RQL - Checking tags using _DateTime function

awsrqlqueryuser — Wed, 15 Nov 2023 21:06:36 GMT

Can _DateTime function be used to check the date of a tag on a resource in AWS? My current query syntax is accepted by prisma however the _DateTime functions are not actually checking the tag (type string because all tags are strings in AWS) so it is returning undesired output.

Current query (should return all volumes with a (tag.key=Retain).value greater than 365 days old:
config from cloud.resource where cloud.type = 'aws' AND api.name = 'aws-ec2-describe-volumes' AND AND json.rule = _DateTime.ageInDays(tags[?(@.key=='Retain')].value) > 365 addcolumn tags[?(@.key=='Retain')].value

Are there any examples of checking a tag using the _DateTime function or any other ways to work with a date in prisma to check the value of a tag's date? Or any useful links/resources to look into this further are appreciated!

Re: RQL - Checking tags using _DateTime function

JCalloway1 — Thu, 16 Nov 2023 20:41:36 GMT

It seems that the way the documentation is written that while it is possible to use the _DateTime function to get the various time and age related properties from a resources, it doesen't seem to be possible to use it to get the time and date of attributes of the resources. If you look at the examples, you can use the TimeDate function against resources an EC2 instance or a key, but not from an attribute of the recourse, like a tag.

topic Re: RQL - Checking tags using _DateTime function in Prisma Cloud Discussions

RQL - Checking tags using _DateTime function

Re: RQL - Checking tags using _DateTime function