topic Re: how to find out who create the resource by RQL? in Prisma Cloud Discussions

how to find out who create the resource by RQL?

JCheng4 — Wed, 02 Sep 2020 18:04:29 GMT

how to find out who create the resource by RQL?

When we use RQL, the output columns are fixed without the info who created the resource, we have to use auditral info manually search created by or modified by, is there any way can get created by or modified by info by API call?

Re: how to find out who create the resource by RQL?

AKing9 — Tue, 16 Aug 2022 20:49:12 GMT

Greetings JCheng4,

I hope that this note finds you well! I know that it has been a while since you had posted this question but I wanted to see if you still potentially needed any help. Thank you for your time and I hope that you have a good remainder of your day.

Kind Regards,

J. Avery King

Re: how to find out who create the resource by RQL?

MDavis29 — Wed, 17 Aug 2022 20:07:59 GMT

To find out who did what with RQL you will need to use event from. Please see the below link for details and examples on the query as well as a sample below. The user that performed the action will be called out when using event from.

event from cloud.audit_logs where cloud.type = 'azure' AND has.anomaly

https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-rql-reference/rql-reference/event-query/event-query-attributes