General Platform Administration and Configuration

Ask a question or join a discussion as you get your Lacework installation up and running

  • 10 Topics
  • 7 Replies

10 Topics

I
I.H.Participant
posted in General Platform Administration and Configuration

Business logic vulnerabilitiy on the SSO between portal and the community

First of all, love the new Lacework community. Thank you for building it and the invitation. In my opinion, there is a security flaw in the current implementation of Portal SSO when it interacts with the community. Currently, when the user login to the community page, the user been granted the whole access to the portal page https://portal.lacework.com/app/UserHome  The logout functionality appears to have a flaw as it allows users to easily log back in without entering any username or password credentials. This poses a security risk and needs to be addressed.Moreover, an effective example of Single Sign-On implementation can be seen with Okta and Jira. In this case, users are unable to access Okta through the Jira login, ensuring a more secure authentication process. Since the Lackwork portal and/or community page is perpetually logged in, an attacker has the potential to manipulate any settings within the system(e.g. XSS or phishing). This poses a significant security risk as unautho

0
I
6 days ago
M
M AParticipant
asked in General Platform Administration and Configuration

New Agent URL

The api.lacework.net agent url will retire on October 31, 2023, and will be replaced with agent.lacework.net.Is there a way to have the agent change its own target? Is there a way to get a report on which IP addresses are using the old endpoint before the retirement?AgentN/APlatformUsing Lacework/OperationalizingCloudAWS

1
C
7 days ago
sporcello
sporcelloParticipant
asked in General Platform Administration and Configuration

Why does my Lacework agent (datacollector) container stop in my ECS Fargate cluster?

I would like to run the Lacework agent as a sidecar in my ECS Fargate cluster. I followed the documentation here to add the datacollector sidecar container into my task definition. When the task starts, I can see both my application and the datacollector containers. The datacollector container starts and stops, then my application container starts and runs. Is this expected?  AgentLinux 6.6XPlatformDeploy Lacework/InstallationCloudAWS

1
sporcello
18 days ago
ECleary
EClearyParticipant
asked in General Platform Administration and Configuration

How do I change the severity of an alert policy?

If I’m getting a lot of medium-level alerts for things that aren’t that big a deal for our organization, how do I set them to Low or Info? AgentN/APlatformCurrentCloudAWS

3
A
20 days ago
Ben Sherman
Ben ShermanParticipant
posted in General Platform Administration and Configuration

CIEM (Cloud Infrastructure Entitlement Management)

Lacework’s CIEM is likely new to you, but for those of us that have used CIEM-like solutions elsewhere, you will immediately note ways to accelerate the march toward Zero Trust and Least Privilege absent those other solutions. Operationalizing CIEMHow often is the first step of operationalizing something to “do nothing, sit back and enjoy.” That is where I like to start discussions of CIEM. Why? Once CIEM is enabled (did you have your CSM, PS, or SE enable it in your GUI with your tenant’s unique organizational GUID?). Thats it ! Lacework automatically moves through configuration and log data to profile all your resources and ownership including net-effective permissions (say goodbye to those spreadsheets). Then, Lacework relies upon an automatic composite alert to fire. These provide high efficacy context signals of privilege escalation and enumeration of anomalies. Why do I start here? Because, most customer risk and IAM managers say they already have Identity and access handled by v

0
Ben Sherman
22 days ago
T
tristancollinsParticipant
posted in General Platform Administration and Configuration

Troubleshooting SAML JIT 403s

Introduction:Are you trying to configure your Lacework Instance to use SAML JIT and getting the following message? Well it turns out you’re not the only one, and even better it’s probably going to be a pretty easy fix! Typically 403s are a result of not having your JIT attributes configured properly - e.g. they’re not included when expected, attribute names are mis-typed or maybe the values you’re assigning can’t be determined in the platform (e.g. incorrect account names). JIT Attribute Recap:In order for a user to gain access to the Lacework Platform they must have the following attributes set against their profile/group in your IDP:First Name Last Name Company Lacework Admin Role Account OR Lacework Power User Role Accounts OR Lacework User Role Accounts (they only need one of these attributes - but Lacework will choose the highest level of access included)For the full list (and what values you can include), check out the full documentation here. How to Troubleshoot:The first thing

0
T
1 month ago
M
mr_torreParticipant
asked in General Platform Administration and Configuration

What are the pros/cons of a single account vs multiaccount/organizational structure?

It is purely around separating enviornments, or anything else to consider? AgentN/APlatformN/ACloudAWS

0
M
1 month ago
S
steffen.hellwigParticipant
asked in General Platform Administration and Configuration

Is there a way to list all active Lacework agents?

Sometimes it is important to list very specific filters or the whole infrastructure about all agents to know about versions or to have an overview about the covered environment.How to do this? 

1
S
1 month ago
Grant Martin
Grant MartinCommunity Manager
asked in General Platform Administration and Configuration

Where does the Digital Hub work on Wednesdays?

I cannot find the answer. AgentLinux <5.0x< />>PlatformN/ACloudGCP

0
Grant Martin
1 month ago
T
TodoParticipant
asked in General Platform Administration and Configuration

How do I see AWS Account name instead of number?

After I completed my Lacework CSPM integration into AWS, it does not list my AWS accounts by name, only numbers when viewing the data in the platform. How can I see the names per integrated account? AgentN/APlatformCurrentCloudAWS

1
T
1 month ago

Badge winners

Show all badges
Terms of UseCookie settings