> For the complete documentation index, see [llms.txt](https://docs.prismacloud.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.prismacloud.io/content-collections/search-and-investigate/rql-operators.md).

# RQL Operators

A list of operators supported by the resource query language (RQL) that enables you to modify the results.

An operator in RQL is one or more symbols or words that compare the value of a field on its left with one or more values on its right, such that only valid results are retrieved and displayed to you. You can use an RQL operator to find a specific term included as a value within an object or an array within a JSON structure.

You can use the following operators and conditions to compare or validate results:

* [Operators Within JSON Arrays](#id26f56de7-623a-4850-808e-80c4476166d5)
* [Config and Event Operators](#idd0bd13f8-7505-4290-ad05-163362024aec)
* [Joins](#id864e6358-0dae-48f6-bf3e-16d88f85a41b)
* [Functions](#idf1090750-00ce-4a0e-adb1-609033551ce5)

## Operators Within JSON Arrays

<table data-header-hidden><thead><tr><th></th><th></th><th></th></tr></thead><tbody><tr><td>OPERATOR</td><td>DESCRIPTION</td><td>RQL EXAMPLE</td></tr><tr><td>?any</td><td><p>?any is an expression used to filter arrays.</p><p>It is used to specify conditions to return results when <strong>any</strong> single one of the array elements satisfy them.</p></td><td><pre><code>config from cloud.resource where api.name= 'azure-network-nsg-list' AND json.rule = securityRules[?any(access equals Allow and direction equals Inbound and sourceAddressPrefix equals Internet and (protocol equals Udp or protocol equals *) and destinationPortRange contains _Port.inRange(137,137) )] exists
</code></pre></td></tr><tr><td>?none</td><td><p>?none is an expression used to filter arrays.</p><p>It is used to specify conditions to return results when <strong>none</strong> one of the array elements are satisfied.</p></td><td><pre><code>config from cloud.resource where api.name = 'aws-ec2-describe-security-groups' AND json.rule = ipPermissions[?none(toPort is member of (10,220,250))] exists
</code></pre></td></tr><tr><td>?all</td><td><p>?all is an expression used to filter arrays.</p><p>It is used to specify conditions to return results when <strong>all</strong> of the array elements satisfy them.</p></td><td><pre><code>config from cloud.resource where api.name = 'aws-ec2-describe-network-acls' AND json.rule = entries[?all(egress is true and ruleAction contains deny)] exists
</code></pre></td></tr><tr><td>@ and ?</td><td><p>@ and ? are expressions used to filter arrays.</p><ul><li>? opens the array.</li><li>@ represents the current item being processed. It is used to hone in on a particular block in the json object so that you are only matching that block and no others.</li></ul></td><td><pre><code>config from cloud.resource where api.name='aws-ec2-describe-security-groups' AND json.rule='ipPermissions[?(@.fromPort==0)].ipRanges[*] contains 0.0.0.0/0'
</code></pre></td></tr><tr><td><code>&#x26;&#x26;</code> and <code>||</code></td><td>Combine conditions within json.rule using <code>&#x26;&#x26;</code> and <code>||</code>.</td><td><pre><code>config from cloud.resource where api.name = 'aws-s3api-get-bucket-acl' and json.rule = "policy.Statement exists and policy.Statement[?(@.Action=='s3:GetObject' &#x26;&#x26; @.Effect=='Allow' || @.Action=='s3:ListBucket' &#x26;&#x26;  @.Effect=='Allow')].Principal contains *"
</code></pre></td></tr></tbody></table>

