Skip to main content

General Platform Administration and Configuration

Ask a question or join a discussion as you get your Lacework installation up and running

  • 23 Topics
  • 19 Replies
23 Topics
J
j0aqu1mParticipant
asked in General Platform Administration and Configuration
Okta SAML JIT configuration using groups for access

I’ve been able to successfully configure Lacework + Okta SAML JIT for individual accounts. Now, I’m wondering if I’m able to configure Lacework access via Okta group membership. For example, Lacework Admin group membership in Okta would grant admin access to the members in Lacework. There doesn’t seem to be documentation for this so I’m guessing it’s not possible? AgentundefinedPlatformundefinedCloudundefined

820
J
3 months ago
S
steven.sorannoCommunity Manager
asked in General Platform Administration and Configuration
How to set up Okta SAML JIT for a single account in Lacework?

General Instructions for setup:Complete the steps in the following documentation in order to set up an App Integration in Okta with all the Lacework Service Provider information.  Note: In following the above instructions make sure to add the following required attribute statements to the App Integration for JIT access:   If you are using a Lacework Organization with multiple accounts, additional attribute statements must also be added for Organization level roles. Lacework Organization Admin Role Lacework Organization User Role For more information about attribute statements, reference the following documentation: https://docs.lacework.net/onboarding/configure-saml-jit-with-okta Once the App integration is created in Okta with all the correct attribute statements, select the "View SAML setup instructions" option to view the SAML app details.  Log back into lacework and add these IDP metadata details to the Lacework Authentication page.   Navigate back to

2550
S
6 months ago
scott.russell
scott.russellCommunity Manager
asked in General Platform Administration and Configuration
What does "Close as False Positive" button actually do?

A lot of you may have noticed a button appearing on your alerts that says "Close as False Positive." But what does it actually do? Well, let me tell ya! For our reference, this is the button I'm referring to: So what does it do? Well, I'm sure you've probably clicked it thinking that it would prevent that type of alert from showing up again (believe me, I did the same thing). But that's not exactly what it does. When you click "Close as False Positive," you're essentially closing the alert in the same way you would if you clicked the "Close" button. The only difference is that when you click "Close as False Positive," you're actually providing Lacework with some extra feedback. This feedback is then sent to our ML/data team for further analysis. At which point they can make adjustments to the detection engine based on that feedback. That's all good and dandy, but what if I want to prevent that type of alert from showing up again? Well, in that case, you'll want to create exceptions for

4040
scott.russell
8 months ago
C
Lacer
craigbeyerjrLacer
asked in General Platform Administration and Configuration
Can I customize Jira tickets created by Lacework alerts?

Yes, absolutely! If your organization configured Jira as a Lacework Alert Channel, you can easily apply a custom template. In this post, we will develop a custom Jira template that will accomplish the following:Map the severity of Lacework Alerts to Jira's severity field Customize the default Summary field naming convention Several of our customers take advantage of custom templates to override a variety of other default Jira settings. You can learn more about custom Jira templates here. To develop a custom Jira template, start by creating a .json file and copy/paste the following json content.{    "fields": {        "summary": "Lacework - $event_severity_str - $event_type"    },    "severity": {        "Critical": {            "id": "1"        },        "High": {            "id": "2"        },        "Medium": {            "id": "3"        },        "Low": {            "id": "4"        },        "Info": {            "id": "5"        }    }} In the above template, we are renaming the J

5210
C
Lacer
9 months ago
Christopher Black
Lacer
Christopher BlackLacer
asked in General Platform Administration and Configuration
Deploying Lacework using Terraform...without using the LW TF provider

Hello community! I’m working through an interesting scenario where I need to provision EKS audit logs...without using the LW provider. There are some internal constraints on how TF is used with the organization I’m working with. Curious if anyone has any perspective they’re willing to share, cheers! AgentN/APlatformDeploy Lacework/InstallationCloudAWS

3550
Christopher Black
Lacer
9 months ago
N
Lacer
Nick-at-LaceworkLacer
asked in General Platform Administration and Configuration
Does Lacework have an Integration with Bitsight?

Currently, Lacework doesn’t have a direct integration with Bitsight.  With that being said - all of the data that Lacework ingests, Lacework should be able to have a comparison with overlapping areas, ultimately not needing Bitsight.  A great way to do this would be leveraging Lacework’s compliance reports / dashboard where risks are easily identifiable and actionable.  AgentN/APlatformUsing Lacework/OperationalizingCloudN/A

3690
N
Lacer
10 months ago
D
dariooshParticipant
asked in General Platform Administration and Configuration
AWS IdC monitoring

Hi, Is there a way, or is there a roadmap, to monitor IdC users in AWS. The users created in one public cloud sync to AWS IdC. We can imagine that with some high privileges, perhaps, some permissions could be modified. Can Lacework put an eyes on this? Thanks AgentLinux 6.6XPlatformUsing Lacework/OperationalizingCloudAWS

