https://live.paloaltonetworks.com/t5/cortex-xsiam-discussions/xql-question/m-p/1241781#M271 <P>Hi, this should work for you</P> <P>&nbsp;</P> <P>dataset = panw_ngfw_traffic_raw<BR />| filter source_ip incidr "x.x.x.x/24"<BR />| filter dest_port != 443 and dest_port != 80<BR />| fields _time, source_ip, dest_ip, dest_port, action, app, bytes_sent, bytes_received, _device_id, rule_matched</P> <P>&nbsp;</P> <P>happy querying</P> <P>&nbsp;</P> Thu, 13 Nov 2025 07:32:05 GMT PA_nts 2025-11-13T07:32:05Z https://live.paloaltonetworks.com/t5/cortex-xsiam-discussions/xql-question/m-p/1241457#M267 <P>Hello,</P> <P>I'm trying to get all the outgoing firewall traffic, except port 80, 443 using the query below but no sucess. Any ideias?</P> <P>&nbsp;</P> <P>dataset = panw_ngfw_traffic_raw<BR />| filter source_ip in ("x.x.x.x/24")<BR />| filter dest_port != 443 and 80<BR />| fields _time, source_ip, dest_ip, dest_port, action, app, bytes_sent, bytes_received, _device_id, rule_matched</P> <P>&nbsp;</P> <P>&nbsp;</P> Fri, 07 Nov 2025 15:44:29 GMT https://live.paloaltonetworks.com/t5/cortex-xsiam-discussions/xql-question/m-p/1241457#M267 SouzaBr 2025-11-07T15:44:29Z https://live.paloaltonetworks.com/t5/cortex-xsiam-discussions/xql-question/m-p/1241781#M271 <P>Hi, this should work for you</P> <P>&nbsp;</P> <P>dataset = panw_ngfw_traffic_raw<BR />| filter source_ip incidr "x.x.x.x/24"<BR />| filter dest_port != 443 and dest_port != 80<BR />| fields _time, source_ip, dest_ip, dest_port, action, app, bytes_sent, bytes_received, _device_id, rule_matched</P> <P>&nbsp;</P> <P>happy querying</P> <P>&nbsp;</P> Thu, 13 Nov 2025 07:32:05 GMT https://live.paloaltonetworks.com/t5/cortex-xsiam-discussions/xql-question/m-p/1241781#M271 PA_nts 2025-11-13T07:32:05Z