Custom Report Query Building Help Needed

dannon — Thu, 28 Sep 2017 20:59:53 GMT

I'm having a hard time getting my URL report built and sorted.

I want to accomplish the following

1. category must match ADULT or NUDITY

2. source user must not be a member of FILT_STAFF or M_FILT_STAFF active directory groups (basically students)

3. search all IPs in 10.0.0.0/8 EXCEPT the following subnets

10.10.0.0/21

10.10.8.0/22

10.7.48.0/21

10.7.56.0/21

10.9.0.0/21

10.9.8.0/21

Another way of prhasing it:

show me all students who went to PORN or NUDITY sites. Don't show me any IPs which don't have "domain\<student id>" listed as the source user. I don't want to see our BYOD wireless or Chromebook subnets because there is no authentication.

Any suggestions?

Dannon

Re: Custom Report Query Building Help Needed

Raido_Rattameister — Fri, 29 Sep 2017 01:52:26 GMT

Try this:

((category eq adult) or (category eq nudity)) and (user.src neq FILT_STAFF ) and (user.src neq M_FILT_STAFF ) and ( addr.src in 10.0.0.0/8 ) and !(( addr.src in 10.10.0.0/21 ) or ( addr.src in 10.10.8.0/22 ) or ( addr.src in 10.7.48.0/21 ) or ( addr.src in 10.7.56.0/21 ) or ( addr.src in 10.9.0.0/21 ) or ( addr.src in 10.9.8.0/21 ))

topic Custom Report Query Building Help Needed in General Topics

Custom Report Query Building Help Needed

Re: Custom Report Query Building Help Needed