Prisma Cloud: Can deactivated cloud accounts be ignored in RQL queries?
5799
Created On 12/20/21 23:31 PM - Last Modified 01/27/23 21:53 PM
Question
Can deactivated cloud accounts be ignored in RQL queries?
Environment
- Prisma Cloud
- RQL query.
Answer
Yes, resources from deactivated cloud accounts can be ignored in RQL queries.
There are two ways that deactivated cloud accounts can be ignored in RQL queries can be done:
- If you delete the account on your tenant - it will remove all the historical data in about 24 hours and resources shouldn't populate in your RQL queries.
- Creating a query like the following can also be used to filter deactivated accounts:
config from cloud.resource where cloud.account NOT IN (
NOTE: Deleting an account will remove all historic data for that account on your tenant.
Additional Information
When we deactivate an account, it will still always show up in the 'investigate' section but will not appear in the Alerts dashboard.