dustinbutterworth · November 22, 2019 18:24
diff --git a/rql-snippets.txt b/rql-snippets.txt
 # If you want to tag something so that Prisma Cloud doesn't alert on it if the tag contains a certain string value
 # And you want to continue alerting if something does not have this specific tag at all, tag this onto your already existing query:
 and ((tags[?(@.key=='PrismaCloudMonitored' && @.value!='no')] size > 0) or (tags[*].key does not contain PrismaCloudMonitored))

 # If you don't want prisma cloud to alert on SQL Express, since you can't encrypt SQL express:
 json.rule="(engine does not contain 'sqlserver-ex') and (dbiResourceId does not equal null and storageEncrypted is false)"
	# If you want to tag something so that Prisma Cloud doesn't alert on it if the tag contains a certain string value
	# And you want to continue alerting if something does not have this specific tag at all, tag this onto your already existing query:
	and ((tags[?(@.key=='PrismaCloudMonitored' && @.value!='no')] size > 0) or (tags[*].key does not contain PrismaCloudMonitored))

	# If you don't want prisma cloud to alert on SQL Express, since you can't encrypt SQL express:
	json.rule="(engine does not contain 'sqlserver-ex') and (dbiResourceId does not equal null and storageEncrypted is false)"