## Config and Event Operators

<table data-header-hidden><thead><tr><th></th><th></th><th></th></tr></thead><tbody><tr><td>OPERATOR</td><td>DESCRIPTION</td><td>RQL EXAMPLE</td></tr><tr><td>greater than</td><td>Compares a path on the left-hand side against either a numeric value or another path on the right-hand side.</td><td><pre><code>config from cloud.resource where api.name = 'aws-iam-get-account-password-policy' AND json.rule =  maxPasswordAge greater than 20
</code></pre></td></tr><tr><td>less than</td><td>Compares a path on the left-hand side against either a numeric value or another path on the right-hand side.</td><td><pre><code>config from cloud.resource where api.name = 'aws-iam-get-account-password-policy' AND json.rule =  maxPasswordAge less than 100
</code></pre></td></tr><tr><td>equals</td><td>Compares a path on the left-hand side against either a numeric value or another path on the right-hand side.</td><td><pre><code>config from cloud.resource where api.name = 'aws-iam-get-account-password-policy' AND json.rule =  maxPasswordAge equals 90
</code></pre></td></tr><tr><td>does not equal</td><td>Compares a path on the left-hand side against either a numeric value or another path on the right-hand side.</td><td><pre><code>config from cloud.resource where api.name = 'aws-iam-get-account-password-policy' AND json.rule = maxPasswordAge does not equal 90
</code></pre></td></tr><tr><td>equal ignore case</td><td><p>Compares a path on the left-hand side against either a string or value or another path on the right-hand side.</p><p>The <strong>equal ignore case</strong> operator works exactly the same as <strong>equals</strong>, with the only difference that it disregards case sensitivity in the string match.</p></td><td><pre><code>config from cloud.resource where cloud.account = 'AWS_prod' AND api.name = 'aws-ec2-describe-security-groups' AND json.rule = groupName equal ignore case RQL-auto-SG1
</code></pre></td></tr><tr><td>does not equal ignore case</td><td>Compares a path on the left-hand side against either a string or value or another path on the right-hand side.</td><td></td></tr><tr><td>starts with</td><td>The left-hand side must be a path with a string value.</td><td><pre><code>config from cloud.resource where api.name = 'aws-iam-list-users' and json.rule = userName starts with y
</code></pre></td></tr><tr><td>does not start with</td><td>The left-hand side must be a path with a string value.</td><td><pre><code>config from cloud.resource where api.name = 'aws-iam-list-users' and json.rule = userName does not start with y
</code></pre></td></tr><tr><td>ends with</td><td>The left-hand side must be a path with a string value.</td><td><pre><code>config from cloud.resource where api.name = 'aws-iam-list-users' and json.rule = userName ends with i
</code></pre></td></tr><tr><td>does not end with</td><td>The left-hand side must be a path with a string value.</td><td><pre><code>config from cloud.resource where api.name = 'aws-iam-list-users' and json.rule = userName does not end with i
</code></pre></td></tr><tr><td>contains</td><td>The left-hand side may be a single path or a set of paths with numeric or string value.</td><td><pre><code>config from cloud.resource where api.name = 'azure-network-nsg-list' AND json.rule = defaultSecurityRules[*].direction contains outbound
</code></pre></td></tr><tr><td>does not contain</td><td>The left-hand side may be a single path or a set of paths with numeric or string value.</td><td><pre><code>config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-vm-list' AND json.rule = powerState does not contain allocated
</code></pre></td></tr><tr><td>is empty</td><td>The left-hand side must be a path leading to a string value.</td><td><pre><code>config from cloud.resource where api.name = 'aws-ec2-describe-instances' and json.rule = publicIpAddress is empty
</code></pre></td></tr><tr><td>is not empty</td><td>The left-hand side must be a path leading to a string value.</td><td><pre><code>config from cloud.resource where api.name = 'aws-ec2-describe-instances' and json.rule = publicIpAddress is not empty
</code></pre></td></tr><tr><td>exists</td><td>The left-hand side must be a path.</td><td><pre><code>config from cloud.resource where api.name = 'aws-ec2-describe-network-interfaces' AND json.rule = 'association.publicIp exists'
</code></pre></td></tr><tr><td>does not exist</td><td>The left-hand side must be a path.</td><td><pre><code>config from cloud.resource where cloud.type = 'gcp' AND cloud.service = 'Compute Engine' and api.name = 'gcloud-compute-instances-list' AND json.rule = metadata.kind does not exist
</code></pre></td></tr><tr><td>any start with</td><td>The left-hand side must be a set of paths leading to string values.</td><td><pre><code>config from cloud.resource where api.name = 'aws-ec2-describe-instances' AND json.rule = networkInterfaces[*].vpcId any start with vpc-3
</code></pre></td></tr><tr><td>none start with</td><td>The left-hand side must be a set of paths leading to string values.</td><td><pre><code>config from cloud.resource where api.name = 'aws-ec2-describe-instances' AND json.rule = networkInterfaces[*].vpcId none start with vpc-323cda
</code></pre></td></tr><tr><td>all start with</td><td>The left-hand side must be a set of paths leading to string values.</td><td><pre><code>config from cloud.resource where api.name = 'aws-ec2-describe-instances' AND json.rule = networkInterfaces[*].vpcId all start with vpc-323cda
</code></pre></td></tr><tr><td>any end with</td><td>The left-hand side must be a set of paths leading to string values.</td><td><pre><code>config from cloud.resource where api.name = 'aws-ec2-describe-instances' AND json.rule = networkInterfaces[*].vpcId any end with 49
</code></pre></td></tr><tr><td>none end with</td><td>The left-hand side must be a set of paths leading to string values.</td><td><pre><code>config from cloud.resource where api.name = 'aws-ec2-describe-instances' AND json.rule = networkInterfaces[*].vpcId none end with 49
</code></pre></td></tr><tr><td>all end with</td><td>The left-hand side must be a set of paths leading to string values.</td><td><pre><code>config from cloud.resource where api.name = 'aws-ec2-describe-instances' AND json.rule = networkInterfaces[*].vpcId all end with 49
</code></pre></td></tr><tr><td>any equal</td><td>The left-hand side must be a set of paths leading to string or numeric values.</td><td><pre><code>config from cloud.resource where api.name = 'aws-ec2-describe-instances' AND json.rule = networkInterfaces[*].vpcId any equal vpc-323cda49
</code></pre></td></tr><tr><td>none equal</td><td>The left-hand side must be a set of paths leading to string or numeric values.</td><td><pre><code>config from cloud.resource where api.name = 'aws-ec2-describe-instances' AND json.rule = networkInterfaces[*].vpcId none equal vpc-323cda49
</code></pre></td></tr><tr><td>all equal</td><td>The left-hand side must be a set of paths leading to string or numeric values.</td><td><pre><code>config from cloud.resource where api.name = 'aws-ec2-describe-instances' AND json.rule = networkInterfaces[*].vpcId all equal vpc-323cda49
</code></pre></td></tr><tr><td>any empty</td><td>The left-hand side must be a set of paths leading to string values.</td><td><pre><code>config from cloud.resource where api.name = 'aws-ec2-describe-instances' AND json.rule = networkInterfaces[*].vpcId any empty
</code></pre></td></tr><tr><td>none empty</td><td>The left-hand side must be a set of paths leading to string values.</td><td><pre><code>config from cloud.resource where api.name = 'aws-ec2-describe-instances' AND json.rule = networkInterfaces[*].vpcId none empty
</code></pre></td></tr><tr><td>all empty</td><td>The left-hand side must be a set of paths leading to string values.</td><td><pre><code>config from cloud.resource where api.name = 'aws-ec2-describe-instances' AND json.rule = networkInterfaces[*].vpcId all empty
</code></pre></td></tr><tr><td>IN (</td><td>The left-hand side must be a string.</td><td><pre><code>event from cloud.audit_logs where crud IN ( 'create' , 'update' ) AND has.anomaly
</code></pre></td></tr><tr><td>NOT IN (</td><td>The left-hand side must be a string.</td><td><pre><code>config from cloud.resource where finding.severity NOT IN ( 'low', 'informational', 'medium' ) AND cloud.account IN ( 'account_name' )
</code></pre></td></tr><tr><td>size equals</td><td><p>The left-hand side must be an array.</p><p>The right-hand side must be an integer.</p></td><td><pre><code>config from cloud.resource where api.name = 'aws-ec2-describe-instances' AND json.rule = tags[*] size equals 0
</code></pre></td></tr><tr><td>size does not equal</td><td><p>The left-hand side must be an array.</p><p>The right-hand side must be an integer.</p></td><td><pre><code>config from cloud.resource where api.name = 'aws-ec2-describe-instances' AND json.rule = tags[*] size does not equal 0
