> For the complete documentation index, see [llms.txt](https://docs.prismacloud.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.prismacloud.io/content-collections/prisma-cloud-copilot/prisma-cloud-copilot-rql.md).

# Text to RQL Examples

With Prisma Cloud Copilot, you can type your questions that are automatically converted to an RQL query and the query is then executed.

## Assets RQL Examples

The following table lists the text (prompts) related to assets that you can enter and the Copilot will generate the corresponding RQL query:

| **Text (Prompt)**                                                                      |
| -------------------------------------------------------------------------------------- |
| Are the IAM resources making attempts to abuse credentials?                            |
| Which users making attempts to abuse credentials?                                      |
| Find S3 buckets with internet exposure or unencrypted storage.                         |
| Find GCP storage buckets in privilege escalation alerts.                               |
| Show me an asset with OPENSSL vulnerability.                                           |
| Which are the AWS instances with vulnerabilities with a score of at least 8?           |
| Show me assets with vulnerabilities.                                                   |
| Show me a list of compute instances using a new protocol to connect outside the cloud. |
| Users connecting from Tor network to Storage services.                                 |
| Compute instances scanning inside my environment.                                      |
| Find port scan attempts from Oracle cloud instances inside monitored accounts.         |
| AWS Lambda Function with IAM permissions management access level.                      |
| ECS task definitions with high privileged roles.                                       |
| Okta user with IAM permissions management access level.                                |
| List of Azure AD users with high privileged roles.                                     |
| Suspicious hosts associated with Rootkit activity talking to compute instances.        |
| AWS SageMaker notebook instances configured with direct internet access feature.       |
| GCP managed service accounts with key misconfigurations.                               |
| Find Alibaba cloud ram users with multiple access keys or types.                       |
| Find Azure AD users with privilege escalation problems.                                |

## Vulnerabilities RQL Examples

The following table lists the text (prompts) related to vulnerabilities that you can enter and the Copilot will generate the corresponding RQL query:

| **Text (Prompt)**                                                                                        |
| -------------------------------------------------------------------------------------------------------- |
| Find vulnerable assets in runtime environment.                                                           |
| Find vulnerabilities that have persisted for a minimum of 30 days.                                       |
| Show vulnerabilities in code repos.                                                                      |
| Show me vulnerabilities data where asset lifecycle is in run and severity is greater than high.          |
| Find all vulnerable assets across all cloud workloads.                                                   |
| Am I impacted by CVE-2022-42889?                                                                         |
| Show me vulnerability where CVSS score is greater than 5.                                                |
| Show the vulnerabilities with CVSS score is higher than 7.5 on infrastructure-as-code assets.            |
| Show vulnerabilities with a CVSS score higher than 8 and at least 30 days old.                           |
| Get cve which is coming from package git-commit-info.                                                    |
| List vulnerabilities for package MOVEit 2021.0.6.                                                        |
| Do I have any log4j vulnerabilities that are public facing?                                              |
| Find vulnerabilities that are not prioritized.                                                           |
| Show vulnerabilities that are both exploitable and have a high possibility of causing denial of service. |
| Do I have any internet facing PII?                                                                       |
| Which critical vulnerabilities exist in my cloud account?                                                |
| Which vulnerability is critical and must be fixed asap.                                                  |
| Show vulnerabilities found by Bridgecrew module.                                                         |
| Find vulnerabilities from either the Compute or Bridgecrew source.                                       |
| Show me any XZ Utils vulnerabilities.                                                                    |


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.prismacloud.io/content-collections/prisma-cloud-copilot/prisma-cloud-copilot-rql.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.