Error with RQL joint and atributes with dot

[VRuiz]

Hello,

I have an error when we are implementing a RQL query in the Investigate tab.

We make a join query searching in a VMs list and a NICs list in the prisma platform over a Azure suscription.

The problem seems to be over the filter part when we use the ['xxx.xxx'] format in a query when an atribute have a dot inside, because when we change to other atribute that don't have dot, it runs.

The query is the next (we are checking the atributes to correlate the VMs):

config where api.name = 'azure-network-nic-list' as X; config where api.name = 'azure-vm-list' as Y; filter '$.X.['properties.virtualMachine'].id == $.Y.['properties.networkProfile'].networkInterfaces[*].id and $.X.tags.owner exists'; show X;

Do anyone know if the definition over the filter could be different that in the filter body? Is it any separating character that allow the query? Could be a bug in the prisma platform?

Regards.

[lpingali · Accepted solution]

Try this RQL ( with double quotes for filter):

config where api.name = 'azure-network-nic-list' as X; config where api.name = 'azure-vm-list' as Y; filter "$.['X'].['properties.virtualMachine'].['id'] == $.['Y'].['properties.networkProfile'].networkInterfaces[*].['id'] and $.X.tags.owner exists"; show X;

[VRuiz]

Hi Lpingali,

I tried this one and could execute (the button isn't grey) but the results was empty because show no one and, the suscription have several cases.

[lpingali]

Can you please open a ticket with screenshots of the results from both API calls, so we can debug further?

[FranciscoBreijo · Accepted solution]

VRuiz,

Please try the below RQL.

config where cloud.account = 'Azure-Redlock-public-demo' AND api.name = 'azure-network-nic-list' as X; config where api.name = 'azure-vm-list' as Y; filter "$.['X'].['properties.virtualMachine'].id contains $.['Y'].['properties.osProfile'].computerName and $.X.tags.owner exists"; show X;

The issue you were running into is that $.['Y'].['properties.networkProfile'].networkInterfaces[*].id references the network interface Id, but that value doesn't exist in the nic-list response. So what you need to do is map from the NIC to the Computername.

@lpingali 

[VRuiz]

Hi,

Thanks!!! That query works fine.

I think that I have two problems. The first one is that you comment with the merge about the nic id and the vm id. But, I think that the real problem form my query is in the tests that I made before, when the filter and variable syntaxis was wrong.

In the filter phrasse need to use a double quote "" and the X, Y and Z variables need to be called with ['X'].

Regards.