Alright, let's cut through the marketing fluff. I've been running Prisma Cloud through its paces for the last quarter, and the signal-to-noise ratio in the console is driving me up the wall. My dashboard is a sea of "potential" findings—most of which are irrelevant dev environment chatter.
I get it, casting a wide net is their thing. But when I need to prioritize actual firefighting, I just want to see the **confirmed, exploitable risks**. The UI filters feel like they're designed by someone who's never had to triage a real CVE.
Has anyone built a reliable method—via the UI, API, or CSPM query—to **permanently filter out all "potential" findings** and only display "confirmed" ones? I'm talking about a set-and-forget view for the security team.
My attempts so far:
* UI Filters: The "Status" filter has options like "open," "dismissed," "resolved," but not a straight "confirmed vs. potential" toggle. Using "Policy Name" or "Resource ID" is a manual nightmare.
* Prisma Cloud Query (PCQL): I've tried something like this, but it's clunky and I'm not sure it's comprehensive:
```sql
config from cloud.resource where finding.status = 'OPEN' AND source.data.condition = 'Confirmed'
```
* API v2: The `/search/config` endpoint seems promising, but the payload structure for filtering on `data.sourceData.condition` is making me pull my hair out.
What's your workflow? Are we stuck manually tagging and dismissing, or is there a smarter filter I'm missing? The overhead of sifting through thousands of "potentials" to find the dozen confirmed issues is... suboptimal for a tool at this price point.