This website uses cookies essential to its operation, for analytics, and for personalized content. By continuing to browse this site, you acknowledge the use of cookies.
For details on cookie usage on our site, read our Privacy Policy
For details on cookie usage on our site, read our Privacy Policy
About APaul
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- LIVEcommunity
- About APaul
08-07-2019
3Posts
0Likes
0Solutions
Aug 07, 2019Last Visited
User
Activity
User
Profile
Latest posts by APaul
| Subject | Views | Posted |
|---|---|---|
| 4176 | 08-05-2019 12:34 AM | |
| 4407 | 06-21-2019 12:58 AM | |
| 3292 | 06-21-2019 12:06 AM |
Posts I Liked
| Subject | Likes | Author | Latest Post |
|---|---|---|---|
| 1 Like | |||
| 3 Likes |
User Badges
Community Statistics
| Member Since | 06-20-2019 11:43 PM |
| Date Last Visited | 08-07-2019 06:02 AM |
| Posts | 3 |
08-05-2019
12:34 AM
Hi @SRohatyn , Thanks a lot for your valuable inputs and related reference links. I am able to get the result with little modification. event where cloud.type = 'aws' AND operation = 'CreateSnapshot' AND json.rule != (( $.userAgent = 'signin.amazonaws.com' ) OR ($.userAgent = 'console.amazonaws.com' )) This is giving me the desired results. A big thanks for your help.
... View more
06-21-2019
12:58 AM
I am trying to create an RQL query, which will check if anyone attaches or modify roles to an AWS instance.
I am using the below Query :
event where cloud.account = 'My-AWS' AND operation = 'AddRoleToInstanceProfile'
I did some testing on one of the instances. However, I am not able to get any result.
Please help on the correct RQL
... View more
Labels:
06-21-2019
12:06 AM
I have configured Redlock to send alert to SQS queue. I am getting the below fields in JSON body when I fetch it from SQS: However, When I try to fetch the alert details using Alert API I get the complete different schema. SQS_JSON_Fields Alert_API_JSON As soon as an alert is generated, then the JSON data for that alert is sent to SQS queue. (I have lambda that captures and process the data from queue and queue is empty) Is there any way I can get the data in JSON format which are sent to SQS for the existing alert? My aim is to capture the JSON data from the existing alert instead of creating a new alert and use it to manipulate and process the data from SQS as per requirement
... View more
Labels:
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
08-07-2019
06:02 AM
|
Latest Tags
No tags yet
LEGAL NOTICES
Copyright 2007 - 2023 - Palo Alto Networks