PSE-Prisma Cloud

By Palo Alto Networks · Question Mode

QuestionQ31

VerifiedMonitoring of Public Cloud

A Prisma Cloud Administrator must create a custom policy that notifies the InfoSec team whenever a configuration change is made to a Security group.

Which type of Resource Query Language (RQL) query should this policy use?

Explanation

An audit-event RQL query uses event from cloud.audit_logs to detect cloud activity such as create or update operations. A Security group configuration change is an update event, so this query type supports notification each time that change occurs.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!