> For the complete documentation index, see [llms.txt](https://docs.prismacloud.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.prismacloud.io/content-collections/search-and-investigate/asset-config-queries/asset-config-query-attributes.md). # Asset Configuration Query Attributes Review your options when using the `config from` query. The `cloud.resource` attribute uses the configuration metadata that Prisma Cloud ingests from the cloud service providers, and you can use it to query the asset configuration and manage the security posture for the asset. Each attribute allows you to narrow your search criteria. As you use these attributes, the auto-suggestion feature shows the available expressions and the operators that are applicable for each attribute. * `api.name` Cloud APIs are part of cloud platforms and they enable the development of applications and services used for provisioning assets, virtual machines, platforms, and software. For each cloud platform, depending on the asset, there are several APIs available. You can use the `api.name` attribute to identify a specific configuration for the asset. For a list of all API names available for each cloud platform, see **API Reference**. When used with the `cloud.type` attribute, auto-complete displays only the API names that pertain to the cloud type you selected. For example, you can list SQL instances on Google Cloud: ``` config from cloud.resource where cloud.type = 'gcp' AND api.name = 'gcloud-sql-instances-list' ``` * `addcolumn` Use the `addcolumn` attribute to add columns to the results displayed. This enables you to view the JSON data for the assets that correspond to your query. For example, you can add columns for key name and image ID for EC2 instances: ``` config from cloud.resource where api.name = 'aws-ec2-describe-instances' addcolumn keyName hypervisor imageId ``` The addcolumn attributes works only when the field is present in all matching entries. If all matching entries do not have the selected field in the JSON payload, the column may not display. * `azure.resource.group` Use the `azure.resource.group` attribute to find all cloud resources deployed within a specific Azure Resource Group, which is a logical container that groups related resources that are stored within your Azure account. For example, you can list all network-vnet resources that are part of the Azure Resource Group named azure-resource-group-test: ``` config from cloud.resource where azure.resource.group = 'azure-resource-group-test' and api.name = 'azure-network-vnet-list' ``` * `cloud.account` Use the `cloud.account` attribute to narrow down a configuration search to one or more cloud accounts that you connected to the Prisma Cloud. For example, you can list EC2 instances in your Production AWS account: ``` config from cloud.resource where cloud.type = 'aws' AND cloud.account = 'Production' AND api.name = 'aws-ec2-describe-instances' ``` * `cloud.account.group` Use the `cloud.account.group` attribute to narrow down the configuration to the cloud account in your cloud account group. For example, you can list all the Amazon RDS instances in all your AWS accounts: ``` config from cloud.resource where cloud.account.group = 'All my AWS accounts' AND cloud.region = 'AWS Virginia' AND api.name = 'aws-rds-describe-db-instances' ``` * `cloud.region` Use the `cloud.region` attribute to narrow down a configuration search to one or more cloud regions. For example, you can list all virtual machine instances in your Azure account in the Central US region: ``` config from cloud.resource where cloud.type = 'azure' and cloud.account = 'RedLock - Azure Subscription' AND cloud.region = 'Azure Central US' AND api.name = 'azure-vm-list' ``` * `cloud.service` Use the `cloud.service` attribute to query configuration for a specific cloud service, such as IAM, S3, or Virtual Machines. For example, you can list all S3 storage bucket access control lists (ACLs) in your AWS cloud accounts: ``` config from cloud.resource where cloud.type = 'aws' AND cloud.service = 'S3' AND api.name = 'aws-s3api-get-bucketacl' ``` * `cloud.type` Use the `cloud.type` attribute to narrow down your search option to specific clouds. Supported options are AWS, Azure,GCP, Alibaba and OCI. For example, you can list all EC2 instances in your AWS cloud accounts: ``` config from cloud.resource where cloud.type = 'aws' AND api.name = 'aws-ec2-describe-instances' ``` * `count` Use the `count` attribute for a tally of the number of assets of a specific type. `count` is available for use with the `api.name` attribute as \ or along with `json.rule` to query or filter specific elements included in the JSON configuration related to a cloud asset. When the api.name is a global service (such as, azure-active-directory-app-registration), count includes all assets for that service within the cloud account; if the api.name is a regional service (such as, azure-vm-list), the count includes the only assets tied to the cloud region for the cloud account. For example, you can retrieve a count of all the Azure Linux Virtual Machines available: ``` config from cloud.resource where api.name = 'azure-vm-list' as X; count(X) greater than 0 ``` or, in conjunction with the `json.rule` attribute to filter and retrieve a count of all the Azure Linux Virtual Machines where password authentication is disabled: ``` config from cloud.resource where api.name = 'azure-vm-list' AND json.rule = ['properties.osProfile'].linuxConfiguration.disablePasswordAuthentication is true as X; count(X) greater than 1 ``` * `finding.type, finding.severity, finding.source` Use the finding attributes to query for vulnerabilities on workloads—destination or source assets—that have one or more host-related security findings. Prisma Cloud ingests host vulnerability data from external sources, such as Qualys, Tenable.io, Amazon Inspector and ingests host and IAM users security-related alerts from Amazon GuardDuty, or Prisma Cloud Defenders deployed on your hosts or containers. To leverage `finding` attributes, you must either enable an integration with the host vulnerability provider such as Amazon GuardDuty or have installed Prisma Cloud Defenders in your environment. For example, you can list all the hosts with a critical host vulnerability: ``` config from