About FranciscoBreijo

This would need to be handled at the specific policy level. However, I would recommend against it. Fundamentally, the default resources could still be used, and are outside of normal security guardrails. Thus you are introducing a blind spot, by not addressing them.   Our recommendation, is to fully secure the default resources as well, to ensure that in the event a user inadvertently associates a resource with a default resource, you are not exposed, or vulnerable. ... View more

VRuiz,   Please try the below RQL.   config where cloud.account = 'Azure-Redlock-public-demo' AND api.name = 'azure-network-nic-list' as X; config where api.name = 'azure-vm-list' as Y; filter "$.['X'].['properties.virtualMachine'].id contains $.['Y'].['properties.osProfile'].computerName and $.X.tags.owner exists"; show X;   The issue you were running into is that $.['Y'].['properties.networkProfile'].networkInterfaces[*].id references the network interface Id, but that value doesn't exist in the nic-list response. So what you need to do is map from the NIC to the Computername.   @lpingali  ... View more

@JReynolds1 ,   The RQL you are utilziing is a join, which is specifically used for aggregating 2 api calls, and cross-correlating the information.   If you are only trying to filter results within a single API call, you don't need to use a join. For the RQL it seems you are trying to gather, the proper RQL is below.   config where api.name = 'aws-ec2-describe-internet-gateways' AND json.rule = attachments[*].vpcId exists   You can find the full RQL Guide at the following location, which can also provide some assistance/guidance on RQL moving forward. https://docs.paloaltonetworks.com/redlock/redlock-rql-reference.html   ... View more