Prisma Cloud : RQL in Investigation tab not getting generated for Read-Only User from Alerts Tab

• A Read-Only User Role from Custom Permission Group wants to investigate an Alert.
• For the same, when the User clicks on Investigate button under the "Actions" section of the mentioned alert, it redirects to the Investigate tab.

GUI Path: Alerts > Alerts Overview 

 

• However, no RQL is generated in the Investigate tab. for this user.

GUI Path: Investigate 

 

• Prisma Cloud
• Read-Only User Role created from Custom Permission Group

• “Account Group Read Only” has “READ:RQL” permission but when we create the Custom Permission Group, only permission assigned will those selected in the screen.
• We don’t have an option to select “READ:RQL” role.
• Once GRBAC is enabled for all RQL modules, all Investigate page permissions will be copied over as is, to custom permission group.
• However, this use case with custom permission group is not supported as of today.

• This is as per product design.

• This issue is only observed for Read-Only User role created from Custom Permission Group for Network Policies.