Is there a list of options / filters I can use in the Web GUI ?


Changes to the LIVEcommunity experience are coming soon... Here's what you need to know.

L1 Bithead

Is there a list of options / filters I can use in the Web GUI ?


Is there a list, a document that would explain how I can use filters in the Web GUI ? I know how to apply simple filters by clicking on a field -> filter, but I would like to use more advanced features.

As exemples :

- (tag/member eq 'TEST') will list all security policies that have "TEST" in their TAG list. How can I negate that so that only rules that don't have the TAG "TEST" would be listed ?

- How can I filters my policies so I only list disabled or enabled rules ?

- ( receive_time leq '2013/05/30 07:43:00' ) will return all log events that have occured before 7:43. What if I want everything that have occured AFTER 07:43 ?

Thank you!

L6 Presenter

ı don't know if there is a guide.

You can use ! to negate all of the thing in brackets

Ex:   !( addr.src in )

Ex  ( receive_time geq '2013/05/30 07:43:00' )

L5 Sessionator


Best thing if don't know the syntax can be to use the "filter add" option - small + on the top righ corner in Monitor/traffic.


L1 Bithead

Thanks for the hint! This will help me build my queries. I was working in my policies where the option to add a filter is simply not there.

L1 Bithead

Thanks. I did tried the use of !, and I though it was not working. It actually work, but not exactly as I would like. I'll keep searching, but I should be able to figure it out now.

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!