultan, What cloud provider are you trying to pull a list of users for? Thanks, Eddie
... View more
11-15-2019
08:51 AM
The product is now called Prisma Cloud (formerly Redlock). There is no customization to the test messages. Thanks, Eddie
... View more
11-05-2019
06:08 AM
Looks like at the time this events was ingested, that we were unable to determine the location data for the IPs. What is the time range for these events?
... View more
10-31-2019
02:17 PM
This RQL might do the trick: config where api.name = 'aws-ec2-describe-instances' AND json.rule = keyName contains "KEYNAME"
... View more
10-28-2019
12:30 PM
Your start time is Oct 28th and your end time is Sept 28th. Have you tried flipping the values to see if it still results in a 400?
... View more
10-17-2019
08:10 AM
RQL is built for looking for resources that exist and have a certain configuration. There isn't a good way to detect for resources that should exist without also alerting on other matching resources. Using a script or a SIEM to further filter out the resources you don't care about is also an option.
... View more
10-15-2019
08:14 AM
1 Kudo
Policies array might be required - here's mine that works and it seems to be the only major thing missing from your payload. Also make sure it's a POST. Payload: { "alerts" : [ "P-1424086" ] , "policies" : [ ] , "filter" : { "filters" : [ { "operator" : "=" , "name" : "alert.status" , "value" : "open" } , { "operator" : "=" , "name" : "policy.type" , "value" : "config" } ] , "timeRange" : { "type" : "relative" , "value" : { "amount" : 1 , "unit" : "week" } } } , "dismissalNote" : "Test2" }
... View more
LEGAL NOTICES
Copyright 2007 - 2021 - Palo Alto Networks
