PSE-Prisma Cloud

The required RQL filter must select VPC flow records whose source is either a suspicious IP or an internet IP and whose destination resource has either the AWS RDS or Database role. The source.publicnetwork filter identifies the specified external sources, while the destination-resource role filter limits results to AWS database targets.