PSE-Prisma Cloud

By Palo Alto Networks · Question Mode

QuestionQ18

VerifiedInvestigating Security Issues with RQL

Which Resource Query Language (RQL) string, using network query attributes, returns all traffic destined for Internet or Suspicious IPs that also exceeds 1 GB?

Explanation

Prisma Cloud network-flow RQL uses dest.publicnetwork IN ('Internet IPs', 'Suspicious IPs') to filter traffic whose destination is one of those predefined public-network groups. Combining it with bytes > 1000000000 returns only flows exceeding 1 GB.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!