PSE-Prisma Cloud

By Palo Alto Networks · Question Mode

QuestionQ39

VerifiedInvestigating Security Issues with RQL

Which Resource Query Language (RQL) query monitors every "delete" activity for the user "user1"?

Explanation

An RQL event query must combine the delete-operation filter (crud = 'delete') with the user filter (subject = 'user1'). Adding no cloud-type constraint ensures the monitoring applies across all cloud environments.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!