Need RQL to exclude NAT Gateway in alerts

[LaserFocus]

I’m looking at some rules that detect traffic on ports and it seems to flag a lot of traffic to AWS resource like the NAT gateway that we do not control.

Is it possible to exclude these based on the resource type? 

For example:

Remove Network - Internet traffic over insecure port (22) 
Exclude Network - Internet traffic (21,23,80,443,8444,8443,22)

How do I compose the RQL?

[jeisenhart · Accepted solution]

The RQL needs constraints to exclude NAT Gateway and ELB. 

Please try:

network where src.ip=0.0.0.0 AND protocol=‘TCP’ AND dest.port not IN (21,23,80,443,8444,8443,22) AND source.publicnetwork IN ( ‘Internet IPs’ , ‘Suspicious IPs’ ) AND dest.resource IN ( resource where role not in ( ‘AWS NAT Gateway’ , ‘AWS ELB’ )

network where src.ip=0.0.0.0 AND protocol=‘TCP’ AND dest.port IN (21,22,23,80) AND source.publicnetwork IN ( ‘Internet IPs’ , ‘Suspicious IPs’ ) AND dest.resource IN ( resource where role not in ( ‘AWS NAT Gateway’ , ‘AWS ELB’ ) )