A Prisma Cloud Administrator has been asked to create a custom policy which notifies the InfoSec team each time a configuration mange is made to a Security group. Which type of Resource Query Language (RQL) query would be used in this policy?

To create a policy that notifies on a configuration change, the query must analyze audit logs for specific events. The Resource Query Language (RQL) event from query type is designed for this purpose. It searches cloud provider audit trails (e.g., AWS CloudTrail) for API calls and user activities. A change to a Security Group, such as modifying its rules, is an event that would be captured and can be used to trigger a policy alert.

A. audit from is not a valid RQL query type. The correct syntax to query audit log events is event from.
B. network from is used to query network flow logs and assess network exposure, not to detect configuration change events.
D. config from queries the current state of a resource's configuration, not the event of a change occurring over time.

1. Palo Alto Networks, Prisma Cloud Administrator's Guide. "Build and Run a Query in Investigate". The documentation explicitly lists the three query types: config from, network from, and event from. It states, "Use event from to search for an event that occurred in your cloud environment."