cnquery scan with pack specified: could not scan asset error="all available packs filtered out. nothing to do."

[misterpantz]

Hiya! What does a could not scan asset error="all available packs filtered out. nothing to do." error indicate?

cnquery scan aws --querypack incident-response

→ no configuration file provided
! No credentials provided. Switching to --incognito mode.
→ discover related assets for 1 asset(s)
→ resolved assets resolved-assets=1
→ connecting to asset AWS Account lunalectric (123456789000) (api)
! could not scan asset error="all available packs filtered out. nothing to do." asset="AWS Account mondoo-dev (123456789000)"░░░░░░░░░░░░   0% AWS Account mondoo-dev (123456789000)

[arlimus]

This error tells us that it tried to run a bundle of query packs on the target, but for some reason threw everything out and we ended up with nothing being scanned.

In this particular case, I see you want to use the incident-response pack for aws. At the moment the --querypack option only works if you provide a local querypack bundle file.

I tested this using the default incident response pack for AWS, found in its latest version here:
https://raw.githubusercontent.com/mondoohq/cnquery-packs/main/core/mondoo-aws-incident-response.mql.yaml

Once downloaded you can run this:

cnquery scan aws -f mondoo-aws-incident-response.mql.yaml --querypack mondoo-incident-response-aws

The first argument is the bundle file that we just downloaded. The second is an example of using querypack to only pick one of the querypacks in that bundle, in this case mondoo-incident-response-aws (which was the first uid in the file at the time of writing).

We are going to support querypack-uids without bundle files in the future as well. If you are from the future and time-traveled to this issue, check if that features has been added. At the time of writing the help menu states that --querypack strings Set the query packs to be executed (requires querypack-bundle). i.e. it only works with local bundles.

[misterpantz]

That worked perfectly. Thank you!