5183
C
Lacer
1 year ago
L
Lucas CoatanlemParticipant
asked in General Platform Administration and Configuration
Deploy Lacework stack again

Hello,Our naming convention has changed, and I would like to rename the stack of Lacework that I already deployed on an account (stack created about 1 year ago). The only way to do that is to delete the stack and create a new one.Will Lacework be capable to match the new stack with the old configuration using the new template (using account ID for example), particularly the Cloudtrail part that has learned about users behaviours during 1 year ?Kind regards,Lucas AgentAgentless (Workload Scanning)PlatformDeploy Lacework/InstallationCloudAWS

7943
L
1 year ago
LacerX
Lacer
LacerXLacer
asked in General Platform Administration and Configuration
Is it possible to allow a user to only see a single section in Lacework?

Recently I was asked by a someone if they could lock down the Lacework UI because they wanted their finance department to only see the licensing used page, so they could match the subscription to vCPU and their license usage.  The answer is YES.  You have granular control over the visibility of what a particular user can potentially access within the platform.The basic steps are, create a role that has only “read access to whatever you want them to access. (Login to lacework Login to Lacework Click on the settings menu at the bottom left In the “Access Control” section, click on “Roles” Click on “+Add New”  Type in the Name of your choice Select the Pages and level of access required for the role Click Create Create a user group and put that “role” in that group Navigate to Settings → User Groups in the “Access Control” Menu group Click on “+Add New”  Type in the Name of your choice Select the role from the dropdown menu Click the Next Button Select the users to be assigned

5080
LacerX
Lacer
1 year ago
LacerX
Lacer
LacerXLacer
asked in General Platform Administration and Configuration
What changed in my configuration to cause the alert?

A Lacework Alert comes in and it is for compliance or configuration changes.  Once you get the alert, it is logical to want to investigate and figure out what caused it, when it happened, and keep investigating so you know when something happened and who made the change.  How can I, within Lacework, identify those changes and be able to compare the configurations so I can identify what changed and when it happend? AgentN/APlatformUsing Lacework/OperationalizingCloudAWS

5361
LacerX
Lacer
1 year ago
I
I.H.Participant
posted in General Platform Administration and Configuration
Business logic vulnerabilitiy on the SSO between portal and the community

First of all, love the new Lacework community. Thank you for building it and the invitation. In my opinion, there is a security flaw in the current implementation of Portal SSO when it interacts with the community. Currently, when the user login to the community page, the user been granted the whole access to the portal page https://portal.lacework.com/app/UserHome  The logout functionality appears to have a flaw as it allows users to easily log back in without entering any username or password credentials. This poses a security risk and needs to be addressed.Moreover, an effective example of Single Sign-On implementation can be seen with Okta and Jira. In this case, users are unable to access Okta through the Jira login, ensuring a more secure authentication process. Since the Lackwork portal and/or community page is perpetually logged in, an attacker has the potential to manipulate any settings within the system(e.g. XSS or phishing). This poses a significant security risk as unautho

8814
I
1 year ago
E
erika.garciaParticipant
asked in General Platform Administration and Configuration
QUESTION ABOUT CHANGE OF ALIAS

Hi! I was modifying the aliases of the AWS accounts from Lacework and I noticed that two sections appear, one called Lacework-Control-Tower-Config-Member-"account" and another TF AWS EKS Audit Log, each of the accounts has these two sections . My question is whether I should modify the alias of both, or just one. I am making this change from settings > cloud accountsI wait your answer.Thank you.

5521
C
Lacer
1 year ago
M
M AParticipant
asked in General Platform Administration and Configuration
New Agent URL

The api.lacework.net agent url will retire on October 31, 2023, and will be replaced with agent.lacework.net.Is there a way to have the agent change its own target? Is there a way to get a report on which IP addresses are using the old endpoint before the retirement?AgentN/APlatformUsing Lacework/OperationalizingCloudAWS

3791
C
Lacer
1 year ago
sporcello
Lacer
sporcelloLacer
asked in General Platform Administration and Configuration
Why does my Lacework agent (datacollector) container stop in my ECS Fargate cluster?

