GSL Builder

The GSL Builder is a sandbox that helps you write and test GSL rules. Some parts of the GSL Builder appear as a GSL Editor when you start to create a new rule for your environment. The GSL Builder provides an interactive graphical interface for all supported entities. CloudGuard constantly updates the list of entities and attributes.

Building a New Rule

00:00: 00:05: Learn how to build a GSL rule in Cloud. 00:09: From the cloud guard, menu, select, cspm and click GSL Builder. 00:14: Access the GSL Builder feature 00:15: Select a platform where you want to apply the rule. 00:17: In this example, we build a rule for workload. 00:20: Vulnerability, this rule will ensure that your package does not have cve 00:24: with high severity. 00:26: Select the context for the rule to apply the rule to an entire package, 00:30: select package. 00:33: In the context of package, Cloud guard, suggests three options to continue. 00:36: The rule should have should not have or where select the second option. 00:42: After that cloudguard shows a list of operators and properties relevant to packages. 00:46: Select the cve option. 00:49: Next select the contain, any option. 00:52: Now, select the category of severity. 00:55: Click on the equals sign 00:58: Enter high and click. 01:00: Close the scope block by clicking on the designated button. 01:03: Now that the rule is ready, click verify to initiate the verification process. 01:08: If everything is correct, Cloud guard validates, the rule created. 01:12: Now, you can copy the rule and add it to a rule set. 01:16: This guide covered the steps to build a GSL rule in CloudGuard. 01:20:

To build a GSL rule, follow the steps below:

In CloudGuard, you can build GSL posture management rules for multiple cloud platforms.

  1. Navigate to the GSL Builder page in the CSPM menu.

  2. Select a cloud platform to run the rule on: AWSClosed Amazon® Web Services. Public cloud platform that offers global compute, storage, database, application and other cloud services., AzureClosed Collection of integrated cloud services that developers and IT professionals use to build, deploy, and manage applications through a global network of data centers managed by Microsoft®., or other.

The platforms with the Preview tag are at Early Availability.

All GSL rules and rulesets are platform-specific, so you can run a rule only on the platform it is created for.

Platforms can be static or dynamic:

Because of different naming conventions, the entity's names on the static and dynamic platforms are not the same.

  1. Select the mode:

    • Builder - Enter the new rule interactively with hints.

    • Free text - Enter the rule as text.

  2. Optionally, change Builder to Free text to make small changes before you test the rule.

Important - Make sure not to change back from Free text to Builder. If you do, CloudGuard erases the expression in the field.

For each cloud platform, CloudGuard provides a set of applicable entities. You build a rule with one entity, which is the rule Target, and a combination of the entity attributes, which are the rule Condition.

Note - The New tag indicates that recently CloudGuard started to support the entity.

  1. Select an entity from the list.

    CloudGuard shows possible actions below, in the interactive section. The attributes (properties) for this type of entity appear on the right below Context Preview.

  2. Select one of the actions. CloudGuard shows applicable operators and properties in the interactive section.

  3. Select an operator or a property to continue to build a rule. Use the context preview on the right to expand properties and see their structure.

    Note - Some asset properties have the indication External, for example, ExternalObject or ExternalArray. These properties are brought by CloudGuard from another entity to help you write GSL rules easier.

    Note - Context preview contains information on static elements only. Information on dynamic elements, such as objects, is not available.

  4. To continue with the rule, add more operators, properties, and functions as the context suggests. To learn more about the GSL syntax, see Governance Specification Language (GSL).

  5. To delete one or more elements in the rule, put the cursor on these elements, and click (this gives approval to the deletion).

  1. Below Test Rule, select one or more environments to test the rule on and click TEST.

    CloudGuard runs the rule and shows the Result Details, almost the same as the Assessment Results (see Running an Assessment). The Test History shows the ten last instances when the rule was run.

  2. Click clear result to erase the test result.

  3. Click clear tests history to erase the history.

After a successful test, select Free text, copy the GSL expression, and paste it into the GSL section of a new rule (see Adding Rules to a Ruleset).

Actions

You can export information about protected assets to a CSV file.

To export protected asset information:

  1. Click Export in the upper right and select the detailed view by asset type.

  2. Select an applicable platform, environment or OU, and the asset type.

  3. Click Done.