RQL to check ALL the virtual machines and service accounts in differents clouds. Prisma Cloud

[jquijada]

Hello Community. 

I need your help. I need a RQL in prisma cloud to check ALL my virtual machines and service accounts. The RQL should be work to GCP, AWS, Azure and OCI cloud. 
It's possible? I wanna check in a new custom policy all my VMs and service accounts. Hope you can help me. 
Regards. 

[bpachauli]

Hello, not via RQL, but with the newly revamped platform, you can choose a asset-based query within investigate and perform that. (screenshot below)

[jquijada]

After worked with CES palo alto. I found the below RQLs: 

The RQLs for the four cloud types would be (Virtual Machine):
1- event from cloud.audit_logs where cloud.type = 'aws' AND crud IN ( 'create', 'update', 'delete' ) and operation matches 'Instance'

2- event from cloud.audit_logs where cloud.type = 'azure' AND crud IN ( 'create', 'update', 'delete' ) AND operation matches 'virtual machine'

3- event from cloud.audit_logs where cloud.type = 'gcp' AND crud IN ( 'create', 'update', 'delete' ) and operation matches 'compute.instance'

4- OCI does not support even based RQLs, hence the RQL that we could come up with is:
config from cloud.resource where cloud.type = 'oci' AND api.name = 'oci-compute-instance'

And Service Accounts: 

OCI:
config from cloud.resource where cloud.type = 'oci' AND cloud.service = 'OCI IAM' AND api.name = 'oci-iam-user' AND json.rule = (apiKeys[*] is not empty or authTokens[*] is not empty)
Azure:
config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-active-directory-app-registration' AND json.rule = servicePrincipalLockConfiguration exists