Query Types and Required Permissions

Prisma Cloud supports the query types listed in the below table. You can review the query types, RQL prefixes, and RQL operators to understand and build customized queries that help you secure your environment.

Query Type	Supported Mode	Description	RQL Prefix	Policies
Asset	Simple	View your cloud assets with comprehensive security context.	Not applicable	Attack Path, Workload Vulnerability
Asset Configuration (Config)	Simple and Advanced	Search configuration files based on cloud APIs and JSON rules.	config from cloud.resource where	Config
Application Asset (AppSec)	Simple	Explore your software delivery chains and engineering attack surfaces.	Not applicable	None
Vulnerability	Simple	Explore top vulnerabilities discovered in your environment.	Not applicable	Workload Vulnerability
Application	Simple	Explore security risks in the context of your application.	Not applicable	None
Permissions (IAM)	Advanced	View net resource permissions based on ingested IAM policies.	config from iam where	IAM
Network Configuration (CNS)	Advanced	Explore network paths and identify assets exposed to the internet.	config from network where	Network
Network	Advanced	Explore network flow logs for incidents and threat detection and investigation.	network from vpc.flow_record where	Network
Audit Event	Advanced	Explore audit logs for investigation and forensics.	event from cloud.audit_logs where	Audit Event

The above query types are supported on all Prisma Cloud tenants and all Prisma Cloud Out of the Box (OOTB) roles, for example System Admins have permissions to all of these query types.

The supported query types for Custom roles are listed under Settings > Access Control > Permission Group > Add Permission Group. The Custom roles (as defined by granular RBAC features) only support the following query types:

• Asset
• Asset Configuration
• Audit Event
• Permissions
• Network
• Network Configuration

The Application Asset, Vulnerability, and Application query types are out of scope for granular RBAC and not supported for Custom roles.

The query types that you see in the Prisma Cloud UI not only depend on the roles and permissions, but also if a feature (module) is enabled on the tenant or not.

Query Type	License and Module	Stack	Permissions Required
Asset	Not applicable	All except app.gov and app.cn	Investigate > Asset > READ
Asset Configuration (Config)	Not applicable	All	Investigate > Config > READ
Application Asset (AppSec)	Only available for Enterprise License	All except app.gov and app.cn	Default System Admins
Vulnerability	Only available for Enterprise License	All except app.gov and app.cn	Only available for the following OOTB roles: System Admin Account Group Admin Account and Cloud Provisioning Admin Account Group Read Only Appsec
Application	Only available for Enterprise License	All except app.gov and app.cn	Investigate > Application > READ
Permissions (IAM)	Only available for Enterprise License and IAM module should be provisioned and enabled for the tenant	All except app.cn	Investigate > Config > READ
Network Configuration (CNS)	Not applicable	All	Investigate > Config > READ, and Investigate > Network > READ
Network	Only available for Enterprise License	All	Investigate > Network > READ
Audit Event	Not applicable	All	Investigate > Audit Events > READ