Product Updates
Office Hours

Home
Community
Product Area or Focus

Product Area or Focus

Specific questions and discussions related to Lacework and cloud security environments

26 Topics

Recently active

Most replies Most views Newest first

robert5156Participant

asked in Vulnerability Management

How to identify Internet accessible nodes and container pods ( inbound from internet)?

Hi,Looking for some advice.Basically with-in lacework kubernetes , looking to see which pods & nodes are accessible from internet ( inbound from internet). What i found so far is we can use Resources → Kubernetes → Pod Network → External connections . You can select all columns and download a CSV. There is a similar view for actual nodes as well. Node→ Kubernetes → Node Network → Node External Connections I am not 100% sure if this is accurate. Also this does not tell what ports are open for inbound connections ( some of the ports listed are >65k which seems to be odd as well)Wondering if anyone had figured out the correct way to “Identify Internet accessible nodes and container pods ( inbound from internet)?”. Thanks in advanceAgentLinux 6.6XPlatformUsing Lacework/OperationalizingCloudGCP

3 days ago

mikedurrrParticipant

asked in Practitioner Tools (API/CLI /LQL)

How can I exclude hosts that haven't been seen for over X hours when pulling vulnerability data from the API?

I only want to see vulnerabilities for hosts that have been running in last 8 hours in my vulnerability reports. How can I craft my API calls to achieve this? AgentN/APlatformN/ACloudN/A

7 days ago

craigbeyerjrParticipant

posted in Practitioner Tools (API/CLI /LQL)

Using the API to Automate a Lacework Response Process

How have you and your team leveraged the Lacework API to develop automation that effectively replaced a manual Lacework process within your organization? Please share your success story! AgentN/APlatformUsing Lacework/OperationalizingCloudN/A

8 days ago

james.banksParticipant

posted in Practitioner Tools (API/CLI /LQL)

Getting Started with LQL (Lacework Query Language): LQL Overview (Documentation Highlights)

LQL Overviewhttps://docs.lacework.net/lql/restricted/lql-overviewThe Lacework Query Language (LQL) is an SQL-like query language for specifying the selection, filtering, and manipulation of data. Queries let you interactively request information from curated datasources. Queries have a defined structure for authoring detections.LQL enables you to find non-compliant resources or suspicious activity by querying data ingested from cloud providers, Kubernetes, CloudTrail activity logs, and the Lacework agent. Then you can associate queries with policies, which contain rich reporting metadata. LQL Operatorshttps://docs.lacework.net/lql/restricted/lql-operatorsLQL uses conventional SQL notation for arithmetic, comparisons, and logical operations. LQL Functionshttps://docs.lacework.net/lql/restricted/lql-functionsThis topic lists all Lacework Query Language functions alphabetically. Datasource Metadatahttps://docs.lacework.net/lql/restricted/datasource-metadataThis topic lists the datasources

14 days ago

james.banksParticipant

posted in Practitioner Tools (API/CLI /LQL)

Getting Started with LQL (Lacework Query Language): Explore the existing LQL Queries

In case you and your team want to explore the existing LQL (Lacework Query Language), the output from lacework query list --json, can be processed with a combination of grep and sed to output a single file that lists all of the Out-Of-The-Box LQL Queries (with the properly formatted LQL). A single file will enable you toCopy and Paste specific LQL queries into a file to run with lacework query run -f <FILENAME>.lql. Search across ALL examples by Data Source Functions Keywords Operators % lacework query list --json | grep "queryId\|queryText" | sed 's/\\n}",/\n }\n/g; s/\\n/\n/g; s/",$//g; s/^ "queryId": "/\n---\nqueryId: /; s/^ "queryText": "/queryText: |-\n /g;' | less -O lacework.query.list.lql---queryId: LW_Global_AWS_CTA_AccessKeyDeletedqueryText: |- { source { CloudTrailRawEvents } filter { EVENT_SOURCE = 'iam.amazonaws.com' and EVENT_NAME = 'DeleteAccessKey' and ERROR_CODE is null } return distinct { INSERT_ID,

14 days ago

Lucas CoatanlemParticipant

asked in Cloud Management Security

Route 53 domain update / deletion alarm

Hello, I would like to know if it is possible to track updates / deletion of a Registered Domain in Route 53 through Cloudtrail x Lacework.As this ressource is critical, the alarm must be immediately raised. Thank you for your assistance. Lucas AgentAgentless (Workload Scanning)PlatformTuning Lacework/CustomizationCloudAWS

14 days ago

LacerXLacer

asked in Vulnerability Management

How often are update CVEs?

AgentN/APlatformCurrentCloudN/A

20 days ago

julian.hartyCommunity Manager

asked in Cloud Workload Security

How to identify all internet exposed resources?

Details

20 days ago

ashley.dejesusParticipant

posted in Alert Investigation

What are the benefits of Lacework's Composite Alerts?

