Custom Report Query Building Help Needed

[dannon]

I'm having a hard time getting my URL report built and sorted.

I want to accomplish the following

1. category must match ADULT or NUDITY

2. source user must not be a member of FILT_STAFF or M_FILT_STAFF active directory groups (basically students)

3. search all IPs in 10.0.0.0/8 EXCEPT the following subnets

     10.10.0.0/21

     10.10.8.0/22

     10.7.48.0/21

     10.7.56.0/21

     10.9.0.0/21

     10.9.8.0/21

Another way of prhasing it:

show me all students who went to PORN or NUDITY sites.  Don't show me any IPs which don't have "domain\<student id>" listed as the source user.  I don't want to see our BYOD wireless or Chromebook subnets because there is no authentication.

Any suggestions?

Dannon

[Raido_Rattameister]

Try this:

((category eq adult) or (category eq nudity)) and (user.src neq FILT_STAFF ) and (user.src neq M_FILT_STAFF ) and ( addr.src in 10.0.0.0/8 ) and !(( addr.src in 10.10.0.0/21 ) or ( addr.src in 10.10.8.0/22 ) or ( addr.src in 10.7.48.0/21 ) or ( addr.src in 10.7.56.0/21 ) or ( addr.src in 10.9.0.0/21 ) or ( addr.src in 10.9.8.0/21 ))