Palo Alto Networks Search API
You can use the Resource Query Language (RQL) to perform configuration checks across cloud services as well as gain real-time insights into user and network events to gain security visibility and create policy guardrails in your cloud environment. See the [Prisma Cloud documentation](https://docs.paloaltonetworks.com/prisma/prisma-cloud.html) for more information.
Operations 20
Each operation below carries the questions people ask an LLM about it and the instructions they give an agent to run it. Generated by API Evangelist overlay
Ask an LLM
“How do I run an RQL config query to find misconfigured cloud resources in Prisma Cloud?”
“Can I save a config search with a name and description when I run it?”
Tell an agent
Run the config query {query} and save it as {searchName}.
Run config query {query} and include the full resource JSON in the results.
Ask an LLM
“How can I query cloud flow logs to see which network traffic reached a resource?”
“Can a network flow-log search be returned as a CSV instead of JSON?”
Tell an agent
Search flow logs with network query {query} over time range {timeRange}.
Run network query {query} for {timeRange} grouped by {groupBy}.
Ask an LLM
“How do I find console and API access events in the audit log using RQL?”
“Which privileged activities happened in my cloud accounts this week?”
Tell an agent
Run audit event query {query} over {timeRange}.
Search audit events with {query} and return at most {limit} results.
Ask an LLM
“Can I get audit event results broken down by location and service?”
“Where geographically and in which services did my audit events come from?”
Tell an agent
Run aggregated event query {query} to show location and service breakdowns.
Aggregate audit events matching {query} over {timeRange} by location and service.
Ask an LLM
“How do I narrow down the results of an aggregated audit event search with extra filters?”
“Can I refine event log results after the first search without rerunning everything?”
Tell an agent
Refine event results for {query} using filters {filters}.
Filter the event log search {query} down with {filters} and sort by {sort}.
Ask an LLM
“My audit event search returned over 100 results — how do I fetch the next page?”
“What token do I pass to page through event search results?”
Tell an agent
Fetch the next page of event search results using page token {pageToken}.
Get {limit} more audit events with page token {pageToken}.
Ask an LLM
“How do I see the raw metadata behind a single audit event?”
“Can I pull the unprocessed JSON for one specific event ID?”
Tell an agent
Show the raw event data for audit event {id}.
Get raw metadata for event {id}.
Ask an LLM
“What can I type next to finish a partial RQL query?”
“Which expressions, values and operators are valid after the RQL I've started writing?”
Tell an agent
Suggest completions for the partial RQL query {query}.
Autocomplete {query} for time range {timeRange}.
Ask an LLM
“How do I pull the search data needed to investigate an anomaly or network alert?”
“Does alert investigation data work for every alert type or only anomaly and network alerts?”
Tell an agent
Get investigation search data for alert {alertId}.
Investigate network alert {alertId}.
POST
/search/config/page
Get the next page of config search results · Get The Next Config Search Page
#
Ask an LLM
“My config search found over 100 resources — how do I load the next page?”
“Can I include resource JSON when paging through config search results?”
Tell an agent
Load the next page of config search results with token {pageToken}.
Fetch {limit} more config results using page token {pageToken}.
POST
/search/event/filtered/download
Download audit event search results as CSV · Download Event Search CSV
#
Ask an LLM
“Can I export an audit event log search to a CSV file?”
“How do I download filtered event search results for a spreadsheet?”
Tell an agent
Download audit events matching {query} as a CSV.
Export the event log search {query} for {timeRange} to CSV.
POST
/search/config/jobs
Start a config search CSV export job · Submit Search Config CSV Generation Job
#
Ask an LLM
“How do I kick off a background job that builds a CSV of config query results?”
“Can I generate a config CSV from a saved search ID rather than a new query?”
Tell an agent
Submit a CSV generation job for config query {query} named {searchName}.
Start a config CSV job from saved search {id}.
GET
/search/config/jobs/{id}/download
Download a finished config CSV job · Download Async Config Search CSV
#
Ask an LLM
“My config CSV job is done — how do I download the file?”
“Where do I get the CSV produced by a submitted config search job?”
Tell an agent
Download the CSV output of config search job {id}.
Fetch the finished config CSV for job {id}.
POST
/search/api/v1/config
Run a config search by RQL query (v1 API) · Perform Config Search by Query
#
Ask an LLM
“How do I run an RQL config query through the v1 search API and get a page token back?”
“Can I skip saving the search to history when I run a v1 config query?”
Tell an agent
Run v1 config query {query} without creating a saved search.
Use the v1 config search API to run {query} with next page token {nextPageToken}.
POST
/search/api/v1/config/async
Get config search results as CSV asynchronously · Perform Asynchronous Config Search
#
Ask an LLM
“Can the reporting service send config query results as CSV asynchronously?”
“How do I get an async CSV of a saved config search from the reporting service?”
Tell an agent
Request async CSV results from the reporting service for config query {query}.
Get async CSV results for saved search {savedSearchId} with query {query}.
POST
/search/api/v1/config/download
Download config search results as CSV directly · Download Config Search as CSV
#
Ask an LLM
“How do I download config query results straight to a CSV in one call?”
“Is there a synchronous endpoint that returns a config search as CSV?”
Tell an agent
Download config query {query} results as a CSV file right now.
Export saved config search {savedSearchId} using query {query} to CSV immediately.
Ask an LLM
“How do I run a v2 config query that starts at a given time and ends now?”
“Does the v2 config search return the newer descriptive resource type names like EC2 Instance?”
Tell an agent
Run v2 config query {query} starting from {startTime}.
Use config search v2 to run {query} returning {limit} results.
POST
/search/api/v2/config/{id}
Rerun a saved config search by ID (v2) · Perform Config Search by Search Id V2
#
Ask an LLM
“Can I rerun an existing config search by its ID using the v2 start-time format?”
“How do I page through a v2 config search that I already created?”
Tell an agent
Rerun config search {id} with the v2 API from {startTime}.
Get the next v2 results for search {id} using token {nextPageToken}.
POST
/search/api/v1/config/{id}
Rerun a saved config search by ID (v1) · Perform Config Search by Search Id
#
Ask an LLM
“How do I get results for an existing config search ID with a time range in v1?”
“Can I rerun a previous config search by ID instead of retyping the RQL?”
Tell an agent
Rerun v1 config search {id} over time range {timeRange}.
Get {limit} results from existing config search {id}.
Ask an LLM
“Which cloud assets match an RQL asset query across my resource configurations?”
“Can one asset search cover config, network and event query types?”
Tell an agent
Search assets with RQL {query} over {timeRange}.
Find up to {limit} assets matching {query} in {timeRange}.