</code></pre></td></tr><tr><td>size greater than</td><td><p>The left-hand side must be an array.</p><p>The right-hand side must be an integer.</p></td><td><pre><code>config from cloud.resource where api.name = 'aws-ec2-describe-instances' AND json.rule = tags[*] size greater than 1
</code></pre></td></tr><tr><td>size less than</td><td><p>The left-hand side must be an array.</p><p>The right-hand side must be an integer.</p></td><td><pre><code>config from cloud.resource where api.name = 'aws-ec2-describe-instances' AND json.rule = tags[*] size less than 1
</code></pre></td></tr><tr><td>length equals</td><td><p>The left-hand side is a path with a string value.</p><p>The right-hand side must be an integer.</p></td><td><pre><code>config from cloud.resource where api.name = 'aws-rds-describe-db-snapshots' AND json.rule = snapshot.storageType length equals 3
</code></pre></td></tr><tr><td>length does not equal</td><td><p>The left-hand side is a path with a string value.</p><p>The right-hand side must be an integer.</p></td><td><pre><code>config from cloud.resource where api.name = 'aws-rds-describe-db-snapshots' AND json.rule = snapshot.storageType length does not equal 3
</code></pre></td></tr><tr><td>length greater than</td><td><p>The left-hand side is a path with a string value.</p><p>The right-hand side must be an integer.</p></td><td><pre><code>config from cloud.resource where api.name = 'aws-rds-describe-db-snapshots' AND json.rule = snapshot.storageType length greater than 3
</code></pre></td></tr><tr><td>length less than</td><td><p>The left-hand side is a path with a string value.</p><p>The right-hand side must be an integer.</p></td><td><pre><code>config from cloud.resource where api.name = 'aws-rds-describe-db-snapshots' and json.rule = snapshot.storageType length less than 4
</code></pre></td></tr><tr><td>number of words equals</td><td>The left-hand side is a path with a string value.</td><td><pre><code>config from cloud.resource where cloud.type = 'gcp' AND cloud.service = 'Compute Engine' and api.name = 'gcloud-compute-instances-list' AND json.rule = cpuPlatform number of words equals 3
</code></pre></td></tr><tr><td>number of words does not equal</td><td>The left-hand side is a path with a string value.</td><td><pre><code>config from cloud.resource where cloud.type = 'gcp' AND cloud.service = 'Compute Engine' and api.name = 'gcloud-compute-instances-list' AND json.rule = cpuPlatform number of words does not equal 3
</code></pre></td></tr><tr><td>number of words greater than</td><td>The left-hand side is a path with a string value.</td><td><pre><code>config from cloud.resource where cloud.type = 'gcp' AND cloud.service = 'Compute Engine' and api.name = 'gcloud-compute-instances-list' AND json.rule = cpuPlatform number of words greater than 2
</code></pre></td></tr><tr><td>number of words less than</td><td>The left-hand side is a path with a string value.</td><td><pre><code>config from cloud.resource where cloud.type = 'gcp' AND cloud.service = 'Compute Engine' and api.name = 'gcloud-compute-instances-list' AND json.rule = cpuPlatform number of words less than 3
</code></pre></td></tr><tr><td>any true</td><td>The left-hand side is a set of paths with Boolean values.</td><td><pre><code>config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-network-nic-list' AND json.rule = " ['properties.ipConfigurations'][*].['properties.primary'] any true "
</code></pre></td></tr><tr><td>none true</td><td>The left-hand side is a set of paths with Boolean values.</td><td><pre><code>config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-network-nic-list' AND json.rule = " ['properties.ipConfigurations'][*].['properties.primary'] none true"
</code></pre></td></tr><tr><td>all true</td><td>The left-hand side is a set of paths with Boolean values.</td><td><pre><code>config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-network-nic-list' AND json.rule = " ['properties.ipConfigurations'][*].['properties.primary'] all true
</code></pre></td></tr><tr><td>any false</td><td>The left-hand side is a set of paths with Boolean values.</td><td><pre><code>config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-network-nic-list' AND json.rule = " ['properties.ipConfigurations'][*].['properties.primary'] any false"
</code></pre></td></tr><tr><td>none false</td><td>The left-hand side is a set of paths with Boolean values.</td><td><pre><code>config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-network-nic-list' AND json.rule = " ['properties.ipConfigurations'][*].['properties.primary'] none false"
</code></pre></td></tr><tr><td>all false</td><td>The left-hand side is a set of paths with Boolean values.</td><td><pre><code>config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-network-nic-list' AND json.rule = " ['properties.ipConfigurations'][*].['properties.primary'] all false"
</code></pre></td></tr><tr><td>is true</td><td>The left-hand side is a path with Boolean value.</td><td><pre><code>config from cloud.resource where api.name = 'azure-storage-account-list' AND json.rule = encryptionStatuses.Blob is true
</code></pre></td></tr><tr><td>is false</td><td>The left-hand side is a path with Boolean value.</td><td><pre><code>config from cloud.resource where api.name = 'azure-storage-account-list' AND json.rule = encryptionStatuses.Blob is false
</code></pre></td></tr><tr><td>is not member of</td><td>The left-hand side is a path with string value, and the right-hand side is a set of values in parentheses and separated with commas.</td><td><pre><code>config from cloud.resource where api.name = 'aws-ec2-describe-security-groups' AND json.rule = ipPermissions[*].toPort exists and ipPermissions[*].fromPort is not member of (22)
</code></pre></td></tr><tr><td>is member of</td><td>The left-hand side is a path with string value, and the right-hand side is a set of values in parentheses and separated with commas.</td><td><pre><code>config from cloud.resource where api.name = 'aws-ec2-describe-security-groups' AND json.rule = ipPermissions[*].toPort exists and ipPermissions[*].toPort is member of (3389,22,5432)
</code></pre><pre><code>config from cloud.resource where api.name = 'aws-ec2-describe-security-groups' AND json.rule = ipPermissions[*].ipProtocol exists and  ipPermissions[*].ipProtocol is member of (tcp)
</code></pre></td></tr><tr><td><p>matches</p><p>does not match</p></td><td><p>For Event queries, use the boolean operators <code>matches</code> and <code>does not match</code> to match or exclude field values against simple patterns and not full regex.</p><p>Patterns can have substrings and <code>*</code> for wild character search.</p><p>Use the <code>matches</code> or <code>does not match</code> operator instead of <code>contains/does not contain</code> or <code>exists/does not exist</code> operators.</p></td><td><p>In the following example, the value 'c*login' enables you to list activities that match <code>clogin</code> , <code>cloudlogin</code> , or <code>consolelogin</code> .</p><pre><code>event from cloud.audit_logs where cloud.type = 'aws' AND cloud.account = 'RedLock Sandbox' AND operation matches 'c*login'
</code></pre></td></tr><tr><td><p>intersects</p><p>does not intersect</p></td><td><p>Checks if there are common elements between any two lists.</p><p>Both the left-hand and right-hand sides can be a path with a string or array, a string or IP address/CIDR block, a set of values in parentheses and separated with commas, or a function such as, <code>_Port.inRange()</code> .</p></td><td><p>The following example shows the <code>_IPAddress.inRange</code> function using the <strong>does not intersect</strong> operator:</p><pre><code>config from cloud.resource where api.name = 'azure-sql-server-list' AND json.rule = firewallRules size > 0 and ((firewallRules[*].endIpAddress does not intersect _IPAddress.inRange("190.100.0.0",100,130) and firewallRules[*].endIpAddress does not intersect (52.31.43.92, 56.75.42.16, 96.15.20.13)))
</code></pre></td></tr><tr><td>like</td><td><p>Checks if the wildcard character (*) is used to grant access permissions at the account level on your cloud service provider. For example, you can check for wildcard permissions granted to delete all EC2 instances in every account.</p><p>The left-hand side is a path with string value, and the right-hand side is the name of a cloud account.</p><p>The <code>like</code> operator is currently only supported for <code>iam</code> queries; see <a href="https://github.com/PaloAltoNetworks/pc-docs-md/tree/main/enterprise-edition/content-collections/search-and-investigate/iam-query/iam-query-attributes.xml#idd31fd7aa-bbe1-4353-b872-d89d688dfc45">IAM Query Attributes</a>.</p></td><td><pre><code>config from iam where dest.cloud.account LIKE 'account-dev-3'
</code></pre></td></tr></tbody></table>

