XQL query between 2 dates

[FabioFerreira]

Hi,

I want to query a specific number of events between 2 dates.

I have this query below, but it is missing the "between current_date and last 5 minutes"

dataset = fortinet_fortiauthenticator_vm_raw | filter deviceSeverity != "information" | filter deviceSeverity != "notice" | filter deviceSeverity = "warning"
| comp count(msg) as counter
| filter counter > 5

Could you help pls

Regards,

[afurze · Accepted solution]

FabioFerreira,

You can use the config stage command to specify a timeframe like so...

config timeframe = 5m
| dataset = fortinet_fortiauthenticator_vm_raw | filter deviceSeverity != "information" | filter deviceSeverity != "notice" | filter deviceSeverity = "warning"
| comp count(msg) as counter
| filter counter > 5

[kadirerol]

Hi everyone,

I need your help. I wanna create new rule about FW action. Actually my new rules purpose is If there are a lot of FW action drop and next FW allow in 5 minutes. But I dont know how can i create this. In the below just L2L drop logs .

|dataset = panw_ngfw_traffic_raw
|filter source_ip incidr "172.16.0.0/12" or source_ip incidr "192.168.0.0/16" or source_ip incidr "10.0.0.0/8"
|filter dest_ip incidr "172.16.0.0/12" or dest_ip incidr "192.168.0.0/16" or dest_ip incidr "10.0.0.0/8"
|comp count(action ) as action_count by source_ip,action,dest_ip
|dedup source_ip
|filter action_count > 1000 and action ="drop"