Lacework Platform Q&A

Specific questions and discussions related to Lacework and cloud security environments

37 Topics

jbonnerLacer

asked in Practitioner Tools (API/CLI /LQL)

Is there a visual representation / map of all available table joins for LQL/LPP data sources?

For us visual learners 😎 AgentN/APlatformCurrentCloudN/A

1 month ago

abeneshLacer

posted in Practitioner Tools (API/CLI /LQL)

Visualising LQL Datasources

LQL has a ton of Datasources that can be queried in a plethora of ways.Some of these Datasources are even related to each other.When faced with the challenge of building a custom LQL Query, I’ve built a little tool that helps you find these Datasources and their relationships in a visual way. You can also search for keywords and highlight the Datasource Neighbors: Hovering over one of the Sources and clićking the link takes you to the respective Datasource documentation.Since each tenant might have a different set of Datasources available, there is no public Datasource Map available, which is why you’ll need to run a quick python script to create your individual graph. Usage is very simple:pip install laceworksdk pyvispython datasource_visualizer.py --profile your-lacework-cli-profile Your browser will open up the Map after a few seconds. It’ll be be a HTML file you can reference whenever you need to look something up.No need to run the script everytime. This is just needed when dataso

1 month ago

therockvalleyParticipant

asked in Cloud Workload Security

Has anyone figured out a way to create resource groups based on pod labels?

I’m trying to create container resource groups based on pod labels, but these do not seem to be available.In specific I want to be able to create resource groups and queries based on the output of: kubectl get pod my_pod -n my_namespace -o=jsonpath='{.metadata.labels}'Below is an example of what I would like to do in query terms:filter { containers.PROPS_LABELS["my_pod_label_key"] = "my_pod_label_value" }(this won’t actually work afaik, just an illustration of what I’m after)Seems like a rather obvious thing to be able to do. Wondering is there is an apparent trick I’m missing.AgentN/APlatformTuning Lacework/CustomizationCloudN/A

2 months ago

james.banksLacer

posted in Practitioner Tools (API/CLI /LQL)

Getting Started with LQL (Lacework Query Language): LQL Overview (Documentation Highlights)

LQL Overviewhttps://docs.lacework.net/lql/restricted/lql-overviewThe Lacework Query Language (LQL) is an SQL-like query language for specifying the selection, filtering, and manipulation of data. Queries let you interactively request information from curated datasources. Queries have a defined structure for authoring detections.LQL enables you to find non-compliant resources or suspicious activity by querying data ingested from cloud providers, Kubernetes, CloudTrail activity logs, and the Lacework agent. Then you can associate queries with policies, which contain rich reporting metadata. LQL Operatorshttps://docs.lacework.net/lql/restricted/lql-operatorsLQL uses conventional SQL notation for arithmetic, comparisons, and logical operations. LQL Functionshttps://docs.lacework.net/lql/restricted/lql-functionsThis topic lists all Lacework Query Language functions alphabetically. Datasource Metadatahttps://docs.lacework.net/lql/restricted/datasource-metadataThis topic lists the datasources

3 months ago

spencerLacer

posted in Cloud Management Security (CSPM, IaC Security, UEBA)

New Google Cloud Pub/Sub Audit Log Integration!

We’re very excited to announce a new Pub/Sub-based integration to collect Google Cloud Audit Logs! This new integration unlocks a ton of new capabilities, including:Low-latency alerting, as events are delivered from Google Cloud much more quickly Composite alerts based on Google Cloud Audit Log events Custom LQL policies based on Google Cloud Audit Log eventsThis integration is currently in Public Preview as we monitor performance and collect customer feedback.If you are integrating Lacework with Google Cloud for the first time, then please reach out to me (spencer.engleson@lacework.net) to get the Pub/Sub integration enabled.If you have already integrated Lacework with Google Cloud, then you may need to migrate from the Storage-based integration to the new Pub/Sub architecture. See our product documentation for more information:Migrate using Terraform Migrate manuallyPlease comment here or reach out to me directly with questions and feedback. AgentN/APlatformCurrentCloudGCP

3 months ago

steven.sorannoLacer

asked in Practitioner Tools (API/CLI /LQL)

How can I identify and list all security groups associated with ECS fargate tasks?

In AWS all ECS fargate tasks run in the “awsvpc” networking mode which means that each task gets its own Elastic Network Interface (ENI). Since each task gets an ENI, this means that a security group must also be attached to the task and we can search for this security group id using LQL. The query below will filter for any network interface that is associated to an ECS task and will return the security group associated to that ENI. queryId: LWCustomCompliance_ECS_fargate_security_groupsqueryText: |- { source { LW_CFG_AWS_EC2_NETWORK_INTERFACES as interface, array_to_rows(interface.RESOURCE_CONFIG:Groups) as groups } filter{ RESOURCE_ID::String in { source { LW_CFG_AWS_ECS_DESCRIBE_TASKS as task, array_to_rows(task.RESOURCE_CONFIG:attachments) as attachments, array_to_rows(attachments:details) as details } filter { details:value::String like any("eni-%") } return {

3 months ago

steven.sorannoLacer

asked in Vulnerability Management

How to set up the Lacework Proxy Scanner to integrate with a Sonatype Nexus Registry with multiple repositories?

