LIVEcommunity - Who rated this post

You can add an OR to the filter and use parenthesis to group your operators, like so:

| filter (action_local_ip = "10.130.130.34" and action_local_port != 445) or action_local_ip != "10.130.130.34"

This selects either logs where the local IP is 10.130.130.34 and the source port is not 445, or logs where the local IP is not 10.130.130.34.

Who rated this post

L1 Bithead

Rating date:

Who rated this post