Perform advanced Identity Security investigations using XQL

Use XQL in Cortex XSIAM to investigate Cloud Identity Security permissions, identity risks, and access data.

Requires a Cloud Posture Security, Cloud Runtime Security, or Cortex XSIAM Premium license.

Overview

Use Cortex Query Language (XQL) in Cortex XSIAM to investigate Cloud Identity Security permissions, access, identity risks, findings, and issues. Query identity datasets to identify security gaps and guide remediation.

For more information, see Get started with XQL.

You can use the following identity-related datasets:

Dataset	Description
ciem_permissions_with_last_access	Contains the permissions of each identity that is discovered in your environments, including the time of their last access when applicable.
asset_inventory	Contains an inventory of all the assets that are discovered in your environments. For more information, see Asset management.
issues	Contains the issues that are related to the assets in your environments. For more information, see Issues.
findings	Contains the findings that are associated with the assets that are found in your environments. For more information, see Findings and events.

Investigate Cloud Identity Security in Cortex XSIAM

To run queries on your Cloud Identity Security datasets:

1. In Cortex XSIAM, in the navigation pane on the left, click Investigation & Response, then under Search, click XQL Search.

2. On the XQL Search screen, under XQL Query, in the text box, start typing your query. Alternatively, you can search for existing queries on the Query Library tab.

3. When you have finished entering your query, click Run. The results appear on the Query Results tab.

For more information, see Build XQL queries.

Example XQL queries for Identity Security

Use these XQL queries in Cortex XSIAM to investigate your identity security posture:

1. Count the number of admin sources per account

dataset = ciem_permissions_with_last_access 
| filter action_access_isadministrative in(true, TRUE) 
| dedup source_cloud_resource_uai, source_cloud_account_id 
| comp count(source_cloud_resource_uai) as admins_count by source_cloud_account_id  
| sort desc admins_count

2. Azure service principals granting write permissions on the subscription level

dataset =  ciem_permissions_with_last_access
| filter dest_cloud_type = "AZURE" and action_access_level contains "Write" and grantedby_level_type = "AZURE_SUBSCRIPTION" and grantedby_cloud_entity_type = "service principal"
| fields source_cloud_resource_name, source_cloud_resource_type, grantedby_cloud_entity_name, grantedby_level_name, grantedby_level_type

3. Group permissions on production assets

dataset = ciem_permissions_with_last_access
| filter dest_cloud_type = "GCP" and action_access_level = "config" and source_cloud_resource_type = "user" and grantedby_cloud_entity_type = "group" and wildcard_match("prod.*", dest_cloud_resource_name)
| fields source_cloud_resource_name, grantedby_cloud_entity_name, dest_cloud_resource_name, dest_cloud_resource_type

4. Users without MFA and sensitive S3 and EC2 permissions

dataset =  ciem_permissions_with_last_access
| filter source_cloud_type = "aws" and source_cloud_resource_type = "user" and action_access_level contains "Config" and dest_cloud_service_name in ("s3", "ec2")
| join (dataset = asset_inventory) as assets source_cloud_resource_uai = assets.xdm.asset.id
| filter lowercase(json_extract_scalar(xdm.asset.normalized_fields, "$['xdm.identity.has_mfa']")) = "false"

5. Azure VM with data write permissions on the subscription levels

dataset = ciem_permissions_with_last_access
 | filter source_cloud_type = "azure" and source_cloud_resource_type = "virtualMachines" and (lowercase(action_access_level) contains "config" or lowercase(action_access_level) contains "write") and dest_cloud_resource_type ~= "^storageAccounts/blobServices" and grantedby_level_type = "AZURE_SUBSCRIPTION"

6. Policies granting wildcard permissions

dataset =  ciem_permissions_with_last_access 
| filter dest_cloud_resource_name ~= "^\*$" and grantedby_cloud_policy_type in ("AWS_CUSTOMER_MANAGED_POLICY", "AWS_MANAGED_POLICY")
| dedup grantedby_cloud_policy_id 
| fields grantedby_cloud_policy_id as policy_arn

7. Administrative roles open to third-party vendors and external unknown accounts

dataset =  ciem_permissions_with_last_access
| filter grantedby_cloud_entity_type = "role" and action_access_isadministrative = true and account_access in ("EXTERNAL_UNKNOWN", "THIRD_PARTY_VENDOR")
| fields grantedby_cloud_entity_name, grantedby_cloud_entity_account_name, source_cloud_account_name, account_access

8. Show identities with unused permissions

dataset = ciem_permissions_with_last_access 
| filter last_access_time != null and timestamp_diff(current_time(), last_access_time, "DAY") > 90 and source_cloud_resource_name !~= "^\*$"
| dedup source_cloud_resource_name, source_cloud_account_id, action_name, dest_cloud_resource_name, last_access_time
| fields  source_cloud_resource_name, source_cloud_account_id, action_name, dest_cloud_resource_name, last_access_time

9. Unused permissions by lambda functions

dataset = ciem_permissions_with_last_access 
| filter source_cloud_service_name= "lambda" and source_cloud_resource_type = "function" and source_cloud_region = "Virginia" and is_last_access_supported = true 
| alter days_since_used = timestamp_diff(current_time(), last_access_time, "DAY") 
| filter days_since_used > 90
| fields source_cloud_resource_uai, source_cloud_resource_name, days_since_used, action_name, action_access_level 

10. Get all the non-admin sources that can assume an admin role

dataset = ciem_permissions_with_last_access 
| filter action_name = "sts:AssumeRole"
| fields source_cloud_resource_uai, dest_cloud_resource_uai, dest_cloud_resource_id, dest_cloud_account_id 
| filter source_cloud_resource_uai not in(dataset = ciem_permissions_raw 
| filter action_access_isadministrative in(true, TRUE) 
| dedup source_cloud_resource_uai 
| fields source_cloud_resource_uai) 
| fields source_cloud_resource_uai as source, dest_cloud_resource_uai as dest_uai, dest_cloud_resource_id as dest_id, dest_cloud_account_id as dest_account_id 
| join(dataset = ciem_permissions_raw 
| filter grantedby_cloud_entity_type = "role" 
| filter action_access_isadministrative in(true, TRUE) 
| dedup grantedby_cloud_entity_id 
| fields grantedby_cloud_entity_account_id, grantedby_cloud_entity_id) as admin_roles (dest_id = admin_roles.grantedby_cloud_entity_id or (dest_id ~= "^\*$" and dest_account_id = admin_roles.grantedby_cloud_entity_account_id)) 
| fields source

11. Administrative permissions granted to EC2 instances that can access multiple services

dataset = ciem_permissions_with_last_access
| filter source_cloud_resource_type = "instance" and source_cloud_service_name = "EC2" and action_access_isadministrative = true
| comp values(action_name) as actions by source_cloud_resource_uai, source_cloud_resource_name, source_cloud_account_id, grantedby_cloud_entity_name
| join (dataset = asset_inventory) as assets source_cloud_resource_uai = assets.xdm.asset.id
| alter access_to_services = to_integer(json_extract_scalar(xdm.asset.normalized_fields, "$['xdm.identity.access_statistics.services']"))
| filter access_to_services >= 10
| fields source_cloud_resource_name, source_cloud_resource_uai, access_to_services, grantedby_cloud_entity_name