Paloalto Networks CloudSec-Pro Online Access

The correct RQL (Resource Query Language) that detected the vulnerability is:

config from cloud.resource where cloud.type = 'aws' and api.name = 'aws-iam-get-credential-report' AND json.rule = '(access_key_1_active is true and access_key_1_last_rotated != N/A and DateTime. ageInDays (access_key_1_last_rotated) > 90) or (access_key_2_active is true and access_key_2_last_rotated != N/A and _DateTime. ageInDays (access_key_2_last_rotated) > 90)'

This RQL is designed to check the age of the AWS IAM user's access keys to ensure that they are rotated within a recommended period, typically 90 days. If the access keys have not been rotated within this timeframe, it would be considered a security risk or vulnerability, as old keys may potentially be compromised. By enforcing access key rotation, it minimizes the risk of unauthorized access.

The reference for this type of policy check can be seen in cloud security best practices that advocate for regular rotation of access keys to minimize the potential impact of key compromise. CSPM tools like Prisma Cloud include such checks to automate compliance with these best practices.

AZURE:

% export SB_QUEUE_KEY=your_sb_queue_key

% export SB_QUEUE_KEY_NAME=your_sb_queue_key_name

% export SB_QUEUE_NAME_SPACE=your_sb_queue_name_space

% export API_ENDPOINT=api_tenant

% export AUTH_KEY=your_jwt_token

1. Post /Login 2. Get /report 3. Get report/id/download

To protect pods in an environment from Cross-Site Scripting (XSS) attacks, the development team should create a Container Cloud Native Application Firewall (CNAF) policy. This policy should be targeted at the specific resource (e.g., a particular pod or set of pods), with the option for XSS protection checked, and the action set to "prevent." This configuration ensures that any XSS attacks directed at the targeted containers are effectively blocked.