> For the complete documentation index, see [llms.txt](https://docs.fusion.vectra.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.fusion.vectra.ai/network-query-language/nql-examples.md).

# NQL Examples

We have categorized these examples and provided a base query that you can customize to your own infrastructure and network topography: Search for and alert on specific traffic For example, East/West o

We have categorized these examples and provided a base query that you can customize to your own infrastructure and network topography:

### Search for and alert on specific traffic <a href="#search-for-and-alert-on-specific-traffic" id="search-for-and-alert-on-specific-traffic"></a>

For example, East/West or North-South or compliance requirements or in a forensics investigation.

#### Outbound traffic <a href="#outbound-traffic" id="outbound-traffic"></a>

{% tabs %}
{% tab title="NQL" %}

```sql
srcinternal == true && dstinternal == false
```

{% endtab %}
{% endtabs %}

#### Inbound traffic <a href="#inbound-traffic" id="inbound-traffic"></a>

{% tabs %}
{% tab title="NQL" %}

```sql
srcinternal == true && dstinternal == true
```

{% endtab %}
{% endtabs %}

### Search for and alert on geographic-based activity <a href="#search-for-and-alert-on-geographic-based-activity" id="search-for-and-alert-on-geographic-based-activity"></a>

Discover compromised devices via traffic from countries of concern, or for responding to threats or proactively threat hunting.

#### Outbound traffic to T1 CoC <a href="#outbound-traffic-to-t1-coc" id="outbound-traffic-to-t1-coc"></a>

{% tabs %}
{% tab title="NQL" %}

```sql
dstgeo.countrycode == MM OR dstgeo.countrycode == CN OR dstgeo.countrycode == ER OR dstgeo.countrycode == IN OR dstgeo. countrycode == IR OR dstgeo.countrycode == NG OR dstgeo. countrycode == KP OR dstgeo.countrycode == PK OR dstgeo. countrycode == RU OR dstgeo.countrycode == SA OR dstgeo. countrycode == SY OR dstgeo.countrycode == TJ OR dstgeo. countrycode == TM OR dstgeo.countrycode == VM
```

{% endtab %}
{% endtabs %}

### Bad Actors <a href="#bad-actors" id="bad-actors"></a>

Such as finding IP reputation-based traffic, botnets, or phishing/spammers.

#### IPs that matched an IP reputation list <a href="#ips-that-matched-an-ip-reputation-list" id="ips-that-matched-an-ip-reputation-list"></a>

{% tabs %}
{% tab title="NQL" %}

```sql
dstiprep.count >= 1 or srciprep.count >= 1
```

{% endtab %}
{% endtabs %}

#### Outbound traffic to non-approved geographies <a href="#outbound-traffic-to-non-approved-geographies" id="outbound-traffic-to-non-approved-geographies"></a>

{% tabs %}
{% tab title="NQL" %}

```sql
srcipname == PointOfSaleSystem AND (dstgeo.countrycode != US OR dstgeo.countrycode != CA)
```

{% endtab %}
{% endtabs %}

### Configuration validation or misconfiguration <a href="#configuration-validation-or-misconfiguration" id="configuration-validation-or-misconfiguration"></a>

Finding traffic that should not exist between applications and systems or drift between deployments.

#### Web application database <a href="#web-application-database" id="web-application-database"></a>

{% tabs %}
{% tab title="NQL" %}

```sql
(srcipname == websvr && dstipname != appSvr) or (srcipname != websvr && dstipname != appSvr)
```

{% endtab %}
{% endtabs %}

### Compliance <a href="#compliance" id="compliance"></a>

Enforce compliance for specific applications or regions or make your reporting or compliance audits easier with audit-ready proof of enforcement.

#### Detect network activity on specific ports <a href="#detect-network-activity-on-specific-ports" id="detect-network-activity-on-specific-ports"></a>

{% tabs %}
{% tab title="NQL" %}

```sql
srcinternal == true && protocol == udp && (dstport == 137 OR dstport == 138 OR dstport == 139)
```

{% endtab %}
{% endtabs %}

#### Search for traffic between production environments and dev or test <a href="#search-for-traffic-between-production-environments-and-dev-or-test" id="search-for-traffic-between-production-environments-and-dev-or-test"></a>

{% tabs %}
{% tab title="NQL" %}

```sql
tags == Production && (tags == dev or tags == test)
```

{% endtab %}
{% endtabs %}

#### Show (presumed) successful flows from the Internet to the internal network, of SSH protocol <a href="#show-presumed-successful-flows-from-the-internet-to-the-internal-network-of-ssh-protocol" id="show-presumed-successful-flows-from-the-internet-to-the-internal-network-of-ssh-protocol"></a>

