Prisma cloud rql join filter

RMeneguci — Thu, 08 Feb 2024 16:22:17 GMT

How can I use the cloud account filter in an RQL query? I'm putting together a query to display which screen images are not in use and I would need to add the cloud account filter.

My querys is:

config from cloud.resource where api.name = 'aws-ecr-image' as X; config from cloud.resource where api.name = 'aws-ecs-describe-task-definition' as Y; filter '$.Y.containerDefinitions[0].image does not contain $.X.imageTags[0]'; show X;

Re: Prisma cloud rql join filter

AJohri — Tue, 20 Feb 2024 20:40:07 GMT

The way to go about this is add "cloud.account = 'your account'" to this statement sort of like this:

config from cloud.resource where cloud.account = 'your account' AND api.name = 'aws-ecr-image' as X; config from cloud.resource where cloud.account = 'your account' AND api.name = 'aws-ecs-describe-task-definition' as Y; filter '$.Y.containerDefinitions[0].image does not contain $.X.imageTags[0]'; show X;

Hopefully this would resolve your issue, also make sure to add same cloud account to both cloud.account if you're for screen images in a single account.

topic Prisma cloud rql join filter in Prisma Cloud Discussions

Prisma cloud rql join filter

Re: Prisma cloud rql join filter