Flow search using NQL Intersections
Multiple NQL statements can be intersected on a field (or multiple fields).
Constraints
- Only supported flow context searches
- Max of 5 NQL search queries
- Max of 5 intersected fields
In the portal, new parameters have been added to support intersecting queries.
Field | Description | Notes |
---|---|---|
intersect | An array of flow fields to intersect the multiple queries on. | Max of five fields to intersect with. Required when length of search array is > 1 |
search | an array of NQL search strings | $Max of 5 search strings |
rollupperiod | The time bucket the intersection is valid. | Only valid when search array is > 1. If not provided then no time bucketing will happen outside of the start/end search period. |
Example Request
Current basic search request
POST https://api.netography.com/api/v1/search/flow
{
"start": -3600,
"end": 0,
"size": 10,
"search": "protocol == tcp"
}
New basic search request
POST https://api.netography.com/api/v1/search/flow
{
"start": -3600,
"end": 0,
"intersect": \["srcip"\],
"rollupperiod": 300,
"size": 10,
"search": \[
"srcip == 10.0.0.0/8 && protocol == udp && dstport == 53",
"protocol == tcp && srcport == 80"
\]
}
Example Response
Current response
{
"code": 200,
"meta": {
"count": 2,
"tid": "673d8a71-a7b7-470b-8b7b-be8941cf4d8d",
"timems": 17.937822,
"totalcount": 10000
},
"data": \[
{
"dstip": "54.175.191.203",
"protocol": "tcp",
"srcip": "10.0.98.60"
},
{
"dstip": "52.44.223.164",
"protocol": "tcp",
"srcip": "10.0.98.60"
}
\]
}
New response
New response with intersection on dstip, dstport. The intersection array will be the unique intersections found in the result set (data array). If rollupperiod is provided the starting timestamp will be included for each intersection.
{
"code": 200,
"meta": {
"count": 4,
"tid": "6d85deb5-36a2-4844-a00b-ebf2eeb70160",
"timems": 23.291099,
"totalcount": 10000
},
"data": \[
{
"dstip": "10.0.99.222",
"dstport": 41000,
"protocol": "tcp",
"setid": 1,
"srcip": "10.0.98.60",
"timestamp": 1643395900
},
{
"dstip": "10.0.99.222",
"dstport": 41000,
"protocol": "tcp",
"setid": 1,
"srcip": "10.0.98.60",
"timestamp": 1643396200
},
{
"dstip": "54.92.199.186",
"dstport": 50000,
"protocol": "tcp",
"setid": 2,
"srcip": "10.0.98.60",
"timestamp": 1643396200
},
{
"dstip": "54.92.199.186",
"dstport": 50000,
"protocol": "tcp",
"setid": 2,
"srcip": "10.0.98.60",
"timestamp": 1643396500
}
\],
"intersection": \[
{"dstip": "10.0.99.222", "dstport": 41000, "setid": 1, "start": 1643395900, "end": 1643396200},
{"dstip": "54.92.199.186", "dstport": 50000, "setid": 2, "start": 1643396200, "end": 1643396500}
\]
}
Updated 9 months ago