Text to RQL Examples

With Prisma Cloud Copilot, you can type your questions that are automatically converted to an RQL query and the query is then executed.

Assets RQL Examples

The following table lists the text (prompts) related to assets that you can enter and the Copilot will generate the corresponding RQL query:

Text (Prompt)
Are the IAM resources making attempts to abuse credentials?
Which users making attempts to abuse credentials?
Find S3 buckets with internet exposure or unencrypted storage.
Find GCP storage buckets in privilege escalation alerts.
Show me an asset with OPENSSL vulnerability.
Which are the AWS instances with vulnerabilities with a score of at least 8?
Show me assets with vulnerabilities.
Show me a list of compute instances using a new protocol to connect outside the cloud.
Users connecting from Tor network to Storage services.
Compute instances scanning inside my environment.
Find port scan attempts from Oracle cloud instances inside monitored accounts.
AWS Lambda Function with IAM permissions management access level.
ECS task definitions with high privileged roles.
Okta user with IAM permissions management access level.
List of Azure AD users with high privileged roles.
Suspicious hosts associated with Rootkit activity talking to compute instances.
AWS SageMaker notebook instances configured with direct internet access feature.
GCP managed service accounts with key misconfigurations.
Find Alibaba cloud ram users with multiple access keys or types.
Find Azure AD users with privilege escalation problems.

Vulnerabilities RQL Examples

The following table lists the text (prompts) related to vulnerabilities that you can enter and the Copilot will generate the corresponding RQL query:

Text (Prompt)
Find vulnerable assets in runtime environment.
Find vulnerabilities that have persisted for a minimum of 30 days.
Show vulnerabilities in code repos.
Show me vulnerabilities data where asset lifecycle is in run and severity is greater than high.
Find all vulnerable assets across all cloud workloads.
Am I impacted by CVE-2022-42889?
Show me vulnerability where CVSS score is greater than 5.
Show the vulnerabilities with CVSS score is higher than 7.5 on infrastructure-as-code assets.
Show vulnerabilities with a CVSS score higher than 8 and at least 30 days old.
Get cve which is coming from package git-commit-info.
List vulnerabilities for package MOVEit 2021.0.6.
Do I have any log4j vulnerabilities that are public facing?
Find vulnerabilities that are not prioritized.
Show vulnerabilities that are both exploitable and have a high possibility of causing denial of service.
Do I have any internet facing PII?
Which critical vulnerabilities exist in my cloud account?
Which vulnerability is critical and must be fixed asap.
Show vulnerabilities found by Bridgecrew module.
Find vulnerabilities from either the Compute or Bridgecrew source.
Show me any XZ Utils vulnerabilities.