How to exclude a resource by TAG from network traffic query

JustinB — Wed, 02 Sep 2020 18:11:33 GMT

RQL:

network where src.publicnetwork in ('Suspicious IPs','Internet IPs') and dest.port in (1433, 1521, 3306, 5000, 5432, 5984, 6379, 6380, 8080, 9042, 11211, 27017, 28015, 29015, 50000) AND dest.resource IN ( resource where tag ( 'Aviatrix-Created-Resource' ) = 'Do-Not-Delete-Aviatrix-Created-Resource' )

I want

network where src.publicnetwork in ('Suspicious IPs','Internet IPs') and dest.port in (1433, 1521, 3306, 5000, 5432, 5984, 6379, 6380, 8080, 9042, 11211, 27017, 28015, 29015, 50000) AND dest.resource NOT IN ( resource where tag ( 'Aviatrix-Created-Resource' ) = 'Do-Not-Delete-Aviatrix-Created-Resource' )

Re: How to exclude a resource by TAG from network traffic query

kiwi — Mon, 04 Nov 2019 23:13:08 GMT

Hi @JustinB ,

The RQL might need constraints to exclude tag.

Please try:

dest.resource in ( resource where tag not in ( 'Aviatrix-Created-Resource' ) = 'Do-Not-Delete-Aviatrix-Created-Resource' )

topic How to exclude a resource by TAG from network traffic query in Prisma Cloud Discussions

How to exclude a resource by TAG from network traffic query

Re: How to exclude a resource by TAG from network traffic query