> For the complete documentation index, see [llms.txt](https://docs.prismacloud.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.prismacloud.io/content-collections/search-and-investigate/audit-event-queries/audit-event-query-attributes.md). # Audit Event Query Attributes Learn about audit event query attributes. Review your options when using `event from cloud.audit_logs where`. Each attribute allows you to narrow your search criteria. As you use these attributes, the auto-suggestion feature shows the available expressions and the operators that are applicable for each attribute. * `alert.id` Use the `alert.id` attribute to view alert details on the **Investigate** tab. For example, you can visualize the alert details for a set of alerts such as P-8444, P-8421, P-8420. ``` event from cloud.audit_logs where alert.id IN (‘P-8444’, ‘P-8421’, ‘P-8420’) ``` * `anomaly.type` Use the `anomaly.type` to view details on specific anomaly policies. The auto-suggestion displays the different anomaly policies that are supported with this attribute. ``` event from cloud.audit_logs where anomaly.type = 'Excessive Login Failures' ``` * `cloud.account` Use the `cloud.account` attribute to narrow down audit search to one or more cloud accounts that you connected to Prisma Cloud. For example, you can list entities or users who deleted security groups from a given cloud account: ``` event from cloud.audit_logs where cloud.account = 'Developer Sandbox' AND operation IN ( 'DeleteSecurityGroup' ) ``` * `cloud.account.group` Use the `cloud.account.group` attribute to narrow your search to only the cloud accounts in your cloud account group. For example, you can list entities or users who deleted Virtual Private Clouds in all your AWS accounts: ``` event from cloud.audit_logs where operation = 'DeleteVpc' AND cloud.account.group = 'All my AWS accounts' event from cloud.audit_logs where cloud.account.group = 'All my AWS accounts' AND cloud.service = 'autoscaling.amazonaws.com' AND user = 'maxusertest__gahp1Tho' ``` * `cloud.type` Use the `cloud.type` attribute to narrow your search to a specific cloud platform. Supported options are AWS, Azure, and GCP. For example, you can list all users who deleted S3 buckets: ``` event from cloud.audit_logs where cloud.type = 'aws' AND cloud.service = 's3.amazonaws.com' AND operation = 'DeleteBucket' ``` * `cloud.region` Use the `cloud.region` attribute to narrow down audit search to one or more cloud regions. For example, you can list entities or users who deleted access keys from a given cloud account: ``` event from cloud.audit_logs where cloud.account = 'Developer Sandbox' AND cloud.region = 'AWS Canada' AND operation IN ( 'DeleteAccessKey' ) ``` * `cloud.service` Use the `cloud.service` attribute to search for information using a specific service name in your cloud accounts. For example, you can review details for users who performed operations, such as deleting cloud trail logs or disabling or stopping logging events: ``` event from cloud.audit_logs where cloud.service = 'cloudtrail.amazonaws.com' AND operation IN ( 'DeleteTrail' , 'DisableLogging' , 'StopLogging' ) ``` * `crud` Use the `crud` attribute to search for information for users or entities who performed Create, Read, Update, or Delete operations. You can list all Azure resources that were deleted: ``` event from cloud.audit_logs where cloud.account in ( 'Azure - Microsoft Azure Sponsorship' ) and crud = 'delete' ``` * `has.anomaly` Use the `has.anomaly` attribute to search for information on events that include anomalies. For example, you can list all events that have identified anomalies for a cloud type: ``` event from cloud.audit_logs where cloud.type = 'azure' AND has.anomaly ``` * `operation` An operation is an action performed by users on resources in a cloud account. Use the `operation` attribute to start typing the name of the operation in which you are interested and Prisma Cloud auto-completes a list of operations that match your search criteria. For example, you can list details of delete operations on VPCs, VPC endpoints, and VPC peering connections: ``` event from cloud.audit_logs where operation in ( 'DeleteVpc' , 'DeleteVpcEndpoints' 'DeleteVpcPeeringConnection' ) ``` * `Subject` Use this attribute to search for actions that a specific user or an instance performed on your cloud account. For example, you can list console login operations by Ben: ``` event from cloud.audit_logs where operation = 'ConsoleLogin' AND subject = 'ben' ``` * `role` Use this attribute to filter the search results by role. For example, you can look for events performed by the Okta role: ``` event from cloud.audit_logs where role = ’OktaDevReadWriteRole’ ``` * `json.rule` Use this attribute to filter specific elements included in the JSON configuration related to a cloud resource. The `json.rule` attribute enables you to look for specific configurations—parse JSON-encoded values, extract data from JSON, search for value within any configuration policy for cloud accounts that you are monitoring using Prisma Cloud. Use the automatic suggest feature to see the available values for `json.rule`. The auto suggest works with the operators `=` and `IN` . It is not supported for array objects. Use `cloud.type` attribute to refine the search results. For example, you can check for login failures on the console: ``` event from cloud.audit_logs where cloud.account = 'Sandbox' AND json.rule = $.responseElements.ConsoleLogin != 'Success' ``` --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.prismacloud.io/content-collections/search-and-investigate/audit-event-queries/audit-event-query-attributes.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.