Skip to main content

Practitioner Tools (API/CLI /LQL)

Discussions, questions, and answers related to practitioner tools

  • 11 Topics
  • 6 Replies
11 Topics
D
DaveParticipant
asked in Practitioner Tools (API/CLI /LQL)
Lacework CLI: Where is GCP's Network Interface defined, within the sources of LW_GCF_GCP?

I am trying to create a query that looks for where SSH/RDP open to the web within GCP, only when a network interface is attached the VM. I’m able to locate other platforms (ie: AWS/Azure) where Network Interface is defined within a source (ie: LW_CFG_AWS_EC2_NETWORK_INTERFACES), however, I can’t seem to locate it for GCP. Does anyone happen to have come across this in the past, for GCP specifically?  AgentLinux 6.6XPlatformUsing Lacework/OperationalizingCloudGCP

830
D
2 months ago
J
Lacer
jbonnerLacer
asked in Practitioner Tools (API/CLI /LQL)
Is there a visual representation / map of all available table joins for LQL/LPP data sources? 

For us visual learners 😎 AgentN/APlatformCurrentCloudN/A

3801
A
Lacer
5 months ago
A
Lacer
abeneshLacer
posted in Practitioner Tools (API/CLI /LQL)
Visualising LQL Datasources

LQL has a ton of Datasources that can be queried in a plethora of ways.Some of these Datasources are even related to each other.When faced with the challenge of building a custom LQL Query, I’ve built a little tool that helps you find these Datasources and their relationships in a visual way. You can also search for keywords and highlight the Datasource Neighbors: Hovering over one of the Sources and clićking the link takes you to the respective Datasource documentation.Since each tenant might have a different set of Datasources available, there is no public Datasource Map available, which is why you’ll need to run a quick python script to create your individual graph. Usage is very simple:pip install laceworksdk pyvispython datasource_visualizer.py --profile your-lacework-cli-profile Your browser will open up the Map after a few seconds. It’ll be be a HTML file you can reference whenever you need to look something up.No need to run the script everytime. This is just needed when dataso

2180
A
Lacer
5 months ago
J
Lacer
james.banksLacer
posted in Practitioner Tools (API/CLI /LQL)
Getting Started with LQL (Lacework Query Language): LQL Overview (Documentation Highlights)

LQL Overviewhttps://docs.lacework.net/lql/restricted/lql-overviewThe Lacework Query Language (LQL) is an SQL-like query language for specifying the selection, filtering, and manipulation of data. Queries let you interactively request information from curated datasources. Queries have a defined structure for authoring detections.LQL enables you to find non-compliant resources or suspicious activity by querying data ingested from cloud providers, Kubernetes, CloudTrail activity logs, and the Lacework agent. Then you can associate queries with policies, which contain rich reporting metadata. LQL Operatorshttps://docs.lacework.net/lql/restricted/lql-operatorsLQL uses conventional SQL notation for arithmetic, comparisons, and logical operations. LQL Functionshttps://docs.lacework.net/lql/restricted/lql-functionsThis topic lists all Lacework Query Language functions alphabetically. Datasource Metadatahttps://docs.lacework.net/lql/restricted/datasource-metadataThis topic lists the datasources

7121
scott.russell
7 months ago
S
Lacer
steven.sorannoLacer
asked in Practitioner Tools (API/CLI /LQL)
How can I identify and list all security groups associated with ECS fargate tasks?

In AWS all ECS fargate tasks run in the “awsvpc” networking mode which means that each task gets its own Elastic Network Interface (ENI).  Since each task gets an ENI, this means that a security group must also be attached to the task and we can search for this security group id using LQL.  The query below will filter for any network interface that is associated to an ECS task and will return the security group associated to that ENI.  queryId: LWCustomCompliance_ECS_fargate_security_groupsqueryText: |- { source { LW_CFG_AWS_EC2_NETWORK_INTERFACES as interface, array_to_rows(interface.RESOURCE_CONFIG:Groups) as groups } filter{ RESOURCE_ID::String in { source { LW_CFG_AWS_ECS_DESCRIBE_TASKS as task, array_to_rows(task.RESOURCE_CONFIG:attachments) as attachments, array_to_rows(attachments:details) as details } filter { details:value::String like any("eni-%") } return {

3190
S
Lacer
7 months ago
S
Lacer
steven.sorannoLacer
asked in Practitioner Tools (API/CLI /LQL)
How can I pull Kubernetes Compliance report data via the Lacework API?

