Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Get Started
- News & Events
- Collaboration
- Education Services
- Technologies
- Next-Generation Firewall
- GlobalProtect
- Threat Prevention Services
- Endpoint Protection
- SSL Decryption
- App-ID
- Content-ID
- User-ID
- 5G
- IoT Security
- Cloud Identity Engine
- Panorama
- AIOps for NGFW
Network Security
- Prisma Access
- Prisma Cloud
- Prisma SD-WAN
- Cloud NGFW for AWS
- CN-Series
- VM-Series:
- Private Cloud
- OCI
- Alibaba
- AWS
- GCP
- Azure
Cloud Security
- Cortex XDR
- Cortex XSOAR
- Cortex Data Lake
- Cortex Xpanse
Security Operations
- Resources
- COVID-19 Response Center
About MPestell
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- LIVEcommunity
- About MPestell
06-15-2020
14Posts
0Likes
1Solution
Jun 15, 2020Last Visited
User
Activity
User
Profile
Latest posts by MPestell
| Subject | Views | Posted |
|---|---|---|
| 1238 | 06-11-2020 08:58 AM | |
| 5066 | 12-10-2019 03:34 AM | |
| 3123 | 10-17-2019 04:52 AM | |
| 5958 | 10-07-2019 04:46 AM | |
| 4977 | 09-27-2019 08:43 AM |
Posts I Liked
| Subject | Likes | Author | Latest Post |
|---|---|---|---|
| 1 Like | |||
| 1 Like | |||
| 1 Like |
User Badges
Community Statistics
| Member Since | 08-19-2019 09:18 AM |
| Date Last Visited | 06-15-2020 05:02 AM |
| Posts | 14 |
06-11-2020
08:58 AM
Hello team. I can look for an event to see failed login attempts with; event where operation = 'ConsoleLogin' and json.rule = $.responseElements.ConsoleLogin != 'Success' Is there a way to count these (like we see in config with 'as X; count(X) greater than 5'). I want an alert which shows when the number of failed login attempts exceeds 5. Thank you so much for your time in looking.
... View more
Labels:
- Labels:
-
Prisma Cloud
12-10-2019
03:34 AM
Hey Jason, thank you for the reply. It would be so useful if you knew the RQL for Organisations please.
... View more
10-17-2019
04:52 AM
Hello team.
I have a named CloudTrail which every account must have. aws-landing-zone-logs-us-east-1
Some accounts have additional CloudTrails in addition to the above for there own purposes.
I want an alert that tells me if 'any' account does not have a CloudTrail called aws-landing-zone-logs-us-east-1 but IMPORTANTLY ignoring any other CloudTrail they may already have.
The problem is that the below is alerting even though an account has aws-landing-zone-logs-us-east-1 because it is alerting for the additional CloudTrails also on that account.
config where api.name='aws-cloudtrail-describe-trails' AND cloud.type = 'aws' AND json.rule = "(s3BucketName!= aws-landing-zone-logs-us-east-1)"
Your help welcome and can't figure how to do it.
... View more
- Tags:
- prisma cloud
Labels:
10-07-2019
04:46 AM
Hi everyone. I want to be able to list any AWS account that is not monitored by Prisma We have AWS Organizations configured. However I don't see any RQL to interrogate that to show the accounts in Organizations and compare to _AWSCloudAccount.isRedLockMonitored We have a central CLOUDTRAIL which is writing to a central S3 bucket. The directory/file structure under the S3 also has the account number. Again I wondered if a way to compare to _AWSCloudAccount.isRedLockMonitored but don't see any RQL that would help. Any ideas anyone please??
... View more
Labels:
- Labels:
-
Prisma Cloud
09-27-2019
08:43 AM
Actually I think I have it. I don't understand 'why' this works but it does. Be great if someone could explain the logic for future reference; config where api.name = 'aws-ec2-describe-vpcs' as X; config where api.name = 'aws-ec2-describe-flow-logs' as Y; filter 'not($.Y.resourceId equals $.X.vpcId) or ($.X.isDefault == true)'; show X; # appears that is applies the 'not' to both conditions. Also it does not like 'and' but does work with 'or'
... View more
09-27-2019
08:31 AM
Hi and thank you for your reply. That hasn't exactly worked. What this is bringing back now is indeed those with isDefault=false, however it appears to be ignoring the RQL that looks for VPC's with 'no' Flowlog. Instead it is bringing back just all VPC's that has a isDefault=false.
... View more
09-26-2019
07:24 AM
Hello all. New to RQL. I have the below RQL that identifies DEFAULT VPC's; config where cloud.account IN ( 'AWS_EBU_Networked_Prod_DR_DA_01' ) and api.name = 'aws-ec2-describe-vpcs' AND json.rule = isDefault is true I have the below RQL that shows all VPC's that do not have FlowLogs enabled; config where cloud.account IN ( 'AWS_EBU_Networked_Prod_DR_DA_01' ) and api.name = 'aws-ec2-describe-vpcs' as X; config where api.name = 'aws-ec2-describe-flow-logs' as Y; filter ' not ($.Y.resourceId equals $.X.vpcId)'; show X; Is it possible to combine the 2 so I only show VPC's that do not have FlowLogs enabled AND are not the DEFAULT VPC please?? You help most welcome.
... View more
Labels:
09-20-2019
04:36 AM
Hi team. Can someone share the URI for Prisma Cloud API REST documentation please. (Can't find it anywhere)
... View more
Labels:
09-16-2019
08:18 AM
Thank you. Yes have done so. Wondered if others had seen similar.
... View more
09-12-2019
06:45 AM
Hi everyone. We see occurances where we have RDS Snapshots showing in AWS console. I see from Cloudwatch/trail that primsa is connecting and issueing the call to DescribeDBSnapshots. If I then run a very general investigate query of config where cloud.type = 'aws' and api.name='aws-rds-describe-db-snapshots' / download all results. I see all other accounts but 1 account (the 1 which I know has snapshots) is not showing up? Any experience on this at all please? Please note we see other alerts for this account including DescribeInstances information. All accounts per imported at the same time using the same CloudFoundation. Yet we see snapshot information for all of those accounts with no issues.
... View more
Labels:
08-20-2019
03:53 AM
Thank you. For clarity where are those recommended steps?? Do you mean just AWS/AZURE steps or something specific with Prisma please?
... View more
08-20-2019
03:53 AM
Thank you a good tip and appreciate not perhaps best practise but a good way to clear the old info.
... View more
08-19-2019
09:41 AM
Hi guys. I am looking at a implementation that has been running for over a year - however little work has been done just yet. The system has 54000 OPEN alerts. I want to check which alerts are still valid (ie. do the resource at the end of the alert even exist anymore?) Is it possible to do that from within REDLOCK/Prism please?
... View more
Labels:
- Labels:
-
Prisma Cloud
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-15-2020
05:02 AM
|
Latest Tags
No tags yet
LEGAL NOTICES
Copyright 2007 - 2022 - Palo Alto Networks
