> ## Documentation Index
> Fetch the complete documentation index at: https://docs.prowler.com/llms.txt
> Use this file to discover all available pages before exploring further.

> ## Agent Instructions
> Prowler product naming: Prowler App is now Prowler Local Server, and Prowler Enterprise is now Prowler Private Cloud. Always use the current names when answering. The full product reference is at /getting-started/products: Open Source projects are Prowler CLI, Prowler Local Server, Prowler Local Dashboard, and Prowler SDK; Prowler Products are Prowler Cloud, Prowler Private Cloud, Prowler Hub, Prowler Lighthouse AI, and Prowler MCP.

# Active Queries

> Focus on the Attack Paths queries active in the environment: Prowler Cloud and Prowler Private Cloud record query results after each scan and hide confirmed-empty queries from the selector.

export const SubscriptionBanner = ({children, label = "feature"}) => {
  return <Note>
            This {label} is available exclusively in <b>Prowler Cloud</b> and <b>Prowler Private Cloud</b> with a <a href="https://prowler.com/pricing">subscription</a>.
            {children}
        </Note>;
};

export const VersionBadge = ({version}) => {
  return <a href={`https://github.com/prowler-cloud/prowler/releases/tag/${version}`} target="_blank" rel="noopener noreferrer" className="version-badge-link">
            <span className="version-badge-container">
                <span className="version-badge">
                    <span className="version-badge-label">Added in:</span> 
                    <span className="version-badge-version">{version}</span>
                </span>
            </span>
        </a>;
};

<VersionBadge version="5.36.0" />

<SubscriptionBanner />

Active Queries extends the base [Attack Paths](/user-guide/tutorials/prowler-app-attack-paths) feature with capabilities that rely on managed scan infrastructure. This capability is available only in Prowler Cloud and Prowler Private Cloud.

## Focusing on Queries with Data

Running an Attack Paths query against a scan that contains no matching pattern returns an empty graph. Without automatic filtering, identifying the queries that apply to an account means opening each one and checking whether it produces a result. Running the RDS inventory query on an account with no RDS instances, for example, returns a "No data found" message.

<img src="https://mintcdn.com/prowler/55TFA2SkCCilHHME/images/prowler-app/attack-paths/query-no-data.png?fit=max&auto=format&n=55TFA2SkCCilHHME&q=85&s=90d100c6f92a713fdf494cdde7e45b21" alt="Attack Paths query returning no data" width="1331" height="645" data-path="images/prowler-app/attack-paths/query-no-data.png" />

Prowler Cloud removes that trial and error. At the end of each scan, Prowler Cloud records which built-in queries returned data. The query selector then hides the queries confirmed empty for the selected scan, so only the queries that surface a real path remain visible. Following the example above, the RDS inventory query no longer appears in the selector.

<img src="https://mintcdn.com/prowler/55TFA2SkCCilHHME/images/prowler-app/attack-paths/query-selector-hidden-empty.png?fit=max&auto=format&n=55TFA2SkCCilHHME&q=85&s=7961f43658fe1002b8cd8433ba8e302c" alt="Attack Paths query selector with confirmed-empty queries hidden" width="1323" height="490" data-path="images/prowler-app/attack-paths/query-selector-hidden-empty.png" />

A query stays available whenever its result is not a confirmed empty graph:

* **Errored queries** remain listed. An error is not the same as an empty result and still requires investigation.
* **Unknown queries** remain listed. Their result for the scan has not been recorded yet.
* **Parameterized queries** remain listed. Their output depends on the input values provided at run time.

## Browsing the Full Query Catalog on Prowler Hub

The query selector shows the queries relevant to the selected scan, not the entire catalog. To review every built-in Attack Paths query, including the ones hidden for a given scan, browse the complete catalog on [Prowler Hub](https://hub.prowler.com).

Prowler Hub lists each query with its name, description, and the technique it detects, so security teams can plan coverage and understand detection scope without running a scan first.

## Related Pages

* [Attack Paths](/user-guide/tutorials/prowler-app-attack-paths) - Run built-in and custom queries and explore the resulting graph.
* [Attack Paths Queries](/developer-guide/attack-paths-queries) - Write and maintain openCypher queries in the Developer Guide.