Better detection for Compromised Credentials and Cloud-Native Ransomware - these are the two initially targeted detection use cases Automatically combines events from many detection sources Provides a single, actionable “story” on cloud activity (vs multiple isolated alerts) Provides improvements in: cross-model detections, leveraging domain knowledge at scale, scaling up detection services, and incorporating user feedbackFind out more here:https://docs.lacework.net/console/introduction-to-composite-alerts AgentN/APlatformUsing Lacework/OperationalizingCloudAWS

21 days ago

JoeCloudParticipant

posted in Cloud Workload Security

Lacework Support of CloudTrail's S3 Data Event Log Scanning

Is Lacework planning to support the scanning of CloudTrail's S3 Data Event Logs, which include actions like PUT, GET, HEAD, etc.?This capability would be instrumental in identifying potentially compromised accounts or detecting leaked access keys.If this feature is in the roadmap, what is the anticipated timeline for its roll-out? Reference: https://repost.aws/knowledge-center/cloudtrail-data-management-events AgentN/APlatformUsing Lacework/OperationalizingCloudAWS

22 days ago

DROP TABLE IF EXISTSParticipant

posted in Practitioner Tools (API/CLI /LQL)

LQL Mastery Show-off thread

As the title suggest, this is a place to share custom LQL queries you’ve created and want to share with the Lacework community. AgentN/APlatformTuning Lacework/CustomizationCloudN/A

27 days ago

julian.hartyCommunity Manager

asked in Cloud Workload Security

spencerParticipant

posted in Cloud Management Security

New Google Cloud Pub/Sub Audit Log Integration!

We’re very excited to announce a new Pub/Sub-based integration to collect Google Cloud Audit Logs! This new integration unlocks a ton of new capabilities, including:Low-latency alerting, as events are delivered from Google Cloud much more quickly Composite alerts based on Google Cloud Audit Log events Custom LQL policies based on Google Cloud Audit Log eventsThis integration is currently in Public Preview as we monitor performance and collect customer feedback.If you are integrating Lacework with Google Cloud for the first time, then please reach out to me (spencer.engleson@lacework.net) to get the Pub/Sub integration enabled.If you have already integrated Lacework with Google Cloud, then you may need to migrate from the Storage-based integration to the new Pub/Sub architecture. See our product documentation for more information:Migrate using Terraform Migrate manuallyPlease comment here or reach out to me directly with questions and feedback. AgentN/APlatformCurrentCloudGCP

1 month ago

LacerXLacer

asked in Vulnerability Management

How does Lacework know if a container/image is active?

AgentN/APlatformCurrentCloudN/A AgentN/APlatformCurrentCloudN/A

1 month ago

LacerXLacer

asked in Vulnerability Management

Where does the data come from that Lacework uses to scan for vulnerabilities?

AgentN/APlatformCurrentCloudN/A

1 month ago

LacerXLacer

asked in Vulnerability Management

Can Lacework import vulnerabilities from custom sources?

Can Lacework import vulnerabilities from custom sources? AgentN/APlatformCurrentCloudN/A

1 month ago

ys009Participant

asked in Cloud Workload Security

Where do I see Active Containers with LW agents running in my environment?

Once you are logged in the Lacework platform, List of active containers can be found via navigating to Resources > Containers > List of active containers under the Polygraph. AgentLinux 6.6XPlatformCurrentCloudHybrid

1 month ago

abeneshParticipant

asked in Practitioner Tools (API/CLI /LQL)

How can in query ECS Tasks or Services that don't have an agent installed?

AgentLinux 6.6XPlatformCurrentCloudAWS

1 month ago

jbonnerParticipant

asked in Practitioner Tools (API/CLI /LQL)

Is there a visual representation / map of all available table joins for LQL/LPP data sources?

For us visual learners 😎 AgentN/APlatformCurrentCloudN/A

1 month ago

sluglord9000Participant

asked in Vulnerability Management

Should I use the inline scanner or container registry integration for Vulnerability Management?

AgentN/APlatformCurrentCloudN/A AgentN/APlatformCurrentCloudN/A

1 month ago

timarenzParticipant

asked in Vulnerability Management

Can the proxy scanner deployed on Kubernetes?

AgentN/APlatformN/ACloudN/A

1 month ago

LacerXLacer

asked in Alert Investigation

How does Lacework determine if a resource has internet exposure?

AgentN/APlatformCurrentCloudAWS

1 month ago

TodoParticipant

asked in Cloud Workload Security

How do I tell what hosts do not have an agent deployed on them?

AgentLinux 6.6XPlatformCurrentCloudAWS

1 month ago

Page 1 / 2

Badge winners

katherine.borzonehas earned the badge Early Lacer
Grant Martinhas earned the badge Early Lacer
david.fiamehas earned the badge Early Lacer
luke.markhas earned the badge Early Lacer
bimala.rosehas earned the badge Early Lacer

Show all badges

Sign up

Already have an account? Login

Login with SSO

Login to the community

Login with SSO

Enter your username or e-mail address. We'll send you an e-mail with instructions to reset your password.

Username or e-mail

Back to overview

Scanning file for viruses.

Sorry, we're still checking this file's contents to make sure it's safe to download. Please try again in a few minutes.

This file cannot be downloaded

Sorry, our virus scanner detected that this file isn't safe to download.