Skip to main content
Active Queries extends the base Attack Paths feature with capabilities that rely on managed scan infrastructure. This capability is available only in Prowler Cloud and Prowler Private Cloud.

​
Focusing on Queries with Data

Running an Attack Paths query against a scan that contains no matching pattern returns an empty graph. Without automatic filtering, identifying the queries that apply to an account means opening each one and checking whether it produces a result. Running the RDS inventory query on an account with no RDS instances, for example, returns a “No data found” message. Attack Paths query returning no data Prowler Cloud removes that trial and error. At the end of each scan, Prowler Cloud records which built-in queries returned data. The query selector then hides the queries confirmed empty for the selected scan, so only the queries that surface a real path remain visible. Following the example above, the RDS inventory query no longer appears in the selector. Attack Paths query selector with confirmed-empty queries hidden A query stays available whenever its result is not a confirmed empty graph:
  • Errored queries remain listed. An error is not the same as an empty result and still requires investigation.
  • Unknown queries remain listed. Their result for the scan has not been recorded yet.
  • Parameterized queries remain listed. Their output depends on the input values provided at run time.

​
Browsing the Full Query Catalog on Prowler Hub

The query selector shows the queries relevant to the selected scan, not the entire catalog. To review every built-in Attack Paths query, including the ones hidden for a given scan, browse the complete catalog on Prowler Hub. Prowler Hub lists each query with its name, description, and the technique it detects, so security teams can plan coverage and understand detection scope without running a scan first.
  • Attack Paths - Run built-in and custom queries and explore the resulting graph.
  • Attack Paths Queries - Write and maintain openCypher queries in the Developer Guide.