Useful RQL Queries for Prisma Cloud

rql-snippets.txt

# If you want to tag something so that Prisma Cloud doesn't alert on it if the tag contains a certain string value
# And you want to continue alerting if something does not have this specific tag at all, tag this onto your already existing query:
and ((tags[?(@.key=='PrismaCloudMonitored' && @.value!='no')] size > 0) or (tags[*].key does not contain PrismaCloudMonitored))

# If you don't want prisma cloud to alert on SQL Express, since you can't encrypt SQL express:
 json.rule="(engine does not contain 'sqlserver-ex') and (dbiResourceId does not equal null and storageEncrypted is false)"