What AWS service provides the data necessary for Prisma Cloud "event where" RQL queries?

What AWS service provides the data necessary for Prisma Cloud "event where" RQL queries?

• A. AWS Activity Logs
• B. AWS CloudTrail Audit Logs
• C. AWS Inspector
• D. AWS GuardDuty

Answer: (B)

The correct choice is AWS CloudTrail Audit Logs because these logs provide a comprehensive record of all API calls made within an AWS account. This includes information about the actions taken by users, roles, or services, along with necessary data such as timestamps, source IP addresses, resource names, and the parameters used in each API call. Using CloudTrail Audit Logs, Prisma Cloud can execute "event where" RQL (Regulatory Query Language) queries, which are designed to analyze and correlate events based on specific criteria. This ability enhances the visibility into user activities and system changes, which is critical for security monitoring and compliance auditing within the AWS environment. In contrast, while AWS Activity Logs and the services mentioned may provide useful data for certain aspects of monitoring and security, they do not offer the same level of comprehensive API activity insight or are not specifically integrated for use with Prisma Cloud for such RQL queries. AWS Inspector focuses on the security assessment of applications, while AWS GuardDuty is designed for threat detection rather than providing detailed records of user actions within an AWS account.

The correct choice is AWS CloudTrail Audit Logs because these logs provide a comprehensive record of all API calls made within an AWS account. This includes information about the actions taken by users, roles, or services, along with necessary data such as timestamps, source IP addresses, resource names, and the parameters used in each API call.

Using CloudTrail Audit Logs, Prisma Cloud can execute "event where" RQL (Regulatory Query Language) queries, which are designed to analyze and correlate events based on specific criteria. This ability enhances the visibility into user activities and system changes, which is critical for security monitoring and compliance auditing within the AWS environment.

In contrast, while AWS Activity Logs and the services mentioned may provide useful data for certain aspects of monitoring and security, they do not offer the same level of comprehensive API activity insight or are not specifically integrated for use with Prisma Cloud for such RQL queries. AWS Inspector focuses on the security assessment of applications, while AWS GuardDuty is designed for threat detection rather than providing detailed records of user actions within an AWS account.