In case you and your team want to explore the existing LQL (Lacework Query Language), the output from lacework query list --json
, can be processed with a combination of grep
and sed
to output a single file that lists all of the Out-Of-The-Box LQL Queries (with the properly formatted LQL).
A single file will enable you to
- Copy and Paste specific LQL queries into a file to run with
lacework query run -f <FILENAME>.lql
. - Search across ALL examples by
- Data Source
- Functions
- Keywords
- Operators
% lacework query list --json | grep "queryId\|queryText" | sed 's/\\n}",/\n }\n/g; s/\\n/\n/g; s/",$//g; s/^ "queryId": "/\n---\nqueryId: /; s/^ "queryText": "/queryText: |-\n /g;' | less -O lacework.query.list.lql
---
queryId: LW_Global_AWS_CTA_AccessKeyDeleted
queryText: |-
{
source {
CloudTrailRawEvents
}
filter {
EVENT_SOURCE = 'iam.amazonaws.com'
and EVENT_NAME = 'DeleteAccessKey'
and ERROR_CODE is null
}
return distinct {
INSERT_ID,
INSERT_TIME,
EVENT_TIME,
EVENT
}
}
. . .
Save a query in a separate file in order to run it locally.
% cat LW_Global_AWS_CTA_AccessKeyDeleted.lql
---
queryId: LW_Global_AWS_CTA_AccessKeyDeleted
queryText: |-
{
source {
CloudTrailRawEvents
}
filter {
EVENT_SOURCE = 'iam.amazonaws.com'
and EVENT_NAME = 'DeleteAccessKey'
and ERROR_CODE is null
}
return distinct {
INSERT_ID,
INSERT_TIME,
EVENT_TIME,
EVENT
}
}
Run the query with lacework query run -f <FILENAME>.lql
.
% lacework --profile tudor query run -f LW_Global_AWS_CTA_AccessKeyDeleted.lql | less -O LW_Global_AWS_CTA_AccessKeyDeleted.json
<
{
"EVENT": {
"awsRegion": "us-east-1",
"eventCategory": "Management",
"eventID": "123ab456-7c89-12de-3f45-ab6cde7fa89b",
"eventName": "DeleteAccessKey",
"eventSource": "iam.amazonaws.com",
"eventTime": "2023-09-13T08:23:54Z",
"eventType": "AwsApiCall",
"eventVersion": "1.08",
"managementEvent": true,
"readOnly": false,
. . .
Documentation
Lacework CLI Reference : lacework policy list
https://docs.lacework.net/cli/commands/lacework_policy_list
Lacework CLI Reference : lacework query list
https://docs.lacework.net/cli/commands/lacework_query_list
Lacework CLI Reference : lacework query run
https://docs.lacework.net/cli/commands/lacework_query_run
Agent
N/A
Platform
Using Lacework/Operationalizing
Cloud
N/A