NQL Value Suggestions

When construction NQL queries or filters in the Fusion Portal, the list of both the available fields and values (when applicable) will automatically appear in a dropdown below the NQL search box.

For example, all boolean fields will have value suggestions of true or false.  For fields in which the Fusion Portal can perform lookups, the values will also have suggestions.

Fields in which value suggestions can be made are:

flow Context

dstas.number
dstas.org
dstgeo.continentcode
dstgeo.countrycode
dstipname (deprecated)
dstiprep.categories 
dstname (deprecated)
dstowneras.number
dstowneras.org
dstport
dstportname (deprecated)
flowsrcname
labels.ip.name.src
labels.ip.name.dstseverity
labels.port.name 
rules.plugins.name
rules.name
site 
srcas.number
srcas.org
srcgeo.continentcode
srcgeo.countrycode
srcipname (deprecated)
srciprep.categories
srcowneras.number
srcowneras.org
srcport
srcportname (deprecated)
tags

alert Context (Events)

alerttype
algorithm
categories
dstportnames
dstports
flowsrcnames
ipinfo.as.number
ipinfo.as.org
ipinfo.geo.continentcode
ipinfo.geo.countrycode
ipinfo.iprep.categories
rules
severity
sites
srcportnames
srcports
tags
tdm.description
tdm.name

audit Context

action
class
source
subclass

block Context

active
adapter
algorithms
dstas.number
dstas.org
dstgeo.continentcode
dstgeo.countrycode
dstipname
dstiprep.categories
dstname
dstport
dstportname
plugin.description
plugin.name
protocol
rules
severity
srcas.number
srcas.org
srcgeo.continentcode
srcgeo.countrycode
srcipname
srciprep.categories
srcname
srcport
srcportname