Skip to main content

Documentation Index

Fetch the complete documentation index at: https://docs.blinkops.com/llms.txt

Use this file to discover all available pages before exploring further.

List all registered LQL policies in your Lacework instance.
External DocumentationTo learn more, visit the Lacework documentation.

​
Example Output

{
	"data": [
		{
			"policyId": "lacework-global-89",
			"policyType": "Compliance",
			"queryId": "",
			"queryText": "",
			"title": "EC2 instance does not have any tags",
			"enabled": false,
			"description": "Tags allow users to better organize resources and assist the collection of metrics...",
			"remediation": "Perform the following to add tags:\n1. Log in to the AWS Management Console...",
			"severity": "high",
			"alertEnabled": false,
			"alertProfile": "",
			"owner": "Lacework",
			"lastUpdateTime": "2021-05-31T19:00:00.000Z",
			"lastUpdateUser": "Lacework",
			"tags": [
				"framework:aws-lacework-security-1-0",
				"domain:AWS",
				"subdomain:Configuration"
			],
			"exceptionConfiguration": {
				"constraintFields": [
					{
						"fieldKey": "accountIds",
						"dataType": "String",
						"multiValue": true
					},
					{
						"fieldKey": "regionNames",
						"dataType": "String",
						"multiValue": true
					},
					{
						"fieldKey": "resourceNames",
						"dataType": "String",
						"multiValue": false
					},
					{
						"fieldKey": "resourceTags",
						"dataType": "KVTagPair",
						"multiValue": true
					}
				]
			}
		},
		{
			"evaluatorId": "Cloudtrail",
			"policyId": "lacework...",
			"policyType": "Violation",
			"queryId": "LW_Custom_AWS_CTA_AuroraPasswordChange",
			"queryText": "LW_Custom_AWS_CTA_AuroraPasswordChange { SOURCE { CloudTrailRawEvents } FILTER ...",
			"title": "Cloudtrail Policy 2",
			"enabled": false,
			"description": "Cloudtrail Policy 2",
			"remediation": "Policy remediation 2",
			"severity": "medium",
			"limit": 100,
			"evalFrequency": "Hourly",
			"alertEnabled": true,
			"alertProfile": "LW_CloudTrail_Alerts.CloudTrailDefaultAlert_AwsResource",
			"owner": "user@example.com",
			"lastUpdateTime": "2022-10-03T16:23:38.915Z",
			"lastUpdateUser": "user@example.com",
			"tags": [
				"domain:Host",
				"subdomain:Container"
			]
		}
	]
}

​
Workflow Library Example

List Policies with Lacework and Send Results Via Email
Workflow LibraryPreview this Workflow on desktop