Instructions for how to create a proxy scanner integration can be found in the following documentation. However, it is important to note that the example config.yml provided in the "Configure the Proxy Scanner" section is intended for a connection to a single Nexus repository with one domain/port. If there is a need to have the proxy scanner to scan multiple repositories, the config.yml file for the proxy scanner needs to have multiple registry domains, one for each repository since in Nexus, repositories are configured and run on separate ports. An example of a proxy scanner config.yaml file for multiple repositories can be found below. scan_public_registries: falsestatic_cache_location: /opt/lacework/cachedefault_registry:lacework: account_name: lacework-account integration_access_token: ****registries: - domain: NEXUS-FQDN:<port> name: NEXUS1 ssl: true is_public: false credentials: user_name: "userinregistry" password: "*****" notification_type:

3 months ago

CSA TeamCommunity Manager

asked in Cloud Management Security (CSPM, IaC Security, UEBA)

What are the differences between Lacework and GCP's Cloud Asset Inventory?

If this is you:I’ve recently come across one of Google Cloud’s offerings, Cloud Asset Inventory, and I’m curious what the difference is between that and what Lacework has to offer?Then check out the answer below! AgentN/APlatformUsing Lacework/OperationalizingCloudGCP

3 months ago

steven.sorannoLacer

asked in Practitioner Tools (API/CLI /LQL)

How can I pull Kubernetes Compliance report data via the Lacework API?

The following Lacework API endpoint, “/api/v2/Configs/ComplianceEvaluations/search”, will enable you to export Kubernetes Compliance report data in json format. Below is an example using this endpoint to pull all Kubernetes Compliance data for a set timeframe. When using this endpoint, ensure that the payload has dataset set to “K8sCompliance” to filter out any CSP compliance data.lacework api post "/api/v2/Configs/ComplianceEvaluations/search" -d '{ "timeFilter": { "startTime": "2024-03-12T20:30:00Z", "endTime": "2024-03-13T22:30:00Z"},"dataset": "K8sCompliance" }'The output of this command will be a json array of objects detailing all the Kubernetes Compliance Violations with each object looking similar to the example below:{ "account": { "AccountId": "XXXXXXXXXXXX", "accountId": "XXXXXXXXXXXX" }, "evalType": "LW_K8S_SA", "id": "lacework-global-315", "reason": "EKS cluster does not have all logging categories enabled", "recommendation":

4 months ago

JoeCloudParticipant

posted in Cloud Workload Security

Lacework Support of CloudTrail's S3 Data Event Log Scanning

Is Lacework planning to support the scanning of CloudTrail's S3 Data Event Logs, which include actions like PUT, GET, HEAD, etc.?This capability would be instrumental in identifying potentially compromised accounts or detecting leaked access keys.If this feature is in the roadmap, what is the anticipated timeline for its roll-out? Reference: https://repost.aws/knowledge-center/cloudtrail-data-management-events AgentN/APlatformUsing Lacework/OperationalizingCloudAWS

4 months ago

steven.sorannoLacer

asked in Cloud Management Security (CSPM, IaC Security, UEBA)

When investigating an identity in the identities dossier, how can I determine what AWS IAM policy a specific permission is a part of in AWS?

When reviewing an identity in the identity explorer, it is possible to export all entitlements tied to the identity being reviewed. From this export additional fields can be seen one of which is the policy that each action is a part of along with the role/user it is attached to. To export an entitlements list as a CSV follow the below steps:Navigate to Identities > Explore: Identities, select the identity that you want to investigate. Select the Entitlements tab to display all the entitlements that identity has and select the service you want to export. Once the service is selected, click the download icon to download the csv export which includes the policy name in column F. Example CSV Output: Principal ID Account ID Account Alias Service name Resource Policy name Updated time Actions Used Last Used Revoked Condition arn:aws:iam::XXXXXXXXXXXX:root XXXXXXXXXXXX

4 months ago

Ahmed AbugharbiaLacer

asked in Cloud Management Security (CSPM, IaC Security, UEBA)

Using Terraform to Integrate with Lacework in AWS Organization

There are several ways to integrate Lacework with accounts in an AWS Organization. Lacework provides multiple Terraform modules for this purpose. In this post, we will focus on the aws_org_configuration module. Integration:The aws_org_configuration module offers seamless automation for integrating Lacework with AWS Configuration and CloudTrail. It simplifies the process by automatically configuring integration across the root account and all associated sub-accounts within the specified organizational unit (OU). Additionally, it creates an SNS topic and Lambda function, ensuring that any new AWS accounts added to the organization are seamlessly integrated with Lacework. The module will perform the following tasks:Create the CloudTrail integration at the root account level. Create AWS Configuration integration for each of the sub-accounts. Note that this is not the same as the AWS Config service. Lacework does not rely on the native AWS Config service.For Lacework to access configuration

5 months ago

imrandoraneyLacer

asked in Cloud Management Security (CSPM, IaC Security, UEBA)

How often is my cloud account tested for compliance violations? And when should I expect a configuration that violates a compliance policy be triggered as an alert?

