topic Re: Prisma-Azure RQL query to fetch public IPs in Prisma Cloud Discussions

Prisma-Azure RQL query to fetch public IPs

PAgarwal5 — Wed, 28 Sep 2022 18:35:43 GMT

I am able to see public IPs attached to azure Network interfaces but I am not able to fetch public IPs in a column.

Re: Prisma-Azure RQL query to fetch public IPs

PAgarwal5 — Wed, 28 Sep 2022 18:36:58 GMT

I am using this query: config from cloud.resource where api.name = 'azure-vm-list' AND json.rule = ['properties.networkProfile'].networkInterfaces[*].publicIpAddress exists addcolumn ['properties.networkProfile'].networkInterfaces[*].ipConfigurations[*].publicIpAddress

Can anyone figure out how to add public Ips in a column so that I can download the list directly from Prisma.

Re: Prisma-Azure RQL query to fetch public IPs

AHamilton-Sutherland — Thu, 29 Sep 2022 15:59:43 GMT

The public IPs are included as a custom field. The UI hides the values behind a button, however when you download the CSV, the public IPs do appear in their own column named:

['properties.networkProfile'].networkInterfaces[*].ipConfigurations[*].publicIpAddress
I have tested this myself using your RQL query. Let me know if you have any further questions or if your downloaded file does not contain the public IPs field.

Re: Prisma-Azure RQL query to fetch public IPs

APoppas — Wed, 04 Sep 2024 18:36:43 GMT

Hi I came across this old thread while researching this morning and figured I'd share a more comprehensive query that can be used to find public IP addresses in Azure that isn't restricted to just those assigned to a virtual machine. Give this a try:

config from cloud.resource where cloud.service = 'Azure Virtual Network' AND api.name = 'azure-network-public-ip-address' addcolumn properties.ipAddress properties.dnsSettings.fqdn