Network Configuration Query Examples

The following examples show you how to use Network Configuration Query Attributes in RQL for investigating network and container exposure issues.

AWS Use Cases	RQL
Find all AWS EC2 instances that are accessible from any untrusted Internet source on administrative ports via SSH/RDP.	config from network where source.network = UNTRUST_INTERNET and dest.resource.type = 'Instance' and dest.cloud.type = 'AWS' and effective.action = 'Allow' and protocol.ports in ( 'tcp/22' , 'tcp/3389' )
Find all AWS EC2 instances that are accessible from any untrusted Internet source other than HTTP/HTTPS.	config from network where source.network = UNTRUST_INTERNET and dest.resource.type = 'Instance' and dest.cloud.type = 'AWS' and protocol.ports in ( 'tcp/0:79', 'tcp/81:442', 'tcp/444:65535' )
Find all AWS Redshift managed ENI that are accessible from any untrusted Internet source on any port/protocol.	config from network where source.network = UNTRUST_INTERNET and dest.resource.type = 'Interface' and dest.cloud.type = 'AWS' and dest.network.interface.owner in ( 'amazon-redshift' )
Find all AWS RDS managed ENI that are accessible from any untrusted Internet source on DB port/protocol 3306.	config from network where source.network = UNTRUST_INTERNET and dest.resource.type = 'Interface' and dest.cloud.type = 'AWS' and dest.network.interface.owner in ( 'amazon-rds' ) and protocol.ports in ( 'tcp/3306')
Find all AWS RDS managed ENI that are accessible from any untrusted Internet source on any port/protocol.	config from network where source.network = UNTRUST_INTERNET and dest.resource.type = 'Interface' and dest.cloud.type = 'AWS' and dest.network.interface.owner in ( 'amazon-rds')
Find all AWS ELB managed ENI that are accessible from any untrusted Internet source on any port/protocol other than HTTP/HTTPS.	config from network where source.network = UNTRUST_INTERNET and dest.resource.type = 'Interface' and dest.cloud.type = 'AWS' and dest.network.interface.owner in ( 'amazon-elb' ) and protocol.ports in ( 'tcp/0:79', 'tcp/81:442', 'tcp/444:65535' )
Find all AWS VPCs that have EC2 Instances that are accessible from any untrusted Internet source on any port/protocol other than web traffic (HTTP/HTTPs). If you use the alert.on RQL attribute, it is only applicable for policies and alerts and has no effect on investigate queries.	config from network where source.network = '0.0.0.0/0' and dest.resource.type = 'Instance' and dest.cloud.type = 'AWS' and protocol.ports in ( 'tcp/0:79', 'tcp/81:442', 'tcp/444:65535' ) and alert.on = 'DestVPC'
Find all AWS EC2 instances with outbound access to any untrusted Internet destination.	config from network where source.resource.type = 'Instance' and source.cloud.type = 'AWS' and dest.network = UNTRUST_INTERNET
Find if instance A in VPC-1 (staging environment) can communicate with instance A in VPC-2 (production environment). For E-W network analysis, specify at least one specific source and destination VPC.	config from network where source.resource.type = 'Instance' and source.vpc.id = 'vpc-0657741d2470e9869' and source.cloud.type = 'AWS' and source.tag = 'env=staging' and dest.resource.type = 'Instance' and dest.vpc.id = 'vpc-0a8818db3474831ef' and dest.cloud.type = 'AWS' and dest.tag = 'env=prod'
Find all AWS EC2 instances that are accessible from any untrusted Internet source where routing exists, however effective security policy is ‘Deny’.	config from network where source.network = UNTRUST_INTERNET and dest.resource.type = 'Instance' and dest.cloud.type = 'AWS' and effective.action = 'Deny'
Find if instance A in VPC-1 (staging environment) can communicate with a private S3 bucket using VPC endpoint that contains sensitive information. For E-W network analysis, specify at least one specific source and destination VPC.	config from network where source.resource.type = 'Instance' and source.vpc.id = 'vpc-0a8818db3474831ef' and source.tag = 'env=staging' and dest.resource.type = 'Service' and dest.service.name = 'com.amazonaws.vpce.us-east-1.vpce-svc-0ff33532fa2a4a999' and dest.vpc.id = 'vpc-0a8818db3474831ee' To find out all supported service.name in your environment, use the following RQL: config from cloud.resource where api.name = 'aws-describe-vpc-endpoints' AND json.rule = serviceName exists addcolumn serviceName
Find all Amazon ELB (load balancer) interfaces that are accessible on the Internet on port TCP/22.	config from network where source.network = INTERNET and dest.resource.type = 'Interface' and dest.network.interface.owner = 'amazon-elb' and protocol.ports = 'tcp/22' and effective.action = 'Allow'
Find all AWS EC2 Instances with unrestricted access (0.0.0.0/0) from the Internet other than the Web traffic.	config from network where source.network = '0.0.0.0/0' and address.match.criteria = 'full_match' and dest.resource.type = 'Instance' and dest.cloud.type = 'AWS' and protocol.ports in ( 'tcp/0:79', 'tcp/81:442', 'tcp/444:65535' )
Find all AWS EC2 Instances with network access from any IP in the range 20.0.0.0/24 other than the Web traffic.	config from network where source.network = '20.0.0.0/24' and address.match.criteria = 'partial_match' and dest.resource.type = 'Instance' and dest.cloud.type = 'AWS' and protocol.ports in ( 'tcp/0:79', 'tcp/81:442', 'tcp/444:65535' )

