Audit Event Query Examples

Review examples that show you how to use Audit Event Query Attributes for investigating issues on the following cloud platforms:

• Audit Event Query Examples for AWS
• Audit Event Query Examples for Azure
• Audit Event Query Examples for GCP

Audit Event Query Examples for AWS

DESCRIPTION	RQL
Detect activities from non-automated events and from specific IP addresses.	event from cloud.audit_logs where ip EXISTS AND ip IN ( 152.1.1.1)
Detect potentially sensitive or suspicious changes to the network configuration that impact your security posture.	event from cloud.audit_logs where operation IN ('AuthorizeSecurityGroupEgress', 'AuthorizeSecurityGroupIngress', 'CreateVpc', 'DeleteFlowLogs', 'DeleteVpc', 'ModifyVpcAttribute', 'RevokeSecurityGroupIngress')
Detect potentially sensitive or suspicious changes to configuration settings.	event from cloud.audit_logs where operation IN ('DeleteBucket', 'DeleteConfigRule', 'DeleteTrail', 'PutBucketAcl', 'PutBucketLogging', 'PutBucketPolicy') event from cloud.audit_logs where operation IN ( 'AddUserToGroup', 'AttachGroupPolicy', 'AttachGroupPolicy', 'AttachUserPolicy' , 'AttachRolePolicy' , 'CreateAccessKey', 'CreateKeyPair', 'DeleteKeyPair', 'DeleteLogGroup' )
Detect risky changes executed by a root user.	event from cloud.audit_logs where operation IN ( 'ChangePassword', 'ConsoleLogin', 'DeactivateMFADevice', 'DeleteAccessKey' , 'DeleteAlarms' ) AND user = 'root'
Exclude results that match a specific string within an array in the event details. To exclude results that include a specific string within an array, use the matches or does not match operator instead of contains/does not contain or exists/does not exist.	event from cloud.audit_logs where operation IN ('AttachGroupPolicy', 'AttachRolePolicy', 'DeleteGroupPolicy', 'DeleteKeyPair', 'DeleteLogGroup') AND json.rule = $.userIdentity.arn does not match "AWSCloudFormationStackSetExecutionRole" or $.userIdentity.arn does not match "INST-SR-EC2-GRAAS-ROLE"

Audit Event Query Examples for Azure

DESCRIPTION	RQL
List specific operations performed on a specific Azure account.	event from cloud.audit_logs where cloud.account = 'Test - Azure Subscription' AND operation IN ( 'AttachRolePolicy', 'AttachLoadBalancers')
List classic compute register operations performed by a specific user on a specific Azure account.	event from cloud.audit_logs where cloud.account in ( 'Test - Azure Subscription' ) and user = '[e-mail]' and operation IN ('Microsoft.ClassicCompute/register/action (BeginRequest)')

Audit Event Query Examples for GCP

DESCRIPTION	RQL
View sensitive network configuration updates on GCP.	event from cloud.audit_logs where operation IN ('v1.compute.networks.delete','beta.compute.networks.insert','v1.compute.routes.delete','v1.compute.firewalls.insert','v1.compute.firewalls.delete')
View sensitive SQL instance updates on GCP.	event from cloud.audit_logs where operation IN ('cloudsql.instances.update', 'cloudsql.sslCerts.create',' cloudsql.instances.create', 'cloudsql.instances.delete')
List all events with sensitive user actions on GCP.	event from cloud.audit_logs where operation IN ('CreateCryptoKey','DestroyCryptoKeyVersion','v1.compute.disks.createSnapshot')