# NQL Examples

We have categorized these examples and provided a base query that you can customize to your own infrastructure and network topography:

### Search for and alert on specific traffic <a href="#search-for-and-alert-on-specific-traffic" id="search-for-and-alert-on-specific-traffic"></a>

For example, East/West or North-South or compliance requirements or in a forensics investigation.

#### Outbound traffic <a href="#outbound-traffic" id="outbound-traffic"></a>

{% tabs %}
{% tab title="NQL" %}

```sql
srcinternal == true && dstinternal == false
```

{% endtab %}
{% endtabs %}

#### Inbound traffic <a href="#inbound-traffic" id="inbound-traffic"></a>

{% tabs %}
{% tab title="NQL" %}

```sql
srcinternal == true && dstinternal == true
```

{% endtab %}
{% endtabs %}

### Search for and alert on geographic-based activity <a href="#search-for-and-alert-on-geographic-based-activity" id="search-for-and-alert-on-geographic-based-activity"></a>

Discover compromised devices via traffic from countries of concern, or for responding to threats or proactively threat hunting.

#### Outbound traffic to T1 CoC <a href="#outbound-traffic-to-t1-coc" id="outbound-traffic-to-t1-coc"></a>

{% tabs %}
{% tab title="NQL" %}

```sql
dstgeo.countrycode == MM OR dstgeo.countrycode == CN OR dstgeo.countrycode == ER OR dstgeo.countrycode == IN OR dstgeo. countrycode == IR OR dstgeo.countrycode == NG OR dstgeo. countrycode == KP OR dstgeo.countrycode == PK OR dstgeo. countrycode == RU OR dstgeo.countrycode == SA OR dstgeo. countrycode == SY OR dstgeo.countrycode == TJ OR dstgeo. countrycode == TM OR dstgeo.countrycode == VM
```

{% endtab %}
{% endtabs %}

### Bad Actors <a href="#bad-actors" id="bad-actors"></a>

Such as finding IP reputation-based traffic, botnets, or phishing/spammers.

#### IPs that matched an IP reputation list <a href="#ips-that-matched-an-ip-reputation-list" id="ips-that-matched-an-ip-reputation-list"></a>

{% tabs %}
{% tab title="NQL" %}

```sql
dstiprep.count >= 1 or srciprep.count >= 1
```

{% endtab %}
{% endtabs %}

#### Outbound traffic to non-approved geographies <a href="#outbound-traffic-to-non-approved-geographies" id="outbound-traffic-to-non-approved-geographies"></a>

{% tabs %}
{% tab title="NQL" %}

```sql
srcipname == PointOfSaleSystem AND (dstgeo.countrycode != US OR dstgeo.countrycode != CA)
```

{% endtab %}
{% endtabs %}

### Configuration validation or misconfiguration <a href="#configuration-validation-or-misconfiguration" id="configuration-validation-or-misconfiguration"></a>

Finding traffic that should not exist between applications and systems or drift between deployments.

#### Web application database <a href="#web-application-database" id="web-application-database"></a>

{% tabs %}
{% tab title="NQL" %}

```sql
(srcipname == websvr && dstipname != appSvr) or (srcipname != websvr && dstipname != appSvr)
```

{% endtab %}
{% endtabs %}

### Compliance <a href="#compliance" id="compliance"></a>

Enforce compliance for specific applications or regions or make your reporting or compliance audits easier with audit-ready proof of enforcement.

#### Detect network activity on specific ports <a href="#detect-network-activity-on-specific-ports" id="detect-network-activity-on-specific-ports"></a>

{% tabs %}
{% tab title="NQL" %}

```sql
srcinternal == true && protocol == udp && (dstport == 137 OR dstport == 138 OR dstport == 139)
```

{% endtab %}
{% endtabs %}

#### Search for traffic between production environments and dev or test <a href="#search-for-traffic-between-production-environments-and-dev-or-test" id="search-for-traffic-between-production-environments-and-dev-or-test"></a>

{% tabs %}
{% tab title="NQL" %}

```sql
tags == Production && (tags == dev or tags == test)
```

{% endtab %}
{% endtabs %}

#### Show (presumed) successful flows from the Internet to the internal network, of SSH protocol <a href="#show-presumed-successful-flows-from-the-internet-to-the-internal-network-of-ssh-protocol" id="show-presumed-successful-flows-from-the-internet-to-the-internal-network-of-ssh-protocol"></a>

