Using Where Clauses; Using The Group By Clause - Juniper SECURITY THREAT RESPONSE MANAGER 2008.2 - AQL EVENT AND FLOW QUERY CLI GUIDE Manual

10 U AQL Q
SING THE
Using Where
Clauses
Using the Group By
Clause
CLI
UERY
select <query item> from <flows|events> where
<sourceCIDR|destinationCIDR> = '<CIDR Range>'
For example:
select * from flows where sourceCIDR = '10.100.100/24'
This command returns all flows coming from the 10.100.100 subnet. To capture
flows coming from and into the subnet use the regular OR expression as follows:
select * from events where sourceCIDR = '10.100.100/24' OR
destinationCIDR = '10.100.100/24'
You can restrict your AQL queries using
operators in the clause include
comparison operators include:
For example,
select sourceIP, category, credibility from events where
severity > 9 and category = 5013
select sourceIP, category, credibility from events where
(severity > 9 and category = 5013) or (severity < 5 and
credibility > 8)
The clause also supports the
where
settings passed to the AQL CLI. The
keyword to specify the start and end time bounds of the query. All time
between
constraints must be entered as either UNIX timestamps or formatted date/time
strings.
You can only use the
can only query a continuous span of time in a single AQL command.
The logical operator for the
clause should be the
variable as the last constraint of the query and the
variable and the rest of the
arieltime
You can use the
group by
aggregation is combined with arithmetic functions on remaining columns to provide
meaningful results of the aggregation. For example, to enter a query to investigate
the IP addresses that sent more than 1 million bytes within all flows in a specific
time frame, you must enter:
select sourceIP, SUM(sourceBytes) from flows where sourceBytes >
1000000 group by sourceIP
AQL Event and Flow Query CLI Guide
where
, , and parentheses. Also, the supported
and OR
=, <, >, >=, <=, and !=
arieltime
arieltime
variable once in a single query. Therefore, you
arieltime
variable and the remainder of the
arieltime
operator. We recommend that you use the
and
where
clause to aggregate your data. Typically, data
clauses. The supported logical
variable, which overrides the time
variable must be used with the
operator between the
and
clause.
where
arieltime