Product Updates
Hack'd
Live Security Workshops

Home
Community
Lacework Platform Q&A

Lacework Platform Q&A

Specific questions and discussions related to Lacework and cloud security environments

31 Topics

Recently active

Most replies Most views Newest first

craigbeyerjrCommunity Manager

asked in Cloud Workload Security

How can Lacework help me triage identified IaC Security violations?

The Lacework IaC Security scanner continuously assess your Infrastructure as Code repository to identify misconfigurations before resources are instantiated in your cloud environment. To ensure a swift and easy remediation process, the Lacework platform provides extensive information for each violation. To find more information on the violation click on the violation and reference the Guidelines tab. (screenshot attached)Here, you will find all relevant information about the violation enabling you to triage and how to effectively remediate the violation. AgentN/APlatformUsing Lacework/OperationalizingCloudN/A

4 days ago

scott.russellCommunity Manager

asked in Vulnerability Management

I currently have two Cloud Account integrations: TF AWS CloudTrail and TF AWS Configuration. If I want to add Agentless Workload Scanning (AWLS), do I need to add a new Cloud Account, or should I modify/replace the existing TF Cloudtrail account?

Short Answer: You can treat Agentless Workload Scanning as it's own integration. You don't need to modify anything in the existing integrations. You can just create a separate one using any of our Agentless Workload Scanning (AWLS) integration methods, found here: https://docs.lacework.net/onboarding/category/aws-agentless-workload-scanning-integrations We also offer Agentless Workload Scanning for GCP, which you can review here: https://docs.lacework.net/onboarding/gcp-integrate-agentless-workload-scanning-with-terraform AgentAgentless (Workload Scanning)PlatformDeploy Lacework/InstallationCloudAWS

8 days ago

scott.russellCommunity Manager

asked in Practitioner Tools (API/CLI /LQL)

In an LQL query, can I use multiple fields in a Semi-join filter?

Short answer: Absolutely! If using a Semi-join (in / not in) LQL query, there may come a time when you'll want to use multiple fields to filter on the "in / not in" value. To show you what I mean and how we can do it, let's use an example. First we'll look at a query that uses a simple Semi-join with just one field then we’ll evolve it to use multiple fields. Okay, let's say we want to get the names of containers that are making network requests to a specific IP address (e.g., 91.109.184.3). In order to do this, we'll use the following data sources and approach:LW_HA_CONNECTION_SUMMARY Contains summaries of all network connections. We'll use this to get the unique machine ID of the host machine(s) connecting to the specific IP address. LW_HE_MACHINES Contains details about host machines. Using the returned machine ID(s) from the LW_HA_CONNECTION_SUMMARY data source, we can get additional details about the host machine(s). LW_HE_CONTAINERS Contains details about containers running

8 days ago

craigbeyerjrCommunity Manager

asked in Alert Investigation

How do you respond when a New Vulnerable Application alert is raised by the Lacework platform?

Start your investigation by gaining an understanding of the vulnerability impacting the application. Ensure you know what exploitation activity for the vulnerability looks like in your environment.Then, focus your attention to the activity that triggered the alert which will typically be a network connection. Investigate the connection details, the source and destination hosts, the IP Addresses, and the processes involved to determine if the connection is expected within your environment. Utilize the Resources dossier to expand your search criteria to check for similar activity in other parts of the environment, also expand the date and time range to check for historical context. Once you understand the activity that triggered the alert, assess it to determine if the activity aligns to what you would expect to see if the vulnerability was exploited.If you do find evidence of vulnerability exploitation or other signs of malicious activity, escalate the alert to an official incident an

19 days ago

JoeCloudParticipant

posted in Cloud Workload Security

Lacework Support of CloudTrail's S3 Data Event Log Scanning

Is Lacework planning to support the scanning of CloudTrail's S3 Data Event Logs, which include actions like PUT, GET, HEAD, etc.?This capability would be instrumental in identifying potentially compromised accounts or detecting leaked access keys.If this feature is in the roadmap, what is the anticipated timeline for its roll-out? Reference: https://repost.aws/knowledge-center/cloudtrail-data-management-events AgentN/APlatformUsing Lacework/OperationalizingCloudAWS

1 month ago

DROP TABLE IF EXISTSLacer

posted in Practitioner Tools (API/CLI /LQL)

LQL Mastery Show-off thread

As the title suggest, this is a place to share custom LQL queries you’ve created and want to share with the Lacework community. AgentN/APlatformTuning Lacework/CustomizationCloudN/A

2 months ago

JBNZLacer

asked in Practitioner Tools (API/CLI /LQL)

How can I add tags to my cli generated terraform for azure

ScenarioAzure policy in place that stop default LW deployment due to region blocks, and required tags.

2 months ago

robert5156Participant

asked in Vulnerability Management

How to identify Internet accessible nodes and container pods ( inbound from internet)?

Hi,Looking for some advice.Basically with-in lacework kubernetes , looking to see which pods & nodes are accessible from internet ( inbound from internet). What i found so far is we can use Resources → Kubernetes → Pod Network → External connections . You can select all columns and download a CSV. There is a similar view for actual nodes as well. Node→ Kubernetes → Node Network → Node External Connections I am not 100% sure if this is accurate. Also this does not tell what ports are open for inbound connections ( some of the ports listed are >65k which seems to be odd as well)Wondering if anyone had figured out the correct way to “Identify Internet accessible nodes and container pods ( inbound from internet)?”. Thanks in advanceAgentLinux 6.6XPlatformUsing Lacework/OperationalizingCloudGCP

2 months ago

mikedurrrLacer

asked in Practitioner Tools (API/CLI /LQL)

How can I exclude hosts that haven't been seen for over X hours when pulling vulnerability data from the API?

