I have a saved search that I alert on and there is certain events I don't want the alert to trigger for when it's coming from inside my network.
Basically I have a this saved search:
index=pan_logs (log_subtype=vulnerability OR log_subtype=wildfire) | fields action, severity, CATEGORY, SUBCATEGORY, direction, dst_hostname, dst_ip, dst_user, dst_zone, log_subtype, misc, rule_name, sourcetype, src_ip, src_zone, threat_name, url, protocol, server_location
It sends me all the alerts we want to see, but there is a couple alerts I don't care about. Especially ones that come from "src_zone=inside + dst_zone=outside + threat_name=IIS DDOS"
So, how do I get my search to display everything except the events that are from inside to outside and the threat name is IIS DDOS?
Have you tried this?
index=pan_logs (log_subtype=vulnerability OR log_subtype=wildfire) NOT (src_zone=inside AND dst_zone=outside AND threat_name=IIS DDOS) | fields action, severity, CATEGORY, SUBCATEGORY, direction, dst_hostname, dst_ip, dst_user, dst_zone, log_subtype, misc, rule_name, sourcetype, src_ip, src_zone, threat_name, url, protocol, server_location
Have you tried this?
index=pan_logs (log_subtype=vulnerability OR log_subtype=wildfire) NOT (src_zone=inside AND dst_zone=outside AND threat_name=IIS DDOS) | fields action, severity, CATEGORY, SUBCATEGORY, direction, dst_hostname, dst_ip, dst_user, dst_zone, log_subtype, misc, rule_name, sourcetype, src_ip, src_zone, threat_name, url, protocol, server_location
That worked! Thanks!