Prisma Cloud Event Search API - Include data.items[].rawEvent in response

Showing results for 
Show  only  | Search instead for 
Did you mean: 
Please sign in to see details of an important advisory in our Customer Advisories area.

Prisma Cloud Event Search API - Include data.items[].rawEvent in response

L0 Member

In my organization we have Prisma Cloud integrated into AWS Organization environment.  Which is great for monitoring and pulling data from the entire AWS Org.  I want to pull the count of all ec2 instances which are created using the RunInstances call.  The event search works great for the number of times the RunInstances is called, but in the rawEvent data several instances can be started from one call to RunInstances.  The below api call will receive the data from Prisma:



timePeriod = {
            "type": "absolute",
            "value": {
                "startTime": 1596240000000,
                "endTime": 1598918399000
rqlQuery="event where operation = 'RunInstances'"

prismaToken = prismaAPI.prismaLogin(apiKey,apiSecret)
query = {"limit":limit, "query": rqlQuery, "timeRange": timePeriod}
prismaQueryResult = prismaAPI.prismaQuery(prismaToken, query,'event')
def prismaQuery(pToken, rql, type='config'):

    url = f"{type}" if type != 'network' else "https//"
    print(f'rql: {rql}')
        headers = {
            'accept': "application/json; charset=UTF-8",
            'content-type': "application/json; charset=UTF-8",
            'x-redlock-auth': pToken
        response = requests.request("POST", url, headers=headers, json=rql)
        return response.json()
    except HTTPError as http_err:
        print(f'HTTP error occurred: {http_err}')  
    except Exception as err:
        print(f'Other error occurred: {err}') 




but the raw event data is not included in the response.  So then I need to make a call for every event to the endpoint.  Is there some way to get the rawEvent data in the initial search api call?  There is a data.items[].rawEvent shown as possible response information.


Thank you,




L4 Transporter

Greetings THolmes,


I hope that this note finds you well! I know that it has been a while since you had posted this question but I wanted to see if you still potentially needed any help. Thank you for your time and I hope that you have a good remainder of your day.


Kind Regards,

J. Avery King

J. Avery King | Prisma Cloud | Customer Success Engineer
  • 1 replies
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!