Greetings,

I've been tasked with filtering traffic over ports 443 and 80/8080 that pass through our firewall for the past two months. I created this AQL search:

SELECT * FROM events WHERE destinationip = '<IP>' AND destinationport = '443' OR destinationip = '<IP>' AND destinationport = '80' START '2019-01-01 00:00' STOP '2019-02-27 23:59'

But when I do that, only the port 80 events come up, an no 443 events. If I remove OR destinationip = '<IP>' AND destinationport = '80', then all the 443 events come up.

Is there a way to search for traffic over multiple ports to a single IP?

Thanks,
Brian

------------------------------
BrianBrehart
------------------------------

Hi,

Try like this
SELECT * FROM events WHERE
(destinationip = '<IP>' AND destinationport = '443') OR (destinationip = '<IP>' AND destinationport = '80')
START '2019-01-01 00:00'
STOP '2019-02-27 23:59'

You have to separate destination ip and port from other with bracket.


Regards,

Vedran

------------------------------
Vedran Goricki
------------------------------

Try putting ( )'s around your conditions, destination=IP and destinationport=...etc
Looks like a logic problem here.
e.g.
SELECT * FROM events WHERE (destinationip = '<IP>' AND destinationport = '443') OR (destinationip = '<IP>' AND destinationport = '80') START '2019-01-01 00:00' STOP '2019-02-27 23:59'

------------------------------
James Hewitt
QRadar Log Content Manager
Dish
------------------------------

You can do it this way:

SELECT * FROM events WHERE destinationip = '<IP>' AND destinationport in ( '443','80','8080') START '2019-01-01 00:00' STOP '2019-02-27 23:59'

------------------------------
Robert Djabarov
------------------------------