Failed to execute RQL search. Illegal argument

[KaushalRai]

When I am trying to run this query in Prisma cloud , It through me message "Failed to execute RQL search. Illegal argument" 

RQL 

config from cloud.resource where api.name = 'aws-ec2-describe-security-groups' as X; config from cloud.resource where api.name = 'aws-ec2-describe-route-tables' as Y; config from cloud.resource where api.name = 'aws-ec2-describe-instances' as Z; filter "$.Y.vpcId contains $.X.vpcId
and $.Z.subnetId contains $.Y.associations[*].subnetId
and $.Y.routes[?(@.destinationCidrBlock=='0.0.0.0/0')].gatewayId contains igw
and ($.X.ipPermissions[?(@.toPort > 445 || @.fromPort < 445)].ipRanges[*] contains 0.0.0.0/0
or $.X.ipPermissions[?(@.toPort > 445 || @.fromPort < 445)].ipv6Ranges[*].cidrIpv6 contains ::/0) "; show X;

Please help me in fixing this issue

Prisma Cloud  

[JCalloway1]

Hi KaushalRai

It looks like you had some spacing issues with your last clause.  sometimes you can include spaces, but in other cases, you cannot.  

The last part of your original statement was:

and ($.X.ipPermissions[?(@.toPort > 445 || @.fromPort < 445)].ipRanges[*] contains 0.0.0.0/0 or $.X.ipPermissions[?(@.toPort > 445 || @.fromPort < 445)].ipv6Ranges[*].cidrIpv6 contains ::/0) "; show X;

This is what I was able to get to work:

and ($.X.ipPermissions[?(@.toPort>445||@.fromPort>445)].ipRanges[*] contains 0.0.0.0/0 or $.X.ipPermissions[?(@.toPort>445||@.fromPort>445)].ipv6Ranges[*].cidrIpv6 contains ::/0)" ; show X;

Here is the final modification of your query:

config from cloud.resource where api.name = 'aws-ec2-describe-security-groups' as X; config from cloud.resource where api.name = 'aws-ec2-describe-route-tables' as Y; config from cloud.resource where api.name = 'aws-ec2-describe-instances' as Z; filter "$.Y.vpcId contains $.X.vpcId and $.Z.subnetId contains $.Y.associations[*].subnetId and $.Y.routes[?(@.destinationCidrBlock=='0.0.0.0/0')].gatewayId contains igw and ($.X.ipPermissions[?(@.toPort>445||@.fromPort>445)].ipRanges[*] contains 0.0.0.0/0 or $.X.ipPermissions[?(@.toPort>445||@.fromPort>445)].ipv6Ranges[*].cidrIpv6 contains ::/0)" ; show X;

Hope this helps!
🙂