Are properties missing from JSON preview/auto-complete ingested by Prisma Cloud?
762
Created On 10/19/23 09:35 AM - Last Modified 07/12/24 16:50 PM
Question
If a known property is missing from JSON preview or auto-complete suggestion in the Investigate tab, is it still ingested by Prisma Cloud?
Environment
- Prisma Cloud
- Investigate (CSPM)
- RQL
Answer
The automatic suggestion model is created based on sample data. If certain fields were not included in the training data, they will not be present in the JSON preview or auto-complete suggestions.
Suggestion model has no bearing on functionality of the underlying APIs. Inputting a valid field name in the Investigate tab will provide the expected results even if the field name itself was not suggested by Prisma Cloud.
Additional Information
View our documentation here on the Investigate Page for RQLs.