I only want to see vulnerabilities for hosts that have been running in last 8 hours in my vulnerability reports. How can I craft my API calls to achieve this? AgentN/APlatformN/ACloudN/A

2 months ago

craigbeyerjrCommunity Manager

posted in Practitioner Tools (API/CLI /LQL)

Using the API to Automate a Lacework Response Process

How have you and your team leveraged the Lacework API to develop automation that effectively replaced a manual Lacework process within your organization? Please share your success story! AgentN/APlatformUsing Lacework/OperationalizingCloudN/A

2 months ago

james.banksLacer

posted in Practitioner Tools (API/CLI /LQL)

Getting Started with LQL (Lacework Query Language): LQL Overview (Documentation Highlights)

LQL Overviewhttps://docs.lacework.net/lql/restricted/lql-overviewThe Lacework Query Language (LQL) is an SQL-like query language for specifying the selection, filtering, and manipulation of data. Queries let you interactively request information from curated datasources. Queries have a defined structure for authoring detections.LQL enables you to find non-compliant resources or suspicious activity by querying data ingested from cloud providers, Kubernetes, CloudTrail activity logs, and the Lacework agent. Then you can associate queries with policies, which contain rich reporting metadata. LQL Operatorshttps://docs.lacework.net/lql/restricted/lql-operatorsLQL uses conventional SQL notation for arithmetic, comparisons, and logical operations. LQL Functionshttps://docs.lacework.net/lql/restricted/lql-functionsThis topic lists all Lacework Query Language functions alphabetically. Datasource Metadatahttps://docs.lacework.net/lql/restricted/datasource-metadataThis topic lists the datasources

2 months ago

james.banksLacer

posted in Practitioner Tools (API/CLI /LQL)

Getting Started with LQL (Lacework Query Language): Explore the existing LQL Queries

In case you and your team want to explore the existing LQL (Lacework Query Language), the output from lacework query list --json, can be processed with a combination of grep and sed to output a single file that lists all of the Out-Of-The-Box LQL Queries (with the properly formatted LQL). A single file will enable you toCopy and Paste specific LQL queries into a file to run with lacework query run -f <FILENAME>.lql. Search across ALL examples by Data Source Functions Keywords Operators % lacework query list --json | grep "queryId\|queryText" | sed 's/\\n}",/\n }\n/g; s/\\n/\n/g; s/",$//g; s/^ "queryId": "/\n---\nqueryId: /; s/^ "queryText": "/queryText: |-\n /g;' | less -O lacework.query.list.lql---queryId: LW_Global_AWS_CTA_AccessKeyDeletedqueryText: |- { source { CloudTrailRawEvents } filter { EVENT_SOURCE = 'iam.amazonaws.com' and EVENT_NAME = 'DeleteAccessKey' and ERROR_CODE is null } return distinct { INSERT_ID,

2 months ago

Lucas CoatanlemParticipant

asked in Cloud Management Security

Route 53 domain update / deletion alarm

Hello, I would like to know if it is possible to track updates / deletion of a Registered Domain in Route 53 through Cloudtrail x Lacework.As this ressource is critical, the alarm must be immediately raised. Thank you for your assistance. Lucas AgentAgentless (Workload Scanning)PlatformTuning Lacework/CustomizationCloudAWS

2 months ago

LacerXLacer

asked in Vulnerability Management

How often are update CVEs?

AgentN/APlatformCurrentCloudN/A

2 months ago

julian.hartyCommunity Manager

asked in Cloud Workload Security

How to identify all internet exposed resources?

Details

2 months ago

ashley.dejesusLacer

posted in Alert Investigation

What are the benefits of Lacework's Composite Alerts?

Better detection for Compromised Credentials and Cloud-Native Ransomware - these are the two initially targeted detection use cases Automatically combines events from many detection sources Provides a single, actionable “story” on cloud activity (vs multiple isolated alerts) Provides improvements in: cross-model detections, leveraging domain knowledge at scale, scaling up detection services, and incorporating user feedbackFind out more here:https://docs.lacework.net/console/introduction-to-composite-alerts AgentN/APlatformUsing Lacework/OperationalizingCloudAWS

2 months ago

julian.hartyCommunity Manager

asked in Cloud Workload Security

Page 1 / 2

Badge winners

meagen.eisenberghas earned the badge Early Lacer
I.H.has earned the badge Early Adopter
JBNZhas earned the badge Spam
katherine.borzonehas earned the badge Early Lacer
Grant Martinhas earned the badge Early Lacer

Show all badges

Sign up

Already have an account? Login

Login with SSO

Login to the community

Login with SSO

Enter your username or e-mail address. We'll send you an e-mail with instructions to reset your password.

Username or e-mail

Back to overview

Scanning file for viruses.

Sorry, we're still checking this file's contents to make sure it's safe to download. Please try again in a few minutes.

This file cannot be downloaded

Sorry, our virus scanner detected that this file isn't safe to download.