Failed to execute RQL search. Illegal argument

KaushalRai — Thu, 20 Mar 2025 18:35:21 GMT

When I am trying to run this query in Prisma cloud , It through me message "Failed to execute RQL search. Illegal argument"

RQL

config from cloud.resource where api.name = 'aws-ec2-describe-security-groups' as X; config from cloud.resource where api.name = 'aws-ec2-describe-route-tables' as Y; config from cloud.resource where api.name = 'aws-ec2-describe-instances' as Z; filter "$.Y.vpcId contains $.X.vpcId
and $.Z.subnetId contains $.Y.associations[*].subnetId
and $.Y.routes[?(@.destinationCidrBlock=='0.0.0.0/0')].gatewayId contains igw
and ($.X.ipPermissions[?(@.toPort > 445 || @.fromPort < 445)].ipRanges[*] contains 0.0.0.0/0
or $.X.ipPermissions[?(@.toPort > 445 || @.fromPort < 445)].ipv6Ranges[*].cidrIpv6 contains ::/0) "; show X;

Please help me in fixing this issue

Re: Failed to execute RQL search. Illegal argument

JCalloway1 — Mon, 24 Mar 2025 20:06:41 GMT

Hi KaushalRai

It looks like you had some spacing issues with your last clause. sometimes you can include spaces, but in other cases, you cannot.

The last part of your original statement was:

and ($.X.ipPermissions[?(@.toPort > 445 || @.fromPort < 445)].ipRanges[*] contains 0.0.0.0/0 or $.X.ipPermissions[?(@.toPort > 445 || @.fromPort < 445)].ipv6Ranges[*].cidrIpv6 contains ::/0) "; show X;

This is what I was able to get to work:

and ($.X.ipPermissions[?(@.toPort>445||@.fromPort>445)].ipRanges[*] contains 0.0.0.0/0 or $.X.ipPermissions[?(@.toPort>445||@.fromPort>445)].ipv6Ranges[*].cidrIpv6 contains ::/0)" ; show X;

Here is the final modification of your query:

config from cloud.resource where api.name = 'aws-ec2-describe-security-groups' as X; config from cloud.resource where api.name = 'aws-ec2-describe-route-tables' as Y; config from cloud.resource where api.name = 'aws-ec2-describe-instances' as Z; filter "$.Y.vpcId contains $.X.vpcId and $.Z.subnetId contains $.Y.associations[*].subnetId and $.Y.routes[?(@.destinationCidrBlock=='0.0.0.0/0')].gatewayId contains igw and ($.X.ipPermissions[?(@.toPort>445||@.fromPort>445)].ipRanges[*] contains 0.0.0.0/0 or $.X.ipPermissions[?(@.toPort>445||@.fromPort>445)].ipv6Ranges[*].cidrIpv6 contains ::/0)" ; show X;

Hope this helps!
🙂

topic Re: Failed to execute RQL search. Illegal argument in Prisma Cloud Discussions

Failed to execute RQL search. Illegal argument

Re: Failed to execute RQL search. Illegal argument