> For the complete documentation index, see [llms.txt](https://docs.prismacloud.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.prismacloud.io/content-collections/search-and-investigate/query-types.md).

# Query Types and Required Permissions

Prisma Cloud supports the query types listed in the below table. You can review the query types, RQL prefixes, and RQL operators to understand and build customized queries that help you secure your environment.

| **Query Type**                                                                                                                                                                                              | **Supported Mode**  | **Description**                                                                 | **RQL Prefix**                      | **Policies**                        |
| ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------- | ------------------------------------------------------------------------------- | ----------------------------------- | ----------------------------------- |
| [Asset](https://github.com/PaloAltoNetworks/pc-docs-md/tree/main/enterprise-edition/content-collections/search-and-investigate/asset-queries/asset-queries.md)                                              | Simple              | View your cloud assets with comprehensive security context.                     | Not applicable                      | Attack Path, Workload Vulnerability |
| [Asset Configuration](https://github.com/PaloAltoNetworks/pc-docs-md/tree/main/enterprise-edition/content-collections/search-and-investigate/asset-config-queries/asset-config-queries.md) (Config)         | Simple and Advanced | Search configuration files based on cloud APIs and JSON rules.                  | config from cloud.resource where    | Config                              |
| [Application Asset](https://github.com/PaloAltoNetworks/pc-docs-md/tree/main/enterprise-edition/content-collections/search-and-investigate/application-asset-queries/application-asset-queries.md) (AppSec) | Simple              | Explore your software delivery chains and engineering attack surfaces.          | Not applicable                      | None                                |
| [Vulnerability](https://github.com/PaloAltoNetworks/pc-docs-md/tree/main/enterprise-edition/content-collections/search-and-investigate/vulnerability-queries/vulnerability-queries.md)                      | Simple              | Explore top vulnerabilities discovered in your environment.                     | Not applicable                      | Workload Vulnerability              |
| [Application](https://github.com/PaloAltoNetworks/pc-docs-md/tree/main/enterprise-edition/content-collections/search-and-investigate/application-queries/application-queries.md)                            | Simple              | Explore security risks in the context of your application.                      | Not applicable                      | None                                |
| [Permissions](https://github.com/PaloAltoNetworks/pc-docs-md/tree/main/enterprise-edition/content-collections/search-and-investigate/permissions-queries/permissions-queries.md) (IAM)                      | Advanced            | View net resource permissions based on ingested IAM policies.                   | config from iam where               | IAM                                 |
| [Network Configuration](/content-collections/search-and-investigate/network-queries/network-config-queries.md) (CNS)                                                                                        | Advanced            | Explore network paths and identify assets exposed to the internet.              | config from network where           | Network                             |
| [Network](/content-collections/search-and-investigate/network-queries/network-flow-queries.md)                                                                                                              | Advanced            | Explore network flow logs for incidents and threat detection and investigation. | network from vpc.flow\_record where | Network                             |
| [Audit Event](https://github.com/PaloAltoNetworks/pc-docs-md/tree/main/enterprise-edition/content-collections/search-and-investigate/audit-event-queries/audit-event-queries.md)                            | Advanced            | Explore audit logs for investigation and forensics.                             | event from cloud.audit\_logs where  | Audit Event                         |

The above query types are supported on all Prisma Cloud tenants and all Prisma Cloud [Out of the Box](https://docs.prismacloud.io/en/enterprise-edition/content-collections/administration/prisma-cloud-admin-permissions#roles-all) (OOTB) roles, for example System Admins have permissions to all of these query types.

The supported query types for **Custom** roles are listed under **Settings > Access Control > Permission Group > Add Permission Group**. The **Custom** roles (as defined by granular RBAC features) only support the following query types:

* Asset
* Asset Configuration
* Audit Event
* Permissions
* Network
* Network Configuration

The Application Asset, Vulnerability, and Application query types are out of scope for granular RBAC and not supported for **Custom** roles.

The query types that you see in the Prisma Cloud UI not only depend on the roles and permissions, but also if a feature (module) is enabled on the tenant or not.

| **Query Type**               | **License and Module**                                                                                | **Stack**                     | **Permissions Required**                                                                                                                                                                                  |
| ---------------------------- | ----------------------------------------------------------------------------------------------------- | ----------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Asset                        | Not applicable                                                                                        | All except app.gov and app.cn | Investigate > Asset > READ                                                                                                                                                                                |
| Asset Configuration (Config) | Not applicable                                                                                        | All                           | Investigate > Config > READ                                                                                                                                                                               |
| Application Asset (AppSec)   | Only available for Enterprise License                                                                 | All except app.gov and app.cn | Default System Admins                                                                                                                                                                                     |
| Vulnerability                | Only available for Enterprise License                                                                 | All except app.gov and app.cn | <p>Only available for the following OOTB roles:</p><ul><li>System Admin</li><li>Account Group Admin</li><li>Account and Cloud Provisioning Admin</li><li>Account Group Read Only</li><li>Appsec</li></ul> |
| Application                  | Only available for Enterprise License                                                                 | All except app.gov and app.cn | Investigate > Application > READ                                                                                                                                                                          |
| Permissions (IAM)            | Only available for Enterprise License and IAM module should be provisioned and enabled for the tenant | All except app.cn             | Investigate > Config > READ                                                                                                                                                                               |
| Network Configuration (CNS)  | Not applicable                                                                                        | All                           | <ul><li>Investigate > Config > READ, and</li><li>Investigate > Network > READ</li></ul>                                                                                                                   |
| Network                      | Only available for Enterprise License                                                                 | All                           | Investigate > Network > READ                                                                                                                                                                              |
| Audit Event                  | Not applicable                                                                                        | All                           | Investigate > Audit Events > READ                                                                                                                                                                         |


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.prismacloud.io/content-collections/search-and-investigate/query-types.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.