RQL - Checking tags using _DateTime function

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

RQL - Checking tags using _DateTime function

L1 Bithead

Can _DateTime function be used to check the date of a tag on a resource in AWS? My current query syntax is accepted by prisma however the _DateTime functions are not actually checking the tag (type string because all tags are strings in AWS) so it is returning undesired output.

 

Current query (should return all volumes with a (tag.key=Retain).value greater than 365 days old:
config from cloud.resource where cloud.type = 'aws' AND api.name = 'aws-ec2-describe-volumes' AND AND json.rule = _DateTime.ageInDays(tags[?(@.key=='Retain')].value) > 365 addcolumn tags[?(@.key=='Retain')].value

Are there any examples of checking a tag using the _DateTime function or any other ways to work with a date in prisma to check the value of a tag's date? Or any useful links/resources to look into this further are appreciated! Prisma Cloud AWS 

1 REPLY 1

L2 Linker

It seems that the way the documentation is written that while it is possible to use the _DateTime function to get the various time and age related properties from a resources, it doesen't seem to be possible to use it to get the time and date of attributes of the resources.  If you look at the examples, you can use the TimeDate function against resources an EC2 instance or a key, but not from an attribute of the recourse, like a tag. 

  • 978 Views
  • 1 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!