topic Are Application Filters in Groups an AND or an OR? in General Topics

Are Application Filters in Groups an AND or an OR?

stevenkadish — Thu, 26 Apr 2018 20:38:49 GMT

Hi all,

If there are multiple application filters in an application group, do they work with AND or OR logic?

For instance, someone configured an application group which contains five filters. All of the filters have "Subcategory = file-sharing." Then one filter has "Characteristic = Transfers Files," the second has "Tunnels other apps," the third "Used by malware"... etc.

Basically the group looks like this:

FileShar1_Filter		file-sharing		Transfers Files
FileShar2_Filter		file-sharing		Tunnels other apps
FileShar3_Filter		file-sharing		Used by malware
FileShar4_Filter		file-sharing		Evasive
FileShar5_Filter		file-sharing	2	Prone to Misuse
	3
	4
	5

The group is then used in a "Deny" rule. The filters aren't used anywhere else.

Does this make sense? Do we need five filters, or can they be combined into one?

I know that when I'm using applipedia.paloaltonetworks.com, it's OR.

Any help is appreciated!

Thanks,

- Steve

Re: Are Application Filters in Groups an AND or an OR?

Harshit — Thu, 26 Apr 2018 21:48:58 GMT

Hi,

I believe The Apps in the group would be "OR" (ed) , similary you can put "ssl" and "web browsing" in a rule and that matches both type of traffic.

Regards,

~Harry

Re: Are Application Filters in Groups an AND or an OR?

BPry — Fri, 27 Apr 2018 13:51:24 GMT

@stevenkadish,

The group was built out the way it was because you couldn't combine all of those filters into one and get the same application count. For Example:

FileShar1_Filter: 283 applications

FileShar2_filter: 17 applications

FileShar3: 75 applications

FileShar4: 173 applications

FileShar5: 3 Applications

So when you put all of those filters into a group the group would be if it matches FileShar1_Filter OR FileShar2_Filter and so on. If you attempted to put all of the filters together, the filters become and AND statement. So instead of having the application group match 551 applications in total, the combine filters would only match 5 applications (because only 5 match all of the filter criteria).

TL/DR

So short answer is that @Harshit is correct and multiple filters within an application group follows an OR statement. To answer your other question you wouldn't want to combine all five filters because they would no longer match the majority of the applications you are currently blocking. Building a filter you are simply setting what characteristics you want to match on.

Re: Are Application Filters in Groups an AND or an OR?

stevenkadish — Fri, 27 Apr 2018 14:03:15 GMT

Hi Bpry,

Thanks very much! So to summarize, criteria within a filter are AND and filters within a group are OR. That's very helpful.

Best,

- Steve