About AKing9

Greetings Umberto,   I hope that this note finds you well! In researching your use case I was able to create an event based RQL query that you can run in the investigate portion of the CSPM console to locate if the events are being ingested from the console:   event from cloud.audit_logs where cloud.service = 'securityhub.amazonaws.com'   Depending on if this has any returned values you can create a policy of the 'Audit Event' type and potentially utilize aspects of the returned data from AWS to create scoping for what may be nested within your use case. Here is additional documentation on the entire AWS Security Hub integration setup:   https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-admin/configure-external-integrations-on-prisma-cloud/integrate-prisma-cloud-with-aws-security-hub   To troubleshoot if you do not have any returned values in the above RQL which, depending on the workload, could take a while to complete running, I would recommend checking that the region where you had setup the AWS account is the same as within the integration in the console, a test of the integration has a returned value from the AWS account, and that the permission AWSSecurityHubReadOnlyAccess is attached to the user account of the AWS administrator that is creating the integration. Please let me know if you need any additional help with this and I hope that you have a good day!   Kind Regards, J. Avery King ... View more

Good Day AnaisRomero,   I hope that this note finds you well. In your use case I think that scoping the runtime rule with either an encompassed custom rule defined or process definition to a collection that correlates to the app should be what you need. Collections are the primary scoping utility within the console and when you define the collection that the application is in you can then create the runtime rule with the scope correlated to this collection. You will probably need to check the sequence that the runtime rules are defined in executing so that the new rule is listed before any rule that would potentially execute with a larger scope. As a general guidance, in setting up runtime rules or any other console defined rules, you will be best to have the rules with a narrower scope higher up on the list than rules with a larger scope. Hopefully this helps. Please let me know if you need any additional information.   Kind Regards, J. Avery King ... View more

Greetings Coldstone2,   I hope that this note finds you well! I know that it has been a while since you had posted this question but I wanted to see if you still potentially needed any help. Thank you for your time and I hope that you have a good remainder of your day.   Kind Regards, J. Avery King ... View more

Greetings KSoni, I hope that this note finds you well! I know that it has been a while since you had posted this question but I wanted to see if you still potentially needed any help. Thank you for your time and I hope that you have a good remainder of your day. Kind Regards, J. Avery King ... View more

Greetings MPalagiri,   I hope that this note finds you well! I know that it has been a while since you had posted this question but I wanted to see if you still potentially needed any help. Thank you for your time and I hope that you have a good remainder of your day.   Kind Regards, J. Avery King ... View more

Greetings MPalagiri,   I hope that this note finds you well! I know that it has been a while since you had posted this question but I wanted to see if you still potentially needed any help. Thank you for your time and I hope that you have a good remainder of your day.   Kind Regards, J. Avery King ... View more

Greetings JCheng4,   I hope that this note finds you well! I know that it has been a while since you had posted this question but I wanted to see if you still potentially needed any help. Thank you for your time and I hope that you have a good remainder of your day.   Kind Regards, J. Avery King ... View more

Greetings Zulkarnain,   I hope that this note finds you well! I know that it has been a while since you had posted this question but I wanted to see if you still potentially needed any help. Thank you for your time and I hope that you have a good remainder of your day.   Kind Regards, J. Avery King ... View more

Greetings LChelek,   I hope that this note finds you well! I know that it has been a while since you had posted this question but I wanted to see if you still potentially needed any help. Thank you for your time and I hope that you have a good remainder of your day.   Kind Regards, J. Avery King ... View more

Greetings MPestell,   I hope that this note finds you well! I know that it has been a while since you had posted this question but I wanted to see if you still potentially needed any help. Thank you for your time and I hope that you have a good remainder of your day.   Kind Regards, J. Avery King ... View more

Greetings Lloydc,   I hope that this note finds you well! I know that it has been a while since you had posted this question but I wanted to see if you still potentially needed any help. Thank you for your time and I hope that you have a good remainder of your day.   Kind Regards, J. Avery King ... View more

Greetings Ramyfrahman,   I hope that this note finds you well! I know that it has been a while since you had posted this question but I wanted to see if you still potentially needed any help. Thank you for your time and I hope that you have a good remainder of your day.   Kind Regards, J. Avery King ... View more

Greetings Shaanghaur,   I hope that this note finds you well! I know that it has been a while since you had posted this question but I wanted to see if you still potentially needed any help. Thank you for your time and I hope that you have a good remainder of your day.   Kind Regards, J. Avery King ... View more

Greetings KRyu,   I hope that this note finds you well! I know that it has been a while since you had posted this question but I wanted to see if you still potentially needed any help. Thank you for your time and I hope that you have a good remainder of your day.   Kind Regards, J. Avery King ... View more

Greetings Ziggu88,   I hope that this note finds you well! I know that it has been a while since you had posted this question but I wanted to see if you still potentially needed any help. Thank you for your time and I hope that you have a good remainder of your day.   Kind Regards, J. Avery King ... View more