> For the complete documentation index, see [llms.txt](https://docs.prismacloud.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.prismacloud.io/content-collections/search-and-investigate/network-queries/network-config-query-attributes.md). # Network Configuration Query Attributes The Cloud Network Analyzer (CNA) engine of Prisma Cloud calculates the external exposure of your cloud assets using routing path that exists from **source** to **destination** and the net effectiveness of all network security policies in that network path. You can use `config from network where` query and if the search expression is valid and complete, a green checkmark displays along with your query results. Each attribute allows you to narrow your search criteria. As you use these attributes, the auto-suggestion capability shows the available expressions and [operators](/content-collections/search-and-investigate/rql-operators.md) that are applicable for each attribute. In order for the network configuration query to be valid, you need to specify at least one `source` , one `dest` (destination), and one `cloud.type` attribute. You can only use the `and` operator in the RQL query. Use `=` to specify a single value and `in` to specify comma separated values (csv). Prisma Cloud includes improved handling of internet exposure caused by assets deployed in VPCs that use public CIDR blocks. It now generates new alerts in the following cases: * Inbound OOB policy to AWS EC2 instances are shown as directly exposed even if the ENI has no public IP. * Inbound OOB policy to an interface (with private IP that is a public IP) is shown as exposed even if the interface is not behind a load balancer as long as security considerations allow the packet. Prisma Cloud resolves alerts for outbound OOB policy which has a **Instance (with private IP that is a public IP in this case) > NAT Gateway > Internet Gateway > Internet** path because NAT Gateway drops traffic for the packet which has the source IP as a public IP in the outbound path. Any IP addresses or CIDR that you have not defined as [Trusted IP Addresses on Prisma Cloud](https://github.com/PaloAltoNetworks/pc-docs-md/tree/main/enterprise-edition/content-collections/administration/trusted-ip-addresses-on-prisma-cloud.md) and are not part of your cloud environment are considered as UNTRUST\_INTERNET. * `source/dest.network` Use the `source/dest.network` attribute to search for all public untrusted Internet IPs. Specify it in an IP CIDR format, such as `1.2.3.4/32`. * `address.match.criteria` The `address.match.criteria` attribute is optional to use in combination with the `source/dest.network` attribute. You can use a `full_match` or a `partial_match` for IP addresses with this criteria. For example: * **full\_match**—If you use `address.match.criteria = 'full_match'` for the IP range 20.0.0.0/24 then the cloud network analyzer engine will look for all host addresses of 20.0.0.0/24 in security policies to match. * **partial\_match**-—If you use `address.match.criteria = 'partial_match'` for the IP range 20.0.0.0/24 then the cloud network analyzer engine will look for at-least one of host addresses of 20.0.0.0/24 in security policies to match. **Query example:** ``` config from network where source.network = '20.0.0.0/24' and address.match.criteria = 'partial_match' and dest.resource.type = 'Instance' and dest.cloud.type = 'AWS' and protocol.ports in ( 'tcp/0:79', 'tcp/81:442', 'tcp/444:65535' ) ``` * `source/dest.resource.type` Use the `source/dest.resource.type` attribute to search for true network exposure of a particular resource type, such as an instance, interface, PaaS, or service endpoint. * `source/dest.cloud.type` Use the `source/dest.cloud.type` attribute to narrow down your search option to specific clouds. **Query example:** ``` config from network where source.network = UNTRUST_INTERNET and address.match.criteria = 'full_match' and dest.resource.type = 'Instance' and dest.cloud.type = 'AWS' ``` * (Optional) `source/dest.resource.state` Use the `source/dest.resource.state` attribute to find resources that are Active or Inactive, such as an EC2 instance that has state as running or inactive or an EC2 instance that has state as stopped on Prisma Cloud. If you do not specify `source/dest.resource.state` in the query, the RQL query displays both Active and Inactive