Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Live
- ›
- About ebeuerlein
About ebeuerlein
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
a week ago
32Posts
7Likes
17Solutions
May 20, 2020Last Visited
User
Activity
User
Profile
Latest posts by ebeuerlein
| Subject | Views | Posted |
|---|---|---|
| 1319 | 01-09-2020 12:39 PM | |
| 1969 | 12-10-2019 08:39 AM | |
| 1557 | 12-10-2019 06:34 AM | |
| 1595 | 12-09-2019 08:27 AM | |
| 537 | 12-08-2019 12:09 PM |
My Liked Posts
| Subject | Likes | Posted |
|---|---|---|
| 1 | 11-25-2019 09:46 AM | |
| 1 | 11-26-2019 07:37 AM | |
| 1 | 10-15-2019 08:14 AM | |
| 3 | 06-03-2019 07:18 AM | |
| 1 | 05-17-2019 08:45 AM |
Posts I Liked
| Subject | Likes | Author | Latest Post |
|---|---|---|---|
| 2 |
User Badges
Public Statistics
| Date Registered | 04-16-2019 10:26 AM |
| Date Last Visited | a week ago |
| Total Messages Posted | 32 |
| Total Likes Received | 7 |
01-09-2020
12:39 PM
Yes you can. It does require additional steps including installing agents called Defenders. This also counts against your workload count. Please refer to our 3 Compute documents for further details or contact your sales person for more details. Thanks, Eddie
... View more
12-12-2019
03:00 AM
Thank you kindly for your prompt response
... View more
12-10-2019
08:39 AM
We don't support AWS Organizations via RQL as of yet - this support is coming in first quarter of next year. Thanks, Eddie
... View more
12-08-2019
12:09 PM
Yes, as I mentioned earlier, you would need two RQL statements to get you both inline and attached. To get the username and specific items you are looking for, you would need to use an API call with some filtering with a scripting language like python.
... View more
11-15-2019
08:51 AM
The product is now called Prisma Cloud (formerly Redlock). There is no customization to the test messages. Thanks, Eddie
... View more
11-12-2019
10:57 AM
I suspect in this case, the event info is captured prior to getting the login info. We have an internal team looking into geo location issues.
... View more
11-06-2019
11:38 AM
This feature is currently in development. We know some resources require complex remediation commands that may span more than 1 command at a time. We are trying to have this available early December and there is currently a soft-commital by our engineering team for this timeframe, but there is no firm ETA currently.
... View more
11-06-2019
11:20 AM
Prisma CLoud best practices.
... View more
10-31-2019
02:17 PM
This RQL might do the trick: config where api.name = 'aws-ec2-describe-instances' AND json.rule = keyName contains "KEYNAME"
... View more
10-29-2019
12:12 AM
Thanks @ebeuerlein! Did I mention I seemed to be blind for my own mistake?
... View more
10-17-2019
08:10 AM
RQL is built for looking for resources that exist and have a certain configuration. There isn't a good way to detect for resources that should exist without also alerting on other matching resources. Using a script or a SIEM to further filter out the resources you don't care about is also an option.
... View more
10-16-2019
01:26 PM
Dismissal Range is for the new snooze feature to specify the time range for keeping the alert in dismissed status.
If you are dismissing without snoozing, then Dismissal Range is not needed.
... View more
10-09-2019
10:51 AM
1 Kudo
Junaid,
Please try this RQL to get information on specific actions on S3 buckets:
event where cloud.account = 'SRA-B2B San Jose' AND operation IN ('DeleteBucket', 'PutBucketAcl', 'PutBucketLogging', 'PutBucketPolicy')
You can add more options from the drop down options.
... View more
09-25-2019
07:30 AM
You need to adjust your time frame to pull less data or restrict it to a specific cloud account. Thanks, Eddie
... View more
09-16-2019
09:15 AM
Are you looking generically for errorCode? Otherwise, specifying a specific operation would help the auto help to determine what you are looking for. Also, you will need to specify a operator for errorCode such as contains/does not contain, etc. Thanks, Eddie
... View more
09-16-2019
08:18 AM
Thank you. Yes have done so. Wondered if others had seen similar.
... View more
09-11-2019
09:41 AM
We don't support lists at this time. However, we will be adding support for that in the near future. Currently, you would need to list out manually all the AMIs you are looking to watch for...
... View more
08-19-2019
05:12 PM
So it might be an issue with the token, since the health check doesn't need a token. Thanks for the response.
... View more
08-13-2019
07:05 AM
You can use this to see the various alarms that might be setup in CloudWatch: config where api.name = 'aws-cloudwatch-describe-alarms' There is a policy that will also look to see if cloudtrail is not integrated with cloudwatch: config where cloud.type = 'aws' AND api.name = 'aws-cloudtrail-describe-trails' AND json.rule = 'cloudWatchLogsRoleArn equals null or cloudWatchLogsRoleArn does not exist'
... View more
07-22-2019
09:31 AM
Unfortunately no, it's highly dependent on number of resources scanned, which can change based on permissions granted, how active the account is, etc.
... View more
06-03-2019
07:18 AM
3 Kudos
This should get you started: event where operation = 'DetachVolume' If you are looking for a specific user doing the action, you can add subject or role using the AND function.
... View more
05-21-2019
09:29 PM
1 Kudo
Worked perfectly, thanks @kchen!
... View more
04-16-2019
03:26 PM
Yes, config where api.name = 'azure-vm-list' is the direct equivalent.
For your use case, you can try:
config where api.name = 'azure-vm-list' AND json.rule = ['properties.networkProfile'].networkInterfaces[*].publicIpAddressId exists
... View more
Latest Blogs
Latest Posts
Copyright 2007 - 2020 - Palo Alto Networks
