Bug in Perform Config Search api endpoint for Prisma CSPM APIs

[rutalreja-deloitte]

Describe the bug

Trying to create a custom IAM config search query to be saved as a new custom policy. First step is to call api endpoint /search/config

This works as expected for config from cloud.resource queries but fails with 400 response code on any and all config from iam queries.

Expected behavior

API endpoint should be able to create new search for all config queries including IAM

Current behavior

API endpoint fails for all IAM config queries that start with config from iam ...

Possible solution

Steps to reproduce

Using postman: Endpoint: https://{{api-endpoint}}/search/config Headers: headers = { 'x-redlock-auth': '', 'Accept': 'application/json; charset=UTF-8', 'Content-Type': 'application/json' } Body as Raw JSON: { "query": "config from iam where action.lastaccess.days > 360" }

Context

Using api.eu endpoint if that makes any difference. Works as expected for config from cloud.resource queries

Your Environment

Postman/Python Script

• Version used:
• Environment name and version (e.g. Chrome 59, node.js 5.4, python 3.7.3): Python 3.10, Postman 10.14.3
• Operating System and version (desktop or mobile): Windows 10
• Link to your project:

[welcome-to-palo-alto-networks[bot]]

:tada: Thanks for opening your first issue here! Welcome to the community!