Prisma Cloud RQL json.rule options

[SPAUL2008]

Hello,

Is it possible to use an array or list of values when comparing few values for a json.rule within an RQL?

For example, in the following RQL, can we combine the "tags[*].key" comparison values to a list of items (such as something like     'does not contain ["PatchGroup", "Patch Group", "patch-window", "prismacloud-scan"]') rather than having them defined separately?

config from cloud.resource where cloud.type = 'aws' and api.name = 'aws-ec2-describe-instances' AND json.rule = tags[*].key does not contain "Patch Group" and tags[*].key does not contain "PatchGroup" and tags[*].key does not contain "patch-window" and tags[*].value does not contain "prismacloud-scan"

Thanks,
Paul

[JCalloway1]

Hey Paul!
If the everything was the same, you could use a construction like "not in ()" or ". . . is not member of (string, string,string).  
However, you have two entries that are for "tags[*].key" and one that is for "tags[*].value", so since those are inconsistent, you can't put them in a list like above. 

[SPAUL2008]

Thank you. 
is not a member of ('','','')     seems to be working for the same parameter.

config from cloud.resource where cloud.type = 'aws' and api.name = 'aws-ec2-describe-instances' AND json.rule = tags[*].key is not member of ( 'Patch Group', 'PatchGroup', 'patching-window') and tags[*].value does not contain "prismacloud-scan"

[JCalloway1]

Hey Paul!
Excellent!  I'm glad that works!

[SPAUL2008]

Sorry, I spoke too soon. 
When comparing outputs from both of these queries side-by-side, I can see some false positives from the new one!