## Joins

Joins allow you to get data from two different APIs where you have combined different conditions. You can use Joins only across `config from cloud.resource where` queries, and can include up to three configuration API resources with alias X, Y and Z, and you can optionally include a json.rule to match within the API resource alias. When you use the json.rule, joins across event, network, and config are not supported.

Nested Rules using the `?any` quantifier limit the conditions you write on the elements of an array. For RQL policies that use nested rules, you can add a condition referencing an external JSON path inside the nested rule. This is useful when a Join operator is expressed among two different paths in a JSON specimen, which requires the nested rules to check on values outside the scope of the quantifier. In addition, when a Join is expressed among two different paths in a JSON specimen, which requires the nested rules to check on values outside the scope of the quantifier.

Use resource specific conditions inside json.rule of the alias and use the filter option only for comparison using operators ==, !=, contains, does not contains, not (negation).

**Join basic syntax:**

```
config from cloud.resource where api.name = 'a' and json.rule = 'r' as X; config from cloud.resource where api.name ='b' and json.rule ='r2' as Y; show (X;|Y;)

config from cloud.resource where api.name=".." as X; config from cloud.resource where api.name="..." as Y; filter "$.X... <operator> $.Y"; show (X;|Y;)
```

To find EC2 instances that have public IP addresses assigned at launch use this query:

Steps:

1. List EC2 instances that have a public IP address as X:

   ```
   config from cloud.resource where api.name = 'aws-ec2-describe-instances' and json.rule = publicIpAddress exists and publicIpAddress is not empty as X;
   ```
2. List instances that have security groups which allow unrestricted access from any source as Y:

   ```
   config from cloud.resource where api.name = 'aws-ec2-describe-security-groups' and json.rule = ipPermissions[*].ipRanges[*] contains 0.0.0.0/0 or ipPermissions[*].ipv6Ranges[*].cidrIpv6 contains ::/0 as Y;
   ```
3. Set the filter:

   ```
   filter '($.X.securityGroups[*].groupName==$.Y.groupName)'; show X;
   ```
4. Complete the query to list all EC2 instances that have a public IP address and are accessible without any source IP restrictions:

   ```
   config from cloud.resource where api.name = 'aws-ec2-describe-instances' as X; config from cloud.resource where api.name = 'aws-ec2-describe-subnets' as Y; filter '$.X.subnetId == $.Y.subnetId and $.Y.mapPublicIpOnLaunch is true'; show X;
   ```

