Network Configuration Queries

Prisma Cloud provides the config from network where network query that is based on network configuration, which you can use to identify overly-exposed resources by providing end-to-end network path visibility from any source, such as AWS EC2 virtual machine, DB instance, or Lambda application to any destination, such as the internet, another VPC, or on-premises networks. This visibility in to the associations between security groups and compute instances help you identify network security risks before they become incidents. Prisma Cloud does not send traffic or read network logs for performing network path analysis.

Investigate functions that use the config from network where query, require both READ config and READ network permissions to work. While you can you can save your custom RQL queries for config from network where, you cannot yet download the query result as a CSV from the console.

Use the config from network where RQL, to query Prisma Cloud for network exposure on the following resources:

Cloud Services	Resources that Support Network Exposure
AWS	Network (VPC) Internet Gateway Subnet NACL NAT Gateway EC2 ENI EIP Security Group VPC Service Endpoint/PrivateLink Route Table Transit Gateway and Route Table VPC Peering
Azure	Virtual Machine (VM) Virtual Machine Scale Set (flexible VMSS, uniform VMSS) Network Interface (NIC) Subnet Public IP Addresses (PIP, PIP prefixes, shared PIP) User Define Route (effective UDR) Virtual Network (Vnet) NAT Gateway Loadbalancer (NLB, ALB) Application Security Group (ASG) Network Security Group (NSG) PaaS Services (PgSQL)
GCP	Subnet VPC Firewall Hierarchical Firewall Rules BackendService FirewallPolicy LB ForwardingRule VM InstanceGroup VPC NetworkEndpointGroup TargetHttpProxy TargetHttpsProxy TargetInstance TargetPool TargetSslProxy TargetTcpProxy URLMap

Network exposure queries are currently supported only on AWS, Azure, and GCP cloud environments and are currently not available in the Government and China regions.