For details on cookie usage on our site, read our Privacy Policy
How to exclude a resource by TAG from network traffic query
- LIVEcommunity
- Discussions
- Cloud Native Application Protection
- Prisma Cloud Discussions
- How to exclude a resource by TAG from network traffic query
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Printer Friendly Page
How to exclude a resource by TAG from network traffic query
- Mark as New
- Subscribe to RSS Feed
- Permalink
08-29-2019 03:28 PM - last edited on 09-02-2020 11:11 AM by CHopson
RQL:
network where src.publicnetwork in ('Suspicious IPs','Internet IPs') and dest.port in (1433, 1521, 3306, 5000, 5432, 5984, 6379, 6380, 8080, 9042, 11211, 27017, 28015, 29015, 50000) AND dest.resource IN ( resource where tag ( 'Aviatrix-Created-Resource' ) = 'Do-Not-Delete-Aviatrix-Created-Resource' )
I want
network where src.publicnetwork in ('Suspicious IPs','Internet IPs') and dest.port in (1433, 1521, 3306, 5000, 5432, 5984, 6379, 6380, 8080, 9042, 11211, 27017, 28015, 29015, 50000) AND dest.resource NOT IN ( resource where tag ( 'Aviatrix-Created-Resource' ) = 'Do-Not-Delete-Aviatrix-Created-Resource' )
- Labels:
-
Prisma Cloud
- Mark as New
- Subscribe to RSS Feed
- Permalink
11-04-2019 03:13 PM
Hi @JustinB ,
The RQL might need constraints to exclude tag.
Please try:
dest.resource in ( resource where tag not in ( 'Aviatrix-Created-Resource' ) = 'Do-Not-Delete-Aviatrix-Created-Resource' )
Cheers,
Kiwi
Don't forget to hit that Like button if a post is helpful to you!
- RQL Custom queries for AWS needed URGENTLY in Prisma Cloud Discussions
- Networking runtime policy failed to detect traffic to ec2 meta-data IP address in Prisma Cloud Discussions
- RQL query for tag-based exception in Prisma Cloud Discussions
- Unusual server port activity Internal Alerts Potential False Positives in Prisma Cloud Discussions
- How do I validate resources that have 443 publicly exposed have a WAF ? in Prisma Cloud Discussions
Show your appreciation!
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!