**Examples of Joins:**

<table data-header-hidden><thead><tr><th></th><th></th></tr></thead><tbody><tr><td>DESCRIPTION</td><td>RQL EXAMPLE</td></tr><tr><td>VPCs that are connected to internet gateways.</td><td><pre><code>config from cloud.resource where api.name = 'aws-ec2-describe-internet-gateways' as X; config from cloud.resource where api.name = 'aws-ec2-describe-vpcs' as Y; filter '$.X.attachments[*].vpcId == $.Y.vpcId and $.Y.tags[*].key contains IsConnected and $.Y.tags[*].value contains true'; show Y;
</code></pre></td></tr><tr><td>CloudTrail logs that are integrated with CloudWatch for all regions.</td><td><pre><code>config from cloud.resource where api.name = 'aws-cloudtrail-describe-trails' as X; config from cloud.resource where api.name = 'aws-cloudtrail-get-trail-status' as Y; filter '$.X.cloudWatchLogsLogGroupArn != null and ($.Y.status.latestCloudWatchLogsDeliveryTime != null and _DateTime.ageInDays($.Y.status.latestCloudWatchLogsDeliveryTime) > 1) and ($.X.rrn == $.Y.rrn)'; show X;
</code></pre></td></tr><tr><td>Show all AWS Lambda functions that are accessible with the RedlockReadOnly IAM role.</td><td><pre><code>config from cloud.resource where api.name = 'aws-lambda-list-functions' AND json.rule = handler contains "lambda" as X;config from cloud.resource where api.name = 'aws-iam-list-roles' AND json.rule = role.roleName contains "RedlockReadOnlyRole" as Y;filter '($.X.role.rolename equals $.Y.role.rolename)' ; show X;
</code></pre></td></tr><tr><td>Find all EC2 instances that have a specified name, snapshot ID and image ID.</td><td><pre><code>config from cloud.resource where api.name = 'aws-ec2-describe-instances' AND json.rule = tags[*].key contains "Name"  as X; config from cloud.resource where api.name = 'aws-ec2-describe-snapshots' AND json.rule = snapshot.snapshotId contains "snap-004b0221589e516d7" as Y; config from cloud.resource where api.name = 'aws-ec2-describe-images' AND json.rule = image.imageId contains "ami-03698559b1d406e89" as Z; show X
</code></pre></td></tr><tr><td>Find Azure SQL databases where audit log retention period is less that 90 days.</td><td><pre><code>config from cloud.resource where api.name = 'azure-sql-db-list' as X; config from cloud.resource where api.name = 'azure-sql-server-list' AND json.rule = (serverBlobAuditingPolicy does not exist or serverBlobAuditingPolicy is empty or serverBlobAuditingPolicy.properties.retentionDays does not exist or (serverBlobAuditingPolicy.properties.state equals Enabled and serverBlobAuditingPolicy.properties.retentionDays does not equal 0 and serverBlobAuditingPolicy.properties.retentionDays less than 90)) as Y; filter '$.X.blobAuditPolicy.id contains $.Y.sqlServer.name'; show X;
</code></pre></td></tr><tr><td>Find where bucket ACL owner ID and grantee ID do not match and display name does not contain awslogsdelivery</td><td><pre><code>config from cloud.resource where cloud.type = 'aws' AND api.name = 'aws-s3api-get-bucket-acl' AND json.rule = acl.grants[?any( grantee.displayName exists and grantee.displayName does not contain awslogsdelivery and grantee.identifier does not contain $.acl.owner.id)] exists
</code></pre></td></tr></tbody></table>

### Cross-Account Joins

Prisma Cloud **Investigate** works differently from **Policy** when executing an RQL query specific to cloud accounts. You can facilitate cross-account comparisons from the Investigate page, but not from the Policy page. In case of cross-account JOINs, you must be careful when trying to correlate **Alert** counts with the Investigate page results.

If you do not specify the *cloud.account* parameter while running a query from Investigate, all cloud accounts will be open for JOIN. And since resources from one API in a query can potentially match with another, irrespective of the account, you can get inaccurate results. To achieve consistency with Policy (which generates alerts) and get precise results, Prisma Cloud recommends that you add the *cloud.account* parameter in your query. However, you do not need to apply the *cloud account* condition every time for JOIN RQLs. Usually, the results count on Investigate matches with that on Alerts.

For example:

* If only the first part of an RQL has corresponding resources, and the second part does not, Investigate search displays results only from the first part. These are typically false positives. Prisma Cloud will not generate alerts for these instances.
* When resources with the same name that are associated with a particular API exist across multiple cloud accounts, can also generate false positives.

Prisma Cloud recommends that you specify the cloud account for verification and help validate discrepancies.

## Functions

A function performs a calculation on specific data that matches the clause contained in the function and displays results. Functions support auto-complete when you enter the prefix `_` in a json.rule or addcolumn attribute.

Prisma Cloud supports following functions:

* [\_DateTime Examples](#id12237fdb-8312-4339-9c07-a86721f130c6)
* [\_AWSCloudAccount.isRedLockMonitored Examples](#idbafe637e-96e0-42b3-a227-a51d6045fc72)
* [\_IPAddress.inRange Examples](#idef51bf6d-59e2-420d-9dd0-21b23191c227)
* [\_Port.inRange Examples](#idb115efe2-c78f-450c-bae9-617de5668536)
* [\_IPAddress.inCIDRRange Examples](#id71d92562-6649-4057-9fdf-3ffbf4804353)
* [\_IPAddress.areAnyOutsideCIDRRange() Examples](#id584a8722-44f3-422e-9374-2991b62fe2d8)
* [\_Set Examples](#ide11cc0b6-ecfd-49eb-ae44-63b626661f14)

### \_DateTime Examples

Query time ranges are not part of RQL grammar, and the query time window is passed as a separate argument to the query APIs. The selection of the attributes or columns for a category are not part of the RQL grammar. The function accepts timestamps in the following formats only:

Zulu: "2011-08-13T20:17:46.384Z"

GSON/AWS: "Nov 7, 2016 9:34:21 AM"

ISO: "2011-12-04T10:15:30+01:00"

The query time ranges that are available are `_DateTime.ageInDays` , `_DateTime.ageInMonths` , `_DateTime.ageInYears` , and `_DateTime.daysBetween` . The `_DateTime.daysBetween` function looks for any information that falls in between two dates and takes two dates as arguments.

