topic Negating an Argument for XML API Query in General Topics

Negating an Argument for XML API Query

Molly_Rice — Wed, 04 Sep 2024 18:55:42 GMT

I am essentially trying to query the XML API for the active firewall to grab out operational logs using the below query except I would like to NEGATE the application so that I am grabbing out the logs that do not include that application type. Right now as it is written below, I am grabbing out ONLY the logs with application type "example-application-type-here" and I would like the opposite. Has anyone resolved this?

<show><session><all><filter><application>example-application-type-here</application></filter></all></session></show>

Thanks!

Re: Negating an Argument for XML API Query

Brandon_Wertz — Wed, 04 Sep 2024 20:13:30 GMT

@Molly_Rice wrote:

I am essentially trying to query the XML API for the active firewall to grab out operational logs using the below query except I would like to NEGATE the application so that I am grabbing out the logs that do not include that application type. Right now as it is written below, I am grabbing out ONLY the logs with application type "example-application-type-here" and I would like the opposite. Has anyone resolved this?

<show><session><all><filter><application>example-application-type-here</application></filter></all></session></show>

Thanks!

Can you use a 'not' operator somewhere in-front of the application field or maybe the 'bang' ! ?

Re: Negating an Argument for XML API Query

BPry — Wed, 04 Sep 2024 20:30:27 GMT

@Molly_Rice,

The way that you would do this through the API (and the way that the GUI actually performs this) is simply not outputting the full return. Something a bit like this:

session_table = requests.get('https://<firewall>/api/?type=op&cmd=<validate><full></full></validate>',headers=headers, verify=False) session_dict = xmltodict.parse(session_table.content) returned_session_list = [] session_list = session_dict['response']['result']['entry'] for session in session_list: if session['application'] == 'ssl': logging.debug("Drop Session") else: returned_session_list.append(session) ## Do something with returned_session_list ##