topic Re: Prisma Cloud RQL json.rule options in Prisma Cloud Discussions

Prisma Cloud RQL json.rule options

SPAUL2008 — Tue, 17 Mar 2026 16:52:50 GMT

Hello,

Is it possible to use an array or list of values when comparing few values for a json.rule within an RQL?

For example, in the following RQL, can we combine the "tags[*].key" comparison values to a list of items (such as something like 'does not contain ["PatchGroup", "Patch Group", "patch-window", "prismacloud-scan"]') rather than having them defined separately?

config from cloud.resource where cloud.type = 'aws' and api.name = 'aws-ec2-describe-instances' AND json.rule = tags[*].key does not contain "Patch Group" and tags[*].key does not contain "PatchGroup" and tags[*].key does not contain "patch-window" and tags[*].value does not contain "prismacloud-scan"

Thanks,
Paul

Re: Prisma Cloud RQL json.rule options

JCalloway1 — Tue, 17 Mar 2026 18:08:53 GMT

Hey Paul!
If the everything was the same, you could use a construction like "not in ()" or ". . . is not member of (string, string,string).
However, you have two entries that are for "tags[*].key" and one that is for "tags[*].value", so since those are inconsistent, you can't put them in a list like above.

Re: Prisma Cloud RQL json.rule options

SPAUL2008 — Tue, 17 Mar 2026 18:27:06 GMT

Thank you.
is not a member of ('','','') seems to be working for the same parameter.

config from cloud.resource where cloud.type = 'aws' and api.name = 'aws-ec2-describe-instances' AND json.rule = tags[*].key is not member of ( 'Patch Group', 'PatchGroup', 'patching-window') and tags[*].value does not contain "prismacloud-scan"

Re: Prisma Cloud RQL json.rule options

JCalloway1 — Tue, 17 Mar 2026 18:29:46 GMT

Hey Paul!
Excellent! I'm glad that works!

Re: Prisma Cloud RQL json.rule options

SPAUL2008 — Tue, 17 Mar 2026 18:47:55 GMT

Sorry, I spoke too soon.
When comparing outputs from both of these queries side-by-side, I can see some false positives from the new one!