For example, the `_DateTime.ageInDays` returns the number of days until a date as a negative number.

* For your query to work properly, ensure RQL json.rule functions are wrapped in single quotes (\`\`). If single quotes are not added, the RQL will not be valid and cannot be executed.
* When using the \_DateTime function all json parameters are available as auto-complete options, you must select only parameters that have timestamps. The syntax for a function does not support spaces, so make sure to remove empty spaces before or after parenthesis, and also between comma-separated parameters.

<table data-header-hidden><thead><tr><th></th><th></th></tr></thead><tbody><tr><td>DESCRIPTION</td><td>RQL EXAMPLE</td></tr><tr><td>List EC2 instances with age greater than 2 days.</td><td><pre><code>config from cloud.resource where api.name = 'aws-ec2-describe-instances' AND json.rule = '_DateTime.ageInDays(launchTime) > 2'
</code></pre></td></tr><tr><td>List resource names where access keys are not rotated for 90 days.</td><td><pre><code>config from cloud.resource where api.name = 'aws-iam-get-credential-report' AND json.rule = '(access_key_1_active is true and access_key_1_last_rotated != N/A and _DateTime.ageInDays(access_key_1_last_rotated) > 90) or (access_key_2_active is true and access_key_2_last_rotated != N/A and _DateTime.ageInDays(access_key_2_last_rotated) > 90)'
</code></pre></td></tr><tr><td>Use the function today() to return the current day’s date.</td><td><pre><code>config from cloud.resource where cloud.type = 'aws' and api.name = 'aws-cloudtrail-get-trail-status' AND json.rule ="_DateTime.daysBetween($.latestDeliveryTime,today()) ! = 2"
</code></pre></td></tr></tbody></table>

### \_AWSCloudAccount.isRedLockMonitored Examples

When using this function to identify AWS accounts that are or are not monitored on Prisma Cloud, you can provide the AWS account ID in any of the following formats:

* Standard AWS 12-digit account number.

  For example: 123456789012
* Canonical user ID. You can use this ID to identify an AWS account when granting cross-account access to buckets and objects using Amazon S3.

  For example, an alpha-numeric identifier: 79a59df900b949e55d96a1e698fbacedfd6e09d98eacf8f8d5218e7cd47ef2be
* 3\. AWS account ID in ARN format.

  For example, arn:aws:iam::123456789012:role/test-1240-47

<table data-header-hidden><thead><tr><th></th><th></th></tr></thead><tbody><tr><td>DESCRIPTION</td><td>RQL EXAMPLE</td></tr><tr><td>List any snapshots that are shared publicly and are not monitored by Prisma Cloud.</td><td><pre><code>config from cloud.resource where api.name = 'aws-ec2-describe-snapshots' AND json.rule = 'createVolumePermissions[*] size != 0 and _AWSCloudAccount.isRedLockMonitored(createVolumePermissions[*].userId) is false'
</code></pre></td></tr></tbody></table>

### \_IPAddress.inRange Examples

To check if a particular IP address is part of an IP address range, use `_IPAddress.inRange` and in the argument specify the octets, along with the `<fromInteger>` , `<toInteger>` . For example ("172.%d.",16,31) or (”172.10.%d.”,10,255).

<table data-header-hidden><thead><tr><th></th><th></th></tr></thead><tbody><tr><td>DESCRIPTION</td><td>RQL EXAMPLE</td></tr><tr><td>List AWS Route53 Public Zones that have Private Records.</td><td><p>In this example, the IPAddress.inRange("172.%d.",16,31) allows you to search for IP addresses that are in the range "172.16.x.x" to "172.31.x.x":</p><pre><code>config from cloud.resource where cloud.type = 'aws' AND api.name = 'aws-route53-list-hosted-zones' AND json.rule = resourceRecordSet[*].resourceRecords[*].value any start with _IPAddress.inRange("172.%d.",16,31)
</code></pre></td></tr></tbody></table>

### \_Port.inRange Examples

To check if a particular port number is part of a specific range, use class `Port` and method `inRange` . This method takes three arguments `<fromInteger>` , `<toInteger>` , and you can optionally include an `<offset>`.

By default, the \<offset> is 1.

<table data-header-hidden><thead><tr><th></th><th></th></tr></thead><tbody><tr><td>DESCRIPTION</td><td>RQL EXAMPLE</td></tr><tr><td><p>Use the <code>inRange</code> function with the <code>contains</code> and <code>does not contain</code> operators to check for conditions on a port range.</p><p>Specify <code>&#x3C;fromInteger></code> and <code>&#x3C;toInteger></code> to find all ports within the specified range.</p></td><td><p>Example using <code>contains</code> to check for ports numbers between 22 and 33 with an offset of 1:</p><pre><code>config from cloud.resource where api.name = 'aws-ec2-describe-security-groups' AND json.rule = ipPermissions[*].toPort exists and ipPermissions[*].toPort contains _Port.inRange(22,33,1)
</code></pre><p>The example above checks for all ports between 22 and 33.</p></td></tr><tr><td></td><td><p>Example using <code>Does not Contain</code> :</p><pre><code>config from cloud.resource where api.name = 'azure-network-nsg-list' AND json.rule = securityRules[*].sourcePortRanges[*] does not contain _Port.inRange(350,5400,5)
</code></pre><p>The example above checks for ports 350, 355, 360, …​..5390, 5395, 5600.</p></td></tr><tr><td></td><td><p>Example using no offset, to find all ports within the specified range:</p><pre><code>config from cloud.resource where api.name = 'aws-ec2-describe-security-groups' AND json.rule = ipPermissions[*].toPort exists and ipPermissions[*].toPort contains _Port.inRange(400,500)
</code></pre></td></tr></tbody></table>

