Conversation Filters
This is where you define filters to narrow-down the search results. All the possible dimensions can be found by clicking on the (?) icon next to the word Filters. For any User Labels data, those columns will also be available for the appropriate intervals. This input also supports and, or, not, and parenthesis keywords, use these to express more complex filters. For example, a direction-agnostic filter between IP 1.1.1.1 and 2.2.2.2 can be written:
Consumer Address = 1.1.1.1 and Provider Address = 2.2.2.2 or Consumer Address = 2.2.2.2 and Provider Address = 1.1.1.1 And to additionally filter on Protocol = TCP:
(Consumer Address = 1.1.1.1 and Provider Address = 2.2.2.2 or Consumer Address = 2.2.2.2 and Provider Address = 1.1.1.1) and Protocol = TCP
The filter input also supports “,” and “-” for Port, Consumer Address and Provider Address, by translating “-” into range queries. The following are examples of a valid filter:
Available filters:
|
Filters |
Description |
|---|---|
|
Consumer Address |
Enter a subnet or IP Address using CIDR notation (for example, 10.11.12.0/24). Matches conversation flow observations whose consumer address overlaps with the provided IP Address or subnet. |
|
Provider Address |
Enter a subnet or IP Address using CIDR notation (for example, 10.11.12.0/24) Matches conversation flow observations whose provider address overlaps with provided IP address or subnet. |
|
Port |
Matches conversation flow observations whose port overlaps with provided port. |
|
Protocol |
Filter conversation flow observations by Protocol type (TCP, UDP, ICMP). |
|
Address Type |
Filter conversation flow observations by Address type (IPv4, IPv6, DHCPv4). |
|
Confidence |
Indicated the confidence in the direction of flow. Possible values: High, Very High, Moderate. |
|
Excluded? |
Match conversations that are excluded by an exclusion filter or approved policy. |
|
Excluded By |
Match conversations excluded by a specific filter. Possible values: Exclusion Filter, Policy. |