The following Lacework API endpoint, “/api/v2/Configs/ComplianceEvaluations/search”,  will enable you to export Kubernetes Compliance report data in json format.   Below is an example using this endpoint to pull all Kubernetes Compliance data for a set timeframe.  When using this endpoint, ensure that the payload has dataset set to “K8sCompliance” to filter out any CSP compliance data.lacework api post "/api/v2/Configs/ComplianceEvaluations/search" -d '{ "timeFilter": { "startTime": "2024-03-12T20:30:00Z", "endTime": "2024-03-13T22:30:00Z"},"dataset": "K8sCompliance" }'The output of this command will be a json array of objects detailing all the Kubernetes Compliance Violations with each object looking similar to the example below:{ "account": { "AccountId": "XXXXXXXXXXXX", "accountId": "XXXXXXXXXXXX" }, "evalType": "LW_K8S_SA", "id": "lacework-global-315", "reason": "EKS cluster does not have all logging categories enabled", "recommendation":

3110
S
Lacer
8 months ago
D
Lacer
DROP TABLE IF EXISTSLacer
posted in Practitioner Tools (API/CLI /LQL)
LQL Mastery Show-off thread

As the title suggest, this is a place to share custom LQL queries you’ve created and want to share with the Lacework community. AgentN/APlatformTuning Lacework/CustomizationCloudN/A

5671
JBNZ
Lacer
1 year ago
JBNZ
Lacer
JBNZLacer
asked in Practitioner Tools (API/CLI /LQL)
How can I add tags to my cli generated terraform for azure

ScenarioAzure policy in place that stop default LW deployment due to region blocks, and required tags.  

5991
JBNZ
Lacer
1 year ago
M
Lacer
mikedurrrLacer
asked in Practitioner Tools (API/CLI /LQL)
How can I exclude hosts that haven't been seen for over X hours when pulling vulnerability data from the API?

I only want to see vulnerabilities for hosts that have been running in last 8 hours in my vulnerability reports. How can I craft my API calls to achieve this? AgentN/APlatformN/ACloudN/A

5171
LacerX
Lacer
1 year ago
J
Lacer
james.banksLacer
posted in Practitioner Tools (API/CLI /LQL)
Getting Started with LQL (Lacework Query Language): Explore the existing LQL Queries

In case you and your team want to explore the existing LQL (Lacework Query Language), the output from lacework query list --json, can be processed with a combination of grep and sed to output a single file that lists all of the Out-Of-The-Box LQL Queries (with the properly formatted LQL). A single file will enable you toCopy and Paste specific LQL queries into a file to run with lacework query run -f <FILENAME>.lql. Search across ALL examples by Data Source Functions Keywords Operators   % lacework query list --json | grep "queryId\|queryText" | sed 's/\\n}",/\n }\n/g; s/\\n/\n/g; s/",$//g; s/^ "queryId": "/\n---\nqueryId: /; s/^ "queryText": "/queryText: |-\n /g;' | less -O lacework.query.list.lql---queryId: LW_Global_AWS_CTA_AccessKeyDeletedqueryText: |- { source { CloudTrailRawEvents } filter { EVENT_SOURCE = 'iam.amazonaws.com' and EVENT_NAME = 'DeleteAccessKey' and ERROR_CODE is null } return distinct { INSERT_ID,

6090
J
Lacer
1 year ago
A
Lacer
abeneshLacer
asked in Practitioner Tools (API/CLI /LQL)
How can in query ECS Tasks or Services that don't have an agent installed?

AgentLinux 6.6XPlatformCurrentCloudAWS

4881
A
Lacer
1 year ago

Badge winners

Show all badges
Terms of UseCookie settings