### \_IPAddress.inCIDRRange Examples

To check if a specific IPv4 or IPv6 address or subnet is a part of a specific CIDR block or supernetwork, use the `_IPAddress.inCIDRRange` function. This function takes two arguments, the first is the CIDR address or array of CIDR addresses extracted from the JSON payload where you must specify whether it is an `ipv4Ranges` or an `ipv6Ranges` and the second is the CIDR block (either IPv4 or IPv6) `cidrIp` or `cidripv6` followed by the IP address that you want to match on.The result returns the resources that contain the IP addresses in the JSON payload that fall within the CIDR range you entered, in the case when it is true, and the resources that do not match when it is false.

<table data-header-hidden><thead><tr><th></th><th></th></tr></thead><tbody><tr><td>DESCRIPTION</td><td>RQL EXAMPLE</td></tr><tr><td>Define multiple CIDR blocks that you want to match on.</td><td><pre><code>config from cloud.resource where api.name = 'aws-ec2-describe-security-groups' AND json.rule = '_IPAddress.inCIDRRange($.ipPermissions[*].ipv4Ranges[*].cidrIp,10.0.0.0/8) is false and _IPAddress.inCIDRRange($.ipPermissions[*].ipv4Ranges[*].cidrIp,172.31.0.0/12) is false and _IPAddress.inCIDRRange($.ipPermissions[*].ipv4Ranges[*].cidrIp,192.168.0.0/16) is true'
</code></pre></td></tr><tr><td>Find an IPv6 address within a CIDR block.</td><td><pre><code>config from cloud.resource where api.name = 'aws-ec2-describe-security-groups' AND json.rule = '_IPAddress.inCIDRRange($.ipPermissions[*].ipv6Ranges[*].cidrIpv6,2600:1f18:226b:62fa:ffff:ffff:ffff:ffff/24) is true'
</code></pre></td></tr><tr><td>Specify multiple match conditions to find all CIDRs within the JSON metadata.</td><td><pre><code>config from cloud.resource where api.name = 'aws-ec2-describe-security-groups' AND json.rule = 'ipPermissions[*].ipv4Ranges[*].cidrIp does not contain "0.0.0.0/0" and ipPermissions[*].ipv4Ranges[*].cidrIp size does not equal 0 and _IPAddress.inCIDRRange(ipPermissions[*].ipv4Ranges[*].cidrIp,192.168.0.0/16) is true'
</code></pre></td></tr></tbody></table>

### \_IPAddress.areAllInCIDRRange() Examples

The `_IPAddress.areAllInCIDRRange(Resource, CIDR)` function checks to see if all of the IP addresses assigned to a resource are within a specified CIDR block. The result of executing the function will be a boolean. For example, if you had the question “Do my databases have all IP addresses in the 10.0.0.0./24 IP range,” the answer will be yes or no. The function accepts two arguments which are `Resource` and `CIDR` .

`Resource` describes meta data within the configuration file that contains the IP address(es), and `CIDR` represents the value of the CIDR block that you define.

<table data-header-hidden><thead><tr><th></th><th></th></tr></thead><tbody><tr><td>Description</td><td>Example</td></tr><tr><td>Find all resources that contain CIDR addresses within the 10.0.0.0/8 range.</td><td><pre><code>config from cloud.resource where cloud.type = 'aws' AND api.name = 'aws-ec2-describe-security-groups' AND json.rule = ipPermissions[*].ipv4Ranges[*] size greater than 0 and _IPAddress.areAllInCIDRRange($.ipPermissions[*].ipv4Ranges[*].cidrIp,10.0.0.0/8) is true
</code></pre></td></tr><tr><td>Find all IP addresses that fall within the a specified range.</td><td><pre><code>config from cloud.resource where cloud.type = 'aws' AND api.name = 'aws-ec2-describe-security-groups' AND json.rule = ipPermissions[*].ipv6Ranges[*] size greater than 0 and _IPAddress.areAllInCIDRRange($.ipPermissions[*].ipv6Ranges[*].cidrIp,fc00::/7) is true
</code></pre></td></tr><tr><td>Find all the IPv6 addresses within the CIDR block.</td><td><pre><code>config from cloud.resource where api.name = 'aws-ec2-describe-security-groups' AND json.rule = _IPAddress.areAllInCIDRRange(ipPermissions[*].ipv6Ranges[*].cidrIpv6,2600:1f18:226b:6200::/1) is true
</code></pre></td></tr></tbody></table>

### \_IPAddress.areAnyOutsideCIDRRange() Examples

The `_IPAddress.areAnyOutsideCIDRRange()` function enables you to write config RQL queries that check if any IP/CIDR addresses are outside of a given list of permitted CIDR blocks. You can use this function to check if any resources have exposure to IP addresses outside of the RFC 1918 private CIDR blocks.

The first argument is a JSON expression that evaluates against one or more IP/CIDR addresses. The second and subsequent arguments list the IP/CIDR addresses and/or ranges to test against. You can use IPV4 and IPV6 address formats. However, the two function arguments should be either both in IPV4 or both in IPV6.

