Difference in outcomes when executing RQL queries within the Policies section compared to the Investigate tab

• Discrepancy in results: launching RQL from the policies screen yields 8 results, whereas initiating the same RQL from the investigate screen results in 108 findings. (Please note that exact numbers may vary depending on the case.)

Example 1:

• Executing an RQL query from a policy returns 8 results.

• The same RQL run from the investigate screen yields 108 results

Example 2:

• Executing an RQL query from a policy returns 4 results.

• The investigation tab view for this same RQL query: (More than 100 results ‘Since 24 hours ago’ only):

• Prisma Cloud Enterprise Edition

• Not including the cloud.account condition in both RQL queries can lead to inconsistencies within the results.

• Even if only a single cloud account is onboarded into Prisma Cloud, including the cloud.account condition is necessary to ensure consistent results on both the investigate and policy pages.