topic Filters more advanced and detailed, How do I find more information? in General Topics

Filters more advanced and detailed, How do I find more information?

csolis177 — Sat, 25 Sep 2021 19:34:10 GMT

Hello everyone,

anyone know, how this filter works (addr.dst notin 10.1.1.1) and (addr.dst notin 10.1.1.2) and (addr.dst notin 10.1.1.4), I don't understand this word "notin",

it exists any website to review filters, more advanced and detailed.

I will appreciate your comments

Re: Filters more advanced and detailed, How do I find more information?

JoergSchuetter — Sat, 25 Sep 2021 21:21:35 GMT

Hello

In most network filters you are able to filter for "IP address (src or destionation) is in network xyz". In your syntax this would be written as (addr.src in 10.0.0.0/8).

The network mask could be /32 (where you can omit it).

To negate the filter, you change the word "in" into "not" + "in" --> "notin"

Re: Filters more advanced and detailed, How do I find more information?

csolis177 — Sun, 26 Sep 2021 13:23:33 GMT

Hello Joerg

thanks for your comments, i appreciate your information was clear.

but you could share some link or website with more examples to understand better.

please..

Re: Filters more advanced and detailed, How do I find more information?

S.Cantwell — Mon, 27 Sep 2021 13:20:11 GMT

@csolis177

https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/monitoring/view-and-manage-logs/filter-logs