NQL Keywords

Looking up NQL Keywords in Fusion

When constructing NQL queries in the Fusion Portal, the list of both the available fields and values (when applicable) will automatically appear in a dropdown below the NQL search box under Keywords. .

Example: dstgeo.countrycode description

Example: dstgeo.countrycode description

Using NQL Keyword Auto-Complete Suggestions

When you enter a keyword in the NQL textbox, a list of valid values for that keyword will pop up if available. For example, all boolean fields will have true or false value suggestions. The values for fields in which the Fusion Portal can perform lookups will also have suggestions.

Example: dstgeo.countrycode valid values and meaning

Example: dstgeo.countrycode valid values and meaning

List of NQL Keyword Values with Auto-Complete Suggestions

Flow

dstas.number
dstas.org
dstgeo.continentcode
dstgeo.countrycode
dstipname (deprecated)
dstiprep.categories
dstname (deprecated)
dstowneras.number
dstowneras.org
dstport
dstportname (deprecated)
flowsrcname
labels.ip.name.src
labels.ip.name.dstseverity
labels.port.name
rules.plugins.name
rules.name
site
srcas.number
srcas.org
srcgeo.continentcode
srcgeo.countrycode
srcipname (deprecated)
srciprep.categories
srcowneras.number
srcowneras.org
srcport
srcportname (deprecated)
tags

Events

alerttype
algorithm
categories
dstportnames
dstports
flowsrcnames
ipinfo.as.number
ipinfo.as.org
ipinfo.geo.continentcode
ipinfo.geo.countrycode
ipinfo.iprep.categories
rules
severity
sites
srcportnames
srcports
tags
tdm.description
tdm.name

Audit

action
class
source
subclass

Block

active
adapter
algorithms
dstas.number
dstas.org
dstgeo.continentcode
dstgeo.countrycode
dstipname
dstiprep.categories
dstname
dstport
dstportname
plugin.description
plugin.name
protocol
rules
severity
srcas.number
srcas.org
srcgeo.continentcode
srcgeo.countrycode
srcipname
srciprep.categories
srcname
srcport
srcportname