resources in the result. **Query example:** ``` config from network where source.network = '0.0.0.0/0' and address.match.criteria = 'full_match' and dest.resource.type = 'Instance' and dest.cloud.type = 'AWS' and dest.resource.state = 'Active' ``` * (Optional) `source/dest.cloud.account` Use the `source/dest.cloud.account` attribute to narrow down the search to one or more cloud accounts that you connected to Prisma Cloud. **Query examples:** ``` config from network where source.network = '0.0.0.0/0' and address.match.criteria = 'full_match' and dest.resource.type = 'Instance' and dest.cloud.type = 'AWS' and dest.cloud.account in ( '345744466724', '667116190384' ) config from network where source.network = '0.0.0.0/0' and address.match.criteria = 'full_match' and dest.resource.type = 'Instance' and dest.cloud.type = 'AWS' and dest.cloud.account = '345744466724' ``` * (Optional) `source/dest.cloud.region` Use the `source/dest.cloud.region` attribute to narrow down the search based on where the sources are, in one or more cloud regions. **Query examples:** ``` config from network where source.network = '0.0.0.0/0' and address.match.criteria = 'full_match' and dest.resource.type = 'Instance' and dest.cloud.type = 'AWS' and dest.cloud.region = 'AWS Virginia' config from network where source.network = '0.0.0.0/0' and address.match.criteria = 'full_match' and dest.resource.type = 'Instance' and dest.cloud.type = 'AWS' and dest.cloud.region in ( 'AWS Virginia', 'AWS Ohio' ) ``` * (Optional) `source/dest.cloud.instance.id` Use the `source/dest.cloud.instance.id` attribute to search exposure of a specific EC2 instance based on it resource ID. **Query examples:** ``` config from network where source.network = '0.0.0.0/0' and address.match.criteria = 'full_match' and dest.resource.type = 'Instance' and dest.cloud.type = 'AWS' and dest.instance.id = 'i-07c6c16595ed9196b' config from network where source.network = '0.0.0.0/0' and address.match.criteria = 'full_match' and dest.resource.type = 'Instance' and dest.cloud.type = 'AWS' and dest.instance.id in ( 'i-0a0e018fc73917ba7' , 'i-0a0e018fc73917ba7' ) ``` * (Optional) `source/dest.instance.image.id` Use the `source/dest.instance.image.id` attribute to search for virtual machines with specific image ID. **Query example:** ``` config from network where source.network = UNTRUST_INTERNET and dest.resource.type = 'Instance' and dest.cloud.type = 'AWS' and dest.instance.image.id = 'ami-0fe8c3a9b6b9b3c6e' ``` * (Optional) `source/dest.instance.product.code` Use the `source/dest.instance.product.code` attribute to search for virtual machines with specific product code. **Query example:** ``` config from network where source.network = UNTRUST_INTERNET and dest.resource.type = 'Instance' and dest.cloud.type = 'AWS' and dest.instance.image.product.code = '5tiyrfb5tasxk9gmnab39b843' ``` * (Optional) `source/dest.cloud.interface.id` Use the `source/dest.cloud.interface.id` attribute to search exposure of a specific EC2 cloud resource based on its ID. * (Optional) `source/dest.network.interface.id` Use the `source/dest.network.interface.id` attribute to search exposure of a specific network interface based on its ID. **Query example:** ``` config from network where source.network = UNTRUST_INTERNET and dest.resource.type = 'Interface' and dest.cloud.type = 'AWS' and dest.network.interface.id = 'eni-083bb56febfd55383' ``` * (Optional) `source/dest.network.interface.owner` Use the `source/dest.network.interface.owner` attribute to search exposure of a specific network interface based on the owner. **Query example:** ``` config from network where source.network = UNTRUST_INTERNET and dest.resource.type = 'Interface' and dest.cloud.type = 'AWS' and dest.network.interface.owner = 'amazon-rds' ``` * (Optional) `source/dest.network.interface.type` Use the `source/dest.network.interface.type` attribute to search exposure of a specific network interface based on the interface type. **Query example:** ``` config from network where source.network = UNTRUST_INTERNET and dest.resource.type = 'Interface' and dest.cloud.type = 'AWS' and dest.network.interface.type = 'Lambda' ``` * (Optional) `source/dest.security.group.id` Use the `source/dest.security.group.id` attribute to search exposure of a specific network interface based on the specific security group associated with it. **Query