{% tabs %}
{% tab title="NQL" %}

```sql
srcinternal == false && dstinternal == true && bits > 300 && packets > 3 && dstport:22
```

{% endtab %}
{% endtabs %}

#### FTP and Telnet usage <a href="#ftp-and-telnet-usage" id="ftp-and-telnet-usage"></a>

{% tabs %}
{% tab title="NQL" %}

```sql
protocol == tcp && tcpflags.ack == true && (dstport == 21 || dstport == 23)
```

{% endtab %}
{% endtabs %}

### Discovery by port and protocol usage <a href="#discovery-by-port-and-protocol-usage" id="discovery-by-port-and-protocol-usage"></a>

#### Discover devices using SSH outbound <a href="#discover-devices-using-ssh-outbound" id="discover-devices-using-ssh-outbound"></a>

{% tabs %}
{% tab title="NQL" %}

```sql
protocol == tcp && dstport == 22 && tcpflags.ack == true && dstinternal != true
```

{% endtab %}
{% endtabs %}

#### Discover devices sending > 100MB of data outbound <a href="#discover-devices-sending--100mb-of-data-outbound" id="discover-devices-sending--100mb-of-data-outbound"></a>

{% tabs %}
{% tab title="NQL" %}

```sql
srcinternal == true AND dstinternal == false track by srcip, dstip threshold sum(bits) > x
```

{% endtab %}
{% endtabs %}

#### x11 Discovery <a href="#x11-discovery" id="x11-discovery"></a>

{% tabs %}
{% tab title="NQL" %}

```sql
protocol == tcp and (dstport >= 6000 and dstport \<= 6002)
```

{% endtab %}
{% endtabs %}

#### BitTorrent traffic discovery <a href="#bittorrent-traffic-discovery" id="bittorrent-traffic-discovery"></a>

{% tabs %}
{% tab title="NQL" %}

```sql
protocol == tcp and (dstport >= 6881 and dstport \<= 6889)
```

{% endtab %}
{% endtabs %}

#### Outbound SSH Traffic <a href="#outbound-ssh-traffic" id="outbound-ssh-traffic"></a>

{% tabs %}
{% tab title="NQL" %}

```sql
srcinternal == true && dstinternal == false && dstport == 22
```

{% endtab %}
{% endtabs %}

#### Outbound Unencrypted Web traffic <a href="#outbound-unencrypted-web-traffic" id="outbound-unencrypted-web-traffic"></a>

{% tabs %}
{% tab title="NQL" %}

```sql
srcinternal == true && dstinternal == false && dstport == 80 || dstport == 8080
```

{% endtab %}
{% endtabs %}

#### Outbound Unencrypted FTP traffic <a href="#outbound-unencrypted-ftp-traffic" id="outbound-unencrypted-ftp-traffic"></a>

{% tabs %}
{% tab title="NQL" %}

```sql
srcinternal == true && dstinternal == false && dstport == 20 || port == 21
```

{% endtab %}
{% endtabs %}

#### Outbound Unencrypted Telnet traffic <a href="#outbound-unencrypted-telnet-traffic" id="outbound-unencrypted-telnet-traffic"></a>

{% tabs %}
{% tab title="NQL" %}

```sql
srcinternal == true && dstinternal == false && dstport == 23
```

{% endtab %}
{% endtabs %}

#### Netbios outbound ports <a href="#netbios-outbound-ports" id="netbios-outbound-ports"></a>

{% tabs %}
{% tab title="NQL" %}

```sql
srcinternal == true && dstinternal == false && dstport == 445 || dstport == 139 || dstport == 137
```

{% endtab %}
{% endtabs %}

#### Dynamic port to dynamic port <a href="#dynamic-port-to-dynamic-port" id="dynamic-port-to-dynamic-port"></a>

{% tabs %}
{% tab title="NQL" %}

```sql
(srcinternal == true && dstinternal == false && srcport > 49151 && dstport > 49151) && srcinternal == true && protocol == TCP
```

{% endtab %}
{% endtabs %}

#### Outbound encrypted DOT(853) <a href="#outbound-encrypted-dot853" id="outbound-encrypted-dot853"></a>

{% tabs %}
{% tab title="NQL" %}

```sql
srcinternal == true AND dstinternal == false dstport == 853
```

{% endtab %}
{% endtabs %}


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.fusion.vectra.ai/network-query-language/nql-examples.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.