Prisma-Azure RQL query to fetch public IPs

[PAgarwal5]

I am able to see public IPs attached to azure Network interfaces but I am not able to fetch public IPs in a column. 

[PAgarwal5]

I am using this query: config from cloud.resource where api.name = 'azure-vm-list' AND json.rule = ['properties.networkProfile'].networkInterfaces[*].publicIpAddress exists addcolumn ['properties.networkProfile'].networkInterfaces[*].ipConfigurations[*].publicIpAddress

Can anyone figure out how to add public Ips in a column so that I can download the list directly from Prisma.

[AHamilton-Sutherland]

The public IPs are included as a custom field. The UI hides the values behind a button, however when you download the CSV, the public IPs do appear in their own column named: 

['properties.networkProfile'].networkInterfaces[*].ipConfigurations[*].publicIpAddress
 I have tested this myself using your RQL query. Let me know if you have any further questions or if your downloaded file does not contain the public IPs field.

[APoppas]

Hi I came across this old thread while researching this morning and figured I'd share a more comprehensive query that can be used to find public IP addresses in Azure that isn't restricted to just those assigned to a virtual machine. Give this a try:

config from cloud.resource where cloud.service = 'Azure Virtual Network' AND api.name = 'azure-network-public-ip-address' addcolumn properties.ipAddress properties.dnsSettings.fqdn