example:** ``` config from network where source.network = UNTRUST_INTERNET and dest.resource.type = 'Interface' and dest.cloud.type = 'AWS' and dest.security.group.id = 'sg-04242ff5c55da0c84' ``` * (Optional) `source/dest.service.name` Use the `source/dest.service.name` attribute to search exposure of a specific VPC service endpoint based on the service name. **Query example:** ``` config from network where source.resource.type = 'Instance' and dest.resource.type = 'Service Endpoint' and source.vpc.id = 'vpc-079e9bb7bc4ba9db2' and dest.vpc.id = 'vpc-079e9bb7bc4ba9db2' and dest.service.name = 'com.amazonaws.us-east-1.secretsmanager' ``` * (Optional) `source/dest.subnet.id` Use the `source/dest.subnet.id` attribute to search exposure of a specific network interface based on the subnet id. **Query example:** ``` config from network where source.network = UNTRUST_INTERNET and dest.resource.type = 'Interface' and dest.network.interface.id = 'subnet-0d8b58217812f9c42' ``` * (Optional) `source/dest.tag` Use the `source/dest.tag` attribute to search exposure of a specific network interface or virtual machine based on the resource tag pair. **Query example:** ``` config from network where source.network = UNTRUST_INTERNET and dest.resource.type = 'Instance' and dest.tag = 'env=prod' ``` * (Optional) `source/dest.vpc.id` Use the `source/dest.vpc.id` attribute to search exposure of a specific network interface or virtual machine based on the VPC ID. **Query example:** ``` config from network where source.network = UNTRUST_INTERNET and dest.resource.type = 'Instance' and dest.vpc.id = 'vpc-079e9bb7bc4ba9db2' ``` * (Optional) `excluded.networks` Use the `excluded.networks` attribute to exclude certain IP/IPv6 CIDR blocks from Network Path Analysis calculation. This is useful only when you use `source.network = UNTRUST_INTERNET` or `dest.network = UNTRUST_INTERNET` RQL attribute. **Query example:** ``` config from network where source.network = UNTRUST_INTERNET and dest.resource.type = 'Instance' and dest.cloud.type = 'AWS' and excluded.networks in ( '1.2.3.4/32', '100.0.0.0/24' ) ``` * (Optional) `alert.on` The `alert.on` attribute is only applicable when the RQL query is used as a Policy. **Query example:** ``` config from network where source.network = UNTRUST_INTERNET and dest.resource.type = 'Instance' and dest.cloud.type = 'AWS' and alert.on = 'DestVPC' ``` * (Optional) `protocol.ports` Use the `protocol.ports` attribute to search for specific protocols and destination ports, which you can specify in following formats: * udp * tcp * tcp/22 * tcp/20:50 * icmp/code/type * tcp/22,443,3389,1000:5000 * (Optional) `effective.action` Use the `effective.action` attribute to search for the net effective action that allows or rejects the network traffic from the specified source to destination. The options are: * Allow: A routing path exists and security policies allow the traffic. * Deny: A routing path exists, however security policies reject the traffic. * Any: Routing path exists, however security policies allow/reject the traffic. If you do not specify the value for `effective.action` in your query, by default, CNA considers it as `Allow`. In addition to the above attributes, you can include the following optional attributes that are specific to Kubernetes: * `k8s.cluster.name` Include a specific cluster ID or name. If you do not specify, ANY cluster is considered. * `k8s.dest.namespace` Include a specific namespace. If you do not specify, ANY namespace is considered. You have to use a namespace in combination with the cluster name. * `k8s.destination.label` Use K8s labels to filter down results. If you do not specify, ALL labels are considered. * `container.image` Include a specific container image. If you do not specify, the results will ignore the specific image. * `k8s.service.name` Include a specific service. If you do not specify, ANY service is considered. You can also combine the above Kubernetes-specific attributes with the following pre-existing attributes: * `dest.cloud.account` * `protocol.ports` * `source/destination.vpc` * `source/destination.cloud.region` * (Optional) `effective.action` --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.prismacloud.io/content-collections/search-and-investigate/network-queries/network-config-query-attributes.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.