{% tabs %}
{% tab title="NQL" %}

```sql
srcinternal == false && dstinternal == true && bits > 300 && packets > 3 && dstport:22
```

{% endtab %}
{% endtabs %}

#### FTP and Telnet usage <a href="#ftp-and-telnet-usage" id="ftp-and-telnet-usage"></a>

{% tabs %}
{% tab title="NQL" %}

```sql
protocol == tcp && tcpflags.ack == true && (dstport == 21 || dstport == 23)
```

{% endtab %}
{% endtabs %}

### Discovery by port and protocol usage <a href="#discovery-by-port-and-protocol-usage" id="discovery-by-port-and-protocol-usage"></a>

#### Discover devices using SSH outbound <a href="#discover-devices-using-ssh-outbound" id="discover-devices-using-ssh-outbound"></a>

{% tabs %}
{% tab title="NQL" %}

```sql
protocol == tcp && dstport == 22 && tcpflags.ack == true && dstinternal != true
```

{% endtab %}
{% endtabs %}

#### Discover devices sending > 100MB of data outbound <a href="#discover-devices-sending--100mb-of-data-outbound" id="discover-devices-sending--100mb-of-data-outbound"></a>

{% tabs %}
{% tab title="NQL" %}

```sql
srcinternal == true AND dstinternal == false track by srcip, dstip threshold sum(bits) > x
```

{% endtab %}
{% endtabs %}

#### x11 Discovery <a href="#x11-discovery" id="x11-discovery"></a>

{% tabs %}
{% tab title="NQL" %}

```sql
protocol == tcp and (dstport >= 6000 and dstport \<= 6002)
```

{% endtab %}
{% endtabs %}

#### BitTorrent traffic discovery <a href="#bittorrent-traffic-discovery" id="bittorrent-traffic-discovery"></a>

{% tabs %}
{% tab title="NQL" %}

```sql
protocol == tcp and (dstport >= 6881 and dstport \<= 6889)
```

{% endtab %}
{% endtabs %}

#### Outbound SSH Traffic <a href="#outbound-ssh-traffic" id="outbound-ssh-traffic"></a>

{% tabs %}
{% tab title="NQL" %}

```sql
srcinternal == true && dstinternal == false && dstport == 22
```

{% endtab %}
{% endtabs %}

#### Outbound Unencrypted Web traffic <a href="#outbound-unencrypted-web-traffic" id="outbound-unencrypted-web-traffic"></a>

{% tabs %}
{% tab title="NQL" %}

```sql
srcinternal == true && dstinternal == false && dstport == 80 || dstport == 8080
```

{% endtab %}
{% endtabs %}

#### Outbound Unencrypted FTP traffic <a href="#outbound-unencrypted-ftp-traffic" id="outbound-unencrypted-ftp-traffic"></a>

{% tabs %}
{% tab title="NQL" %}

```sql
srcinternal == true && dstinternal == false && dstport == 20 || port == 21
```

{% endtab %}
{% endtabs %}

#### Outbound Unencrypted Telnet traffic <a href="#outbound-unencrypted-telnet-traffic" id="outbound-unencrypted-telnet-traffic"></a>

{% tabs %}
{% tab title="NQL" %}

```sql
srcinternal == true && dstinternal == false && dstport == 23
```

{% endtab %}
{% endtabs %}

#### Netbios outbound ports <a href="#netbios-outbound-ports" id="netbios-outbound-ports"></a>

{% tabs %}
{% tab title="NQL" %}

```sql
srcinternal == true && dstinternal == false && dstport == 445 || dstport == 139 || dstport == 137
```

{% endtab %}
{% endtabs %}

#### Dynamic port to dynamic port <a href="#dynamic-port-to-dynamic-port" id="dynamic-port-to-dynamic-port"></a>

{% tabs %}
{% tab title="NQL" %}

```sql
(srcinternal == true && dstinternal == false && srcport > 49151 && dstport > 49151) && srcinternal == true && protocol == TCP
```

{% endtab %}
{% endtabs %}

#### Outbound encrypted DOT(853) <a href="#outbound-encrypted-dot853" id="outbound-encrypted-dot853"></a>

{% tabs %}
{% tab title="NQL" %}

```sql
srcinternal == true AND dstinternal == false dstport == 853
```

{% endtab %}
{% endtabs %}


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://docs.fusion.vectra.ai/netography-query-language/nql-examples.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.