Error with RQL joint and atributes with dot

Reply
Highlighted
L1 Bithead

Error with RQL joint and atributes with dot

Hello,

 

I have an error when we are implementing a RQL query in the Investigate tab.

We make a join query searching in a VMs list and a NICs list in the prisma platform over a Azure suscription.

The problem seems to be over the filter part when we use the ['xxx.xxx'] format in a query when an atribute have a dot inside, because when we change to other atribute that don't have dot, it runs.

 

The query is the next (we are checking the atributes to correlate the VMs):

 

config where api.name = 'azure-network-nic-list' as X; config where api.name = 'azure-vm-list' as Y; filter '$.X.['properties.virtualMachine'].id == $.Y.['properties.networkProfile'].networkInterfaces[*].id and $.X.tags.owner exists'; show X;

 

Do anyone know if the definition over the filter could be different that in the filter body? Is it any separating character that allow the query? Could be a bug in the prisma platform?

 

Regards.


Accepted Solutions
Highlighted
L3 Networker

Re: Error with RQL joint and atributes with dot

Try this RQL ( with double quotes for filter):

 

config where api.name = 'azure-network-nic-list' as X; config where api.name = 'azure-vm-list' as Y; filter "$.['X'].['properties.virtualMachine'].['id'] == $.['Y'].['properties.networkProfile'].networkInterfaces[*].['id'] and $.X.tags.owner exists"; show X;

View solution in original post

Highlighted
L1 Bithead

Re: Error with RQL joint and atributes with dot

VRuiz,

 

Please try the below RQL.

 

config where cloud.account = 'Azure-Redlock-public-demo' AND api.name = 'azure-network-nic-list' as X; config where api.name = 'azure-vm-list' as Y; filter "$.['X'].['properties.virtualMachine'].id contains $.['Y'].['properties.osProfile'].computerName and $.X.tags.owner exists"; show X;

 

The issue you were running into is that $.['Y'].['properties.networkProfile'].networkInterfaces[*].id references the network interface Id, but that value doesn't exist in the nic-list response. So what you need to do is map from the NIC to the Computername.

 

@lpingali 

Respectfully Submitted,
Francisco Breijo

View solution in original post


All Replies
Highlighted
L3 Networker

Re: Error with RQL joint and atributes with dot

Try this RQL ( with double quotes for filter):

 

config where api.name = 'azure-network-nic-list' as X; config where api.name = 'azure-vm-list' as Y; filter "$.['X'].['properties.virtualMachine'].['id'] == $.['Y'].['properties.networkProfile'].networkInterfaces[*].['id'] and $.X.tags.owner exists"; show X;

View solution in original post

Highlighted
L1 Bithead

Re: Error with RQL joint and atributes with dot

Hi Lpingali,

 

I tried this one and could execute (the button isn't grey) but the results was empty because show no one and, the suscription have several cases.

 

 

 

Highlighted
L3 Networker

Re: Error with RQL joint and atributes with dot

Can you please open a ticket with screenshots of the results from both API calls, so we can debug further?

Highlighted
L1 Bithead

Re: Error with RQL joint and atributes with dot

VRuiz,

 

Please try the below RQL.

 

config where cloud.account = 'Azure-Redlock-public-demo' AND api.name = 'azure-network-nic-list' as X; config where api.name = 'azure-vm-list' as Y; filter "$.['X'].['properties.virtualMachine'].id contains $.['Y'].['properties.osProfile'].computerName and $.X.tags.owner exists"; show X;

 

The issue you were running into is that $.['Y'].['properties.networkProfile'].networkInterfaces[*].id references the network interface Id, but that value doesn't exist in the nic-list response. So what you need to do is map from the NIC to the Computername.

 

@lpingali 

Respectfully Submitted,
Francisco Breijo

View solution in original post

Highlighted
L1 Bithead

Re: Error with RQL joint and atributes with dot

Hi,

 

Thanks!!! That query works fine.

 

I think that I have two problems. The first one is that you comment with the merge about the nic id and the vm id. But, I think that the real problem form my query is in the tests that I made before, when the filter and variable syntaxis was wrong.

In the filter phrasse need to use a double quote "" and the X, Y and Z variables need to be called with ['X'].

 

Regards.

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!