<table data-header-hidden><thead><tr><th></th><th></th></tr></thead><tbody><tr><td>Description</td><td>Example</td></tr><tr><td>Check a valid IP against an invalid range to indicate the IP is outside of the range. If the address is not a valid IP or CIDR it is not considered to be a match.</td><td><pre><code>_IPAddress.areAnyOutsideCIDRRange(ipPermissions[*].ipv4Ranges[*].cidrIp,192.0.0.0/24,172.31.0.0/16)
</code></pre></td></tr></tbody></table>

### \_Set Examples

The `_Set` function enables you to compare the values between lists on the Left Hand Side and Right Hand Side using the properties of union or intersection, and identify whether a specific value or comma separated list of values are included within that result set. The methods supported are `_Set.intersection`, `_Set.union`, and `Set_isSubset`. For \[\_Set.intersection], `_Set.union`, you can use the boolean operators `intersects` and `contains` to verify whether the values you want to look for are included in the result or if the result set contains the specified value(s).

For `Set_isSubset`, enables you to identify whether a specific value or comma separated list of values returned by the JSON path of the resource is fully contained within the target list. The syntax is: \`Set.isSubset(\<path>, \<targelist>) is \[ true | false \`] where \<path> = JSON path

\<target\_list> = a set of strings without any whitespace within. For example, neither use of whitepace is valid: \_Set.isSubset(\<path>, (a, "b1 b2",c)) where there are spaces within the second string, nor \_Set.isSubset(\<path>, (a, b, c)) with space between the strings in a list.

If the result dataset is huge, use `limit search records to` at the end of the query.

<table data-header-hidden><thead><tr><th></th><th></th></tr></thead><tbody><tr><td>Description</td><td>Example</td></tr><tr><td>Compare a list on the RHS [as X] with another dynamic list of items in LHS [as Y] and take the intersection ones into a subset list and then compare this against a static, comma separated list you provide.</td><td><pre><code>config from cloud.resource where api.name = 'aws-ec2-describe-instances' as X; config from cloud.resource where api.name = 'aws-ec2-describe-security-groups' as Y; config from cloud.resource where api.name = 'aws-ec2-describe-vpcs' as Z; filter '_Set.intersection($.X.vpcId,$.Y.vpcId) intersects (vpc-5b9a3c33,vpc-b8ba2dd0,vpc-b8ba2dd01)'; show X;
</code></pre></td></tr><tr><td><pre><code>config from cloud.resource where api.name = 'aws-ec2-describe-instances' as X; config from cloud.resource where api.name = 'aws-ec2-describe-security-groups' as Y; config from cloud.resource where api.name = 'aws-ec2-describe-vpcs' as Z; filter 'not _Set.intersection($.X.vpcId,$.Y.vpcId) intersects (vpc-5b9a3c33,vpc-b8ba2dd0,vpc-b8ba2dd01)'; show X; limit search records to 100
</code></pre></td><td></td></tr><tr><td>Combine two lists to include all elements of X and Y and find a match against a comma separated list you provide.</td><td><pre><code>config from cloud.resource where api.name = 'aws-ec2-describe-instances' as X; config from cloud.resource where api.name = 'aws-ec2-describe-security-groups' as Y; config from cloud.resource where api.name = 'aws-ec2-describe-vpcs' as Z; filter '_Set.union($.X.vpcId,$.Y.vpcId) intersects (vpc-5b9a3c33,vpc-b8ba2dd0,vpc-b8ba2dd01)'; show Y; limit search records to 10
</code></pre></td></tr><tr><td>Check if a result set contains a specific value.</td><td><pre><code>config from cloud.resource where api.name = 'aws-ec2-describe-instances' as X; config from cloud.resource where api.name = 'aws-ec2-describe-security-groups' as Y; config from cloud.resource where api.name = 'aws-ec2-describe-vpcs' as Z; filter '_Set.union($.X.vpcId,$.Y.vpcId) contains vpc-b8ba2dd0'; show X;
</code></pre></td></tr><tr><td>Detects Internet exposed instances with public IP and firewall rule with 0.0.0.0/0 and destination is specified target tags:</td><td><pre><code>config from cloud.resource where api.name = 'gcloud-compute-instances-list' as X; config from cloud.resource where api.name = 'gcloud-compute-firewall-rules-list' as Y; filter '$.X.networkInterfaces[*].network contains $.Y.network and $.X.networkInterfaces[*].accessConfigs[*].natIP size greater than 0 and $.Y.direction contains INGRESS and $.Y.sourceRanges[*] contains 0.0.0.0/0 and $.X.tags.items[*] intersects $.Y.targetTags[*] and $.Y.disabled contains false'; show X;
</code></pre></td></tr><tr><td>Checks that the SQS policy statement does not include the list of IP addresses specified</td><td><pre><code>config from cloud.resource where cloud.region = 'AWS Ohio' and api.name='aws-sqs-get-queue-attributes' and json.rule = QueueArn contains rql and _Set.isSubset(attributes.Policy.Statement[*].Condition.NotIpAddress.aws:SourceIp[*],(58.307.78.64/28,43.89.2.128/27,3.218.144.244,34.205.176.82,34.228.96.118,14.228.97.64/27)) is false
</code></pre></td></tr><tr><td>Checks that for the specified groupName, the IP address ranges in the path ipPermissions[<strong>].ipRanges[</strong>] are fully contained in the target list of strings</td><td><pre><code>config from cloud.resource where api.name = 'aws-ec2-describe-security-groups' AND json.rule = groupName contains rql and _Set.isSubset(ipPermissions[*].ipRanges[*],(199.167.52.5/32,34.98.203.241/32,192.168.0.0/16,10.0.0.0/24,172.31.0.0/16)) is true
</code></pre></td></tr></tbody></table>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.prismacloud.io/content-collections/search-and-investigate/rql-operators.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.