I would like to run the Lacework agent as a sidecar in my ECS Fargate cluster. I followed the documentation here to add the datacollector sidecar container into my task definition. When the task starts, I can see both my application and the datacollector containers. The datacollector container starts and stops, then my application container starts and runs. Is this expected?  AgentLinux 6.6XPlatformDeploy Lacework/InstallationCloudAWS

7411
sporcello
Lacer
1 year ago
J
Lacer
josehelpsLacer
posted in General Platform Administration and Configuration
LOLDrivers Lacework LQL Detection

Hey everyone,I wanted to share something valuable with the community, especially since a few customers have inquired about this recently. We all know the significance of staying a step ahead in the cybersecurity landscape, and this is a step in that direction.LOLDrivers is a well-curated list of Windows drivers that adversaries commonly use to bypass security measures and execute attacks. It has been used quite often by many threat actors: https://cybernews.com/security/bring-your-own-vulnerable-driver-attack/.I've crafted a script that automatically fetches the latest malicious hashes from the LOLDrivers project and builds an LQL rule, which can be seamlessly deployed in your Lacework environment. This script serves as a tool to monitor and detect malicious drivers in real-time within your infrastructure.Here's how you can integrate this into your Lacework setup:1. Get the Script: Grab the script from this link.   2. Deploy the LQL Rule: Use the Lacework CLI with the following command

5810
J
Lacer
1 year ago
A
Lacer
Andrew LeeLacer
posted in General Platform Administration and Configuration
What CSPM reporting works best for you?

Looking to get feedback on what types of reports or report data points must uesrs really care about or help them in there work flow.There is lots of data there but what do you really want to see and how would you like to see it AgentN/APlatformUsing Lacework/OperationalizingCloudN/A

5110
A
Lacer
1 year ago
ECleary
Lacer
EClearyLacer
asked in General Platform Administration and Configuration
How do I change the severity of an alert policy?

If I’m getting a lot of medium-level alerts for things that aren’t that big a deal for our organization, how do I set them to Low or Info? AgentN/APlatformCurrentCloudAWS

9043
A
Lacer
1 year ago
Ben Sherman
Lacer
Ben ShermanLacer
posted in General Platform Administration and Configuration
CIEM (Cloud Infrastructure Entitlement Management)

Lacework’s CIEM is likely new to you, but for those of us that have used CIEM-like solutions elsewhere, you will immediately note ways to accelerate the march toward Zero Trust and Least Privilege absent those other solutions. Operationalizing CIEMHow often is the first step of operationalizing something to “do nothing, sit back and enjoy.” That is where I like to start discussions of CIEM. Why? Once CIEM is enabled (did you have your CSM, PS, or SE enable it in your GUI with your tenant’s unique organizational GUID?). Thats it ! Lacework automatically moves through configuration and log data to profile all your resources and ownership including net-effective permissions (say goodbye to those spreadsheets). Then, Lacework relies upon an automatic composite alert to fire. These provide high efficacy context signals of privilege escalation and enumeration of anomalies. Why do I start here? Because, most customer risk and IAM managers say they already have Identity and access handled by v

5420
Ben Sherman
Lacer
1 year ago
T
Lacer
tristancollinsLacer
posted in General Platform Administration and Configuration
Troubleshooting SAML JIT 403s

Introduction:Are you trying to configure your Lacework Instance to use SAML JIT and getting the following message? Well it turns out you’re not the only one, and even better it’s probably going to be a pretty easy fix! Typically 403s are a result of not having your JIT attributes configured properly - e.g. they’re not included when expected, attribute names are mis-typed or maybe the values you’re assigning can’t be determined in the platform (e.g. incorrect account names). JIT Attribute Recap:In order for a user to gain access to the Lacework Platform they must have the following attributes set against their profile/group in your IDP:First Name Last Name Company Lacework Admin Role Account OR Lacework Power User Role Accounts OR Lacework User Role Accounts (they only need one of these attributes - but Lacework will choose the highest level of access included)For the full list (and what values you can include), check out the full documentation here. How to Troubleshoot:The first thing

6080
T
Lacer
1 year ago
M
Lacer
mr_torreLacer
asked in General Platform Administration and Configuration
What are the pros/cons of a single account vs multiaccount/organizational structure?

It is purely around separating enviornments, or anything else to consider? AgentN/APlatformN/ACloudAWS

2700
M
Lacer
1 year ago
S
Lacer
steffen.hellwigLacer
asked in General Platform Administration and Configuration
Is there a way to list all active Lacework agents?

Sometimes it is important to list very specific filters or the whole infrastructure about all agents to know about versions or to have an overview about the covered environment.How to do this? 

6531
S
Lacer
1 year ago
Grant Martin
Grant MartinCommunity Manager
asked in General Platform Administration and Configuration
Where does the Digital Hub work on Wednesdays?

I cannot find the answer. AgentLinux <5.0x< />>PlatformN/ACloudGCP

2760
Grant Martin
1 year ago
T
Lacer
TodoLacer
asked in General Platform Administration and Configuration
How do I see AWS Account name instead of number?

After I completed my Lacework CSPM integration into AWS, it does not list my AWS accounts by name, only numbers when viewing the data in the platform. How can I see the names per integrated account? AgentN/APlatformCurrentCloudAWS

6751
T
Lacer
1 year ago

Badge winners

Show all badges
Terms of UseCookie settings