PCCSE · Question #249
Which RQL query is used to detect certain high-risk activities executed by a root user in AWS?
The correct answer is A. event from cloud.audit_logs where operation IN ( 'ChangePassword', 'ConsoleLogin'. Prisma Cloud RQL uses 'event from cloud.audit_logs' to query audit log events; filtering on specific operations and user identity is done via the WHERE clause using supported field names.
Question
Which RQL query is used to detect certain high-risk activities executed by a root user in AWS?
Options
- Aevent from cloud.audit_logs where operation IN ( 'ChangePassword', 'ConsoleLogin',
- Bevent from cloud.security_logs where operation IN ( 'ChangePassword', 'ConsoleLogin',
- Cconfig from cloud.audit_logs where operation IN ( 'ChangePassword', 'ConsoleLogin',
- Devent from cloud.audit_logs where Risk.Level = 'high' AND user = 'root'
How the community answered
(29 responses)- A86% (25)
- B3% (1)
- C3% (1)
- D7% (2)
Why each option
Prisma Cloud RQL uses 'event from cloud.audit_logs' to query audit log events; filtering on specific operations and user identity is done via the WHERE clause using supported field names.
The correct RQL syntax for querying audit log events is 'event from cloud.audit_logs', which targets the audit event data source. Filtering by specific operations such as 'ChangePassword' and 'ConsoleLogin' combined with a user identity condition (e.g., user = 'root') is the proper way to scope detection to high-risk root activity. This syntax aligns with Prisma Cloud's documented RQL event query structure.
'cloud.security_logs' is not a valid RQL data source for audit events; the correct source for cloud audit activity is 'cloud.audit_logs'.
The 'config from' prefix is reserved for configuration-state queries, not real-time or historical event queries, making it syntactically invalid for this use case.
'Risk.Level' and 'user = root' are not valid RQL field names for audit log event queries; Prisma Cloud does not expose a Risk.Level field in the cloud.audit_logs schema.
Concept tested: Prisma Cloud RQL event query syntax for audit logs
Source: https://docs.prismacloud.io/en/enterprise-edition/content-collections/search-and-investigate/audit-event-queries/audit-event-query-attributes
Topics
Community Discussion
No community discussion yet for this question.