How to Create a Custom Detection Rule for ADS in Cortex Cloud to Check File Existence?

To guide users on the correct method for defining custom detection rules using Rego to validate whether a specific file exists on a host scanned by an Agentless Disk Scanner.

• Cortex Cloud
• AWS EC2 Instance
• Linux

To correctly check whether a file (test.txt) exists during a scan, follow these steps:

1. Navigate to the Posture Management > Rules & Policies > Rules > Cloud Workload > Create Custom Rule in the Cortex Cloud console.
2. In the rule configuration, you must explicitly define the target file path in the input file(s) path field (for example, /root/test.txt or /etc/shadow). 
3. Use the following Rego template as a baseline, modifying the target_file.path and msg strings to match the file you defined in Step 2:

   package panw.compliance
   import rego.v1
   
   match contains {"msg": msg} if {
       some id
       target_file := input.files[id]
       target_file.path == "/root/test.txt"
       msg := "Violation: /root/test.txt exists on the system."
   }

   
   
   

4. Navigate to the Posture Management > Rules & Policies > Policies > Cloud Workload > Create Policy (Misconfigurations) to create a policy and add the rule created in the above steps:
   This policy automatically runs the rule and creates an issue if the check fails.
   
   

Once ADS is able to scan the concerned VM, we should see an issue being created with the VM (Inventory > All Assets > Compute > VM Instances).

• Relevant Documentation: Create a new Custom Detection Rule
• In the Rego policy editor, do not use input.path directly in the Rego code, as it is undefined and will cause the rule to fail.
  

package panw.compliance
import rego.v1
match contains {"msg": msg} if {	
  # Updated to match the actual file location in the /root directory	
  input.path == "/root/test.txt"
  msg := "Violation: The unauthorized file '/root/test.txt' was found on the disk."
}