Azure Use Cases	RQL
Find Azure PostgreSQL (PaaS) instance reachable from untrust Internet source on TCP port 5432.	config from network where source.network = UNTRUST_INTERNET and dest.resource.type = 'PaaS' and dest.cloud.type = 'AZURE' and dest.paas.service.type in ( 'MicrosoftDBforPostgreSQLFlexibleServers', 'MicrosoftDBforPostgreSQLServers' ) and protocol.ports = 'tcp/5432'
Find Azure VM instance in running state that is Internet reachable with unrestricted access (0.0.0.0/0) other than HTTP/HTTPS port.	config from network where source.network = '0.0.0.0/0' and address.match.criteria = 'full_match' and dest.resource.type = 'Instance' and dest.cloud.type = 'AZURE' and protocol.ports in ( 'tcp/0:79', 'tcp/81:442', 'tcp/444:65535' ) and dest.resource.state = 'Active'
Find Azure MySQL (PaaS) instance reachable from untrust internet source on TCP port 3306.	config from network where source.network = UNTRUST_INTERNET and dest.resource.type = 'PaaS' and dest.cloud.type = 'AZURE' and dest.paas.service.type in ( 'MicrosoftDBforMySQLFlexibleServers', 'MicrosoftDBforMySQLServers' ) and protocol.ports = 'tcp/3306'

Kubernetes Use Cases	RQL
Find K8s Services that are Internet Facing on EKS clusters on AWS.	config from network where source.network = 'Untrusted_Internet' and dest.resource.type = 'K8s Service' and dest.cloud.type = 'AWS'
Find K8s Services that are Internet Facing on AKS clusters in Azure.	config from network where source.network = 'Untrusted_Internet' and dest.resource.type = 'K8s Service' and dest.cloud.type = 'Azure'
Find K8s Services that are Internet Facing on GKE clusters in GCP.	config from network where source.network = 'Untrusted_Internet' and dest.resource.type = 'K8s Service' and dest.cloud.type = 'GCP'
Scope down searches on a specific cluster and namespace.	config from network where source.network = 'Untrusted_Internet' and dest.resource.type = 'K8s Service' and dest.cloud.type = 'GCP' and dest.k8s.cluster.name = 'yourClusterID' config from network where source.network = 'Untrusted_Internet' and dest.resource.type = 'K8s Service' and dest.cloud.type = 'GCP' and dest.k8s.cluster.name = 'yourClusterID' and dest.k8s.namespace = 'yourNamespaceName'
Search by using tags.	config from network where source.network = 'Untrusted_Internet' and dest.resource.type = 'K8s Service' and dest.cloud.type = 'GCP' and dest.k8s.cluster.name = 'yourClusterID' and dest.k8s.label = 'app=dev'
Identify K8s Services that are Internet Facing over a non-standard port.	config from network where source.network = 'Untrusted_Internet' and dest.resource.type = 'K8s Service' and dest.cloud.type = 'AWS' and protocol.ports = 'tcp/9090'
Find if a specific container image is associated with deployed pods that are Internet exposed.	config from network where source.network = = 'Untrusted_Internet' and dest.resource.type = 'K8s Service' and dest.cloud.type = 'GCP' and dest.k8s.container.image = 'nginx:latest'