search

JupiterOne-Archives / integrations-2021-07-16

JupiterOne integration development documentation and issue tracking
0 stars 2 forks source link

Ingest data to determine age of base image #18

Open austinkelleher opened 3 years ago

austinkelleher commented 3 years ago

google_compute_image's can be derived from snapshots and other images. We should be able to ask a question like:

Are my Google Cloud compute instances using an image who's base image is older than 30 days?

(Potential J1QL - Should think more about this):

find google_compute_image 
  with baseImageCreatedOn < date.now - 30days
  and baseImageId = "abc"
  and depthFromRootImage > 3 /* the number of steps to reach the root image */

We should also create relationships to parent images:

find google_compute_image
THAT USES google_compute_image
THAT USES google_compute_image