Log filters nested and/or problems.

[RobinClayton]

Is there a proper guide to filter wrtiting and nesting????

Trying as hard as I can but the Palo does nto seem to like basic logic for searching

Basicaly the below should alert if the following

Medium or higher, 

threat 40031 except if the destiantion is 192.168.10.140.

Not for threat 30664

Not for threat 37610

(severity geq medium) and 

(

     ((addr.dst notin 192.168.10.140) and (threatid eq 40031)) 

  or

    (threatid neq 30664)

  or

    (threatid neq 37610)

 )

I have tried all manaer of different groupings to try and get it to work but it simply does nto seem to understand.. Getting very frustrated with it!

[RobinClayton]

Anyone?

Or does nobody look at their threats?

Cheers

Rob

[BPry]

@RobinClayton

"or does nobody look at their threats".

I'm sorry, I didn't realize that a bunch of people who volunteer their time had a requirement to answer your question in less than 24 hours.

I'll give you a hint; your going about setting up the query wrong, and if properly formated it's pretty easy to get it filtered to what you're looking for. 

[Remo · Accepted solution]

Just a "like" for @BPry's post is not enough. I thought I need to write it here: this answer is simply great!

[RobinClayton]

Sorry about the comment but there seems to be little or no documentation to creating filters and common logic does not seem to work. I am a forum contributor [mostly answering questions] on a wide number of forums for many different subjects and a moderator on 3 automotive forums so I do offer my time freely to people also.

But nobody seems to have ever had a problem, searched high and low,  which leads me to wonder if people bother?

It's counter productive being alerted to a bunch of stuff that we want to ignore, can't see the wood from the trees.

Thanks

Rob

[eventcore]

Landed on this thread looking for this same solution, the proper syntax to build a nested filter similar to the example by the OP. This thread is marked as solved, but no solution is posted. Am I missing something?