Scenario: want to understand how often Lacework scans our environment and when we’ll be alerted to changes AgentN/APlatformUsing Lacework/OperationalizingCloudN/A

5 months ago

imrandoraneyLacer

asked in Cloud Management Security (CSPM, IaC Security, UEBA)

JBNZLacer

asked in Practitioner Tools (API/CLI /LQL)

How can I add tags to my cli generated terraform for azure

ScenarioAzure policy in place that stop default LW deployment due to region blocks, and required tags.

9 months ago

robert5156Participant

asked in Vulnerability Management

How to identify Internet accessible nodes and container pods ( inbound from internet)?

Hi,Looking for some advice.Basically with-in lacework kubernetes , looking to see which pods & nodes are accessible from internet ( inbound from internet). What i found so far is we can use Resources → Kubernetes → Pod Network → External connections . You can select all columns and download a CSV. There is a similar view for actual nodes as well. Node→ Kubernetes → Node Network → Node External Connections I am not 100% sure if this is accurate. Also this does not tell what ports are open for inbound connections ( some of the ports listed are >65k which seems to be odd as well)Wondering if anyone had figured out the correct way to “Identify Internet accessible nodes and container pods ( inbound from internet)?”. Thanks in advanceAgentLinux 6.6XPlatformUsing Lacework/OperationalizingCloudGCP

10 months ago

mikedurrrLacer

asked in Practitioner Tools (API/CLI /LQL)

How can I exclude hosts that haven't been seen for over X hours when pulling vulnerability data from the API?

I only want to see vulnerabilities for hosts that have been running in last 8 hours in my vulnerability reports. How can I craft my API calls to achieve this? AgentN/APlatformN/ACloudN/A

10 months ago

james.banksLacer

posted in Practitioner Tools (API/CLI /LQL)

Getting Started with LQL (Lacework Query Language): Explore the existing LQL Queries

In case you and your team want to explore the existing LQL (Lacework Query Language), the output from lacework query list --json, can be processed with a combination of grep and sed to output a single file that lists all of the Out-Of-The-Box LQL Queries (with the properly formatted LQL). A single file will enable you toCopy and Paste specific LQL queries into a file to run with lacework query run -f <FILENAME>.lql. Search across ALL examples by Data Source Functions Keywords Operators % lacework query list --json | grep "queryId\|queryText" | sed 's/\\n}",/\n }\n/g; s/\\n/\n/g; s/",$//g; s/^ "queryId": "/\n---\nqueryId: /; s/^ "queryText": "/queryText: |-\n /g;' | less -O lacework.query.list.lql---queryId: LW_Global_AWS_CTA_AccessKeyDeletedqueryText: |- { source { CloudTrailRawEvents } filter { EVENT_SOURCE = 'iam.amazonaws.com' and EVENT_NAME = 'DeleteAccessKey' and ERROR_CODE is null } return distinct { INSERT_ID,

10 months ago

Lucas CoatanlemParticipant

asked in Cloud Management Security (CSPM, IaC Security, UEBA)

Route 53 domain update / deletion alarm

Hello, I would like to know if it is possible to track updates / deletion of a Registered Domain in Route 53 through Cloudtrail x Lacework.As this ressource is critical, the alarm must be immediately raised. Thank you for your assistance. Lucas AgentAgentless (Workload Scanning)PlatformTuning Lacework/CustomizationCloudAWS

10 months ago

LacerXLacer

asked in Vulnerability Management

How often are update CVEs?

AgentN/APlatformCurrentCloudN/A

10 months ago

julian.hartyCommunity Manager

asked in Cloud Workload Security

How to identify all internet exposed resources?

Details

10 months ago

ashley.dejesusLacer

posted in Alert Investigation

What are the benefits of Lacework's Composite Alerts?

Better detection for Compromised Credentials and Cloud-Native Ransomware - these are the two initially targeted detection use cases Automatically combines events from many detection sources Provides a single, actionable “story” on cloud activity (vs multiple isolated alerts) Provides improvements in: cross-model detections, leveraging domain knowledge at scale, scaling up detection services, and incorporating user feedbackFind out more here:https://docs.lacework.net/console/introduction-to-composite-alerts AgentN/APlatformUsing Lacework/OperationalizingCloudAWS

10 months ago

julian.hartyCommunity Manager

asked in Cloud Workload Security

How do I set time range in LQL?

Details...

10 months ago

Page 1 / 2

Lacework Platform Q&A

Badge winners

Sign up

Login with SSO

Login to the community

Login with SSO

Scanning file for viruses.

This file cannot be downloaded