PSE-Prisma Cloud

By Palo Alto Networks · Question Mode

QuestionQ55

VerifiedInvestigating Security Issues with RQL

Which RQL query should be used to quickly identify any events related to an organization’s Google Cloud Platform BigQuery database in the last 24 hours?

Explanation

BigQuery audit logs identify their service as bigquery.googleapis.com. Combining that service value with cloud.type = 'gcp' restricts the cloud audit-log event search to Google Cloud BigQuery activity.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!