XQL Query Help

[Anuja_Prasad]

Hello All,

I am trying to build a correlation rule for palo alto traffic logs to have local to remote traffic logs but I am unable to put that condition in the XQL query. Can someone please help me with the condition if you have already built one?

It will start off like this:

 dataset =panw_ngfw_traffic_raw _raw |filter <I want Outbound traffic condition here>

[jmazzeo]

Hi @Anuja_Prasad, thanks for reaching us using the live community.

Your XQL Query start looks good, you only need to filter the required field like this:

dataset = panw_ngfw_traffic_raw
| filter dest_ip = "8.8.8.8" and dest_port = 53

(DNS Traffic to the Google public DNS)

If the required fields are not present in the result, remember to add then to the layout clicking the three dots and selecting them like in this example.

If this answers your question, please mark it as the solution.

[Anuja_Prasad]

Thanks! I am actually looking for any outbound traffic over say port 53 not just to a particular IP.