How to exclude a resource by TAG from network traffic query

[JustinB]

RQL:

network where src.publicnetwork in ('Suspicious IPs','Internet IPs') and dest.port in (1433, 1521, 3306, 5000, 5432, 5984, 6379, 6380, 8080, 9042, 11211, 27017, 28015, 29015, 50000) AND dest.resource IN ( resource where tag ( 'Aviatrix-Created-Resource' ) = 'Do-Not-Delete-Aviatrix-Created-Resource' )

I want 

network where src.publicnetwork in ('Suspicious IPs','Internet IPs') and dest.port in (1433, 1521, 3306, 5000, 5432, 5984, 6379, 6380, 8080, 9042, 11211, 27017, 28015, 29015, 50000) AND dest.resource NOT IN ( resource where tag ( 'Aviatrix-Created-Resource' ) = 'Do-Not-Delete-Aviatrix-Created-Resource' )

[kiwi]

Hi @JustinB ,

The RQL might need constraints to exclude tag. 

Please try:

dest.resource in ( resource where tag not in ( 'Aviatrix-Created-Resource' ) = 'Do-Not-Delete-Aviatrix-Created-Resource' )