cloud.resource where finding.type = 'Host Vulnerability' AND finding.severity = 'critical' ``` Or find potential security issues by source: ``` config from cloud.resource where finding.source = 'AWS Guard Duty' AND finding.type = 'AWS GuardDuty IAM' AND api.name= 'aws-iam-list-users' ``` Host finding attributes support the following assets types: * **Prisma Cloud Alert**—Fetches all assets that have one or more open alerts generated by Prisma Cloud. * **Host Vulnerability**—Fetches all assets that have one or more of the host vulnerabilities (such as CVE-2016-8655) reported by external providers such as AWS Inspector, Qualys, or Tenable.io or Prisma Cloud Defenders. * **Compliance**—Fetches all assets that are in violation of one or more compliance issues reported by external compliance host-scanning systems. * **AWS Inspector Runtime Behavior Analysis**—Fetches all assets which are in violation of one or more rules reported by the AWS Runtime Behavior Analysis package. * **AWS Inspector Security Best Practices**—Fetches all assets which are in violation of one or more rules reported by the AWS Inspector Security best practices package. * **AWS GuardDuty**—Fetches all assets which have one or more findings reported by AWS GuardDuty. For Amazon GuardDuty, the finding.type can be IAM or host—AWS GuardDuty IAM or AWS GuardDuty Host. * `finding.name` Use the `finding.name` attribute and enter a string value to find a host vulnerability by the name defined on your host vulnerability provider. Specify the `finding.type` for the autocomplete suggestion to specify a `finding.name` query. For example, you can list all the hosts with the CVE-2016-8399 vulnerability: ``` config from cloud.resource where finding.type = 'Host Vulnerability' AND finding.name = 'CVE-2016-8399' ``` or, ``` config from cloud.resource where finding.type = 'AWS GuardDuty IAM' AND finding.name= 'Recon:IAM/TorIPCaller' ``` * `json.rule` Prisma Cloud ingests data and updates events in the JSON format. Use the `json.rule` attribute to query or filter specific elements included in the JSON configuration related to a cloud asset. The `json.rule` attribute enables you to look for specific configurations: parse JSON-encoded values, extract data from JSON, or search for value within any configuration policy for cloud accounts that you are monitoring using Prisma Cloud. The `json.rule` attribute allows you to create boolean combinations and find data in selected fields within the JSON data that represents the asset. When you include the `json.rule` attribute in a configuration query, the auto-complete displays the elements or assets that match your search criteria. Because JSON has a nested structure, you can search for elements at the root level, inside the JSON tree, or in an array object. Since the auto-complete model is static and is not built on live data from your accounts, some of the fields may not be displayed on selecting **JSON RULE IS**. If you see a few fields missing, do not use auto-complete; instead switch to the **Advanced** mode and manually enter the RQL and JSON path. For example, you can list all Azure Linux Virtual Machines where password authentication is disabled: ``` config from cloud.resource where api.name = 'azure-vm-list' AND json.rule = ['properties.osProfile'].linuxConfiguration.disablePasswordAuthentication is true ``` Or define nested rules in Config RQL to query data within JSON arrays, such as find network security groups that include rules that allow TCP traffic on specified destination ports: ``` config from cloud.resource where api.name= 'azure-network-nsg-list' AND json.rule = securityRules[?any( direction equals Inbound and protocol does not equal UDP and access equals Allow and destinationPortRange is member of (22,3389,5432,1521,3306,5000,5984,6379,6380,9042,11211,27017))] exists ``` or, ``` config from cloud.resource where api.name= 'azure-network-nsg-list' AND json.rule = securityRules[?any(access equals Allow and direction equals Inbound and sourceAddressPrefix equals Internet and (protocol equals Udp or protocol equals *) and destinationPortRange contains _Port.inRange(137,137) )] exists ``` or, ``` config from cloud.resource where api.name = 'aws-ec2-describe-security-groups' AND json.rule = ipPermissionsEgress[?any( toPort greater than 22 and ipv4Ranges[?any( cidrIp does not contain "0.0" )] exists )] exists ``` * `resource.status` Use the `resource.status` attribute to find assets that are active or deleted on the cloud platform within the specified time range. The value available are `active` or `deleted` . For example: `config from cloud.resource where resource.status = active` The query result is based on whether the specified asset was active during or deleted anytime within the search time range. Assets that were neither created nor deleted within the specified time range are not included in the result. When `resource.status` is not specified in the query, use the **Asset Explorer** to check whether the **Deleted** status for the resource is True or False. * `tag` Use the `tag` attribute to find all resources that have a specific tag name or value. The operators available with `config from cloud.resource where tag` include `('key') = 'value'` , `All` , `Any` , `tag('key') EXISTS` , `tag('key') in ('value1', 'value2', 'value3')` , and the negations !=, does not Exist, not in. After you define a `tag` in menu:Settings\[Resource List], you can reference the tag value or key in a config query. The supported operators are `is member of`, `is not member of` , `intersects` , and `does not intersect`. Use curly braces to use them in a JSON rule: ``` config from cloud.resource where api.name = 'aws-ec2-describe-instances' AND json.rule = tags[*].key is member of {'Resource List'.keys} ``` * Only the tags that are displayed in the Asset Explorer are available for you to match on; all tags in the JSON payload are not available with the tag attribute. * Tag-based filtering allows you to find assets on the **Investigate** page. You cannot save the query as a saved search or use it in custom policy. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.prismacloud.io/content-collections/search-and-investigate/asset-config-queries/asset-config-query-attributes.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.