Traffic Queries Syntax

Traffic queries can be used in several contexts:

• to search traffic in the Explore section
• to define Custom Rules
• to define Endpoints

A traffic query is composed of terms and operators.
Multiple terms can be combined together with Boolean operators and parenthesis ( ) to form a more complex query

Term

All fields are listed below.
Fields and values are case sensitive.

field:value

Boolean Operator

Three boolean operators are available: AND OR NOT

Wildcard Searches

Multi-character wildcard

Wildcard searches * look for 0 or more characters.
For example, to include test, tests or tester in the same search, you can type the following:

useragent:test*

The wildcard character * cannot be used inside a double quote. Therefore you should avoid special characters.

Single-character wildcard

The Wildcard searches ?can be used to search for an unknown single character. For example, if you want to search for text or testyou can use the following

useragent:te?t

Range Searches

Range queries allow to match documents with field(s) values that are between lower and upper bounds specified by the range query.
Range queries are inclusive of the lower and upper bounds.

📘

CIDR format is supported

Please note that IP addresses can be written following the CIDR format: ip:1.2.3.0/24

ip:[1.2.3.4 TO 1.2.3.9]

ip:[2001\:0db8\:85a3\:0000\:0000\:8a2e\:0000\:0000 TO 2001\:0db8\:85a3\:0000\:0000\:8a2e\:ffff\:ffff]

Range queries can also have numeric ranges, such as:

asn:[1234 TO 4567]

Grouping

Grouping is using parentheses to group clauses to form sub-queries. This can be very useful if you want to control the boolean logic for a query.

The query example below allows/blocks requests incoming from "www.example.com" and are using one of these criteria:

• useragent:test
• ip:1.2.3.4

(useragent:"test" OR ip:1.2.3.4) AND domain:"www.example.com"

The query example below allows/blocks requests incoming from "www.example.com" and are using one of these criteria:

• useragent:test
• useragent:mywork

useragent:("test" OR "mywork") AND domain:"www.example.com"

Special Characters

The following characters need to be escaped by using a backslash:
+ - & | ! ( ) { } [ ] ^ " ~ * ? : \ ␣

useragent:*Windows\\\ NT* AND url:*\+*

Available fields

The fields available to search traffic in the Explore section, define Custom Rules or define Endpoints are listed in the following table.