Boolean operators include AND, OR, and NOT.
By default, a space between query terms is considered an implicit “and”, and the search is inclusive of all terms specified.
The order of precedence for AND, OR, and NOT is:
NOT, which binds to what immediately follows it
AND (explicit)
AND (implicit, or no AND is entered, but a space exists between two terms)
OR
The valid symbols for AND are:
AND
and
&&
(single empty space)
The valid symbols for OR are:
OR
or
|| (double bars)
For example:
http and tcp or ftp:(http and tcp) or ftp
http tcp or ftp:http and (tcp or ftp)
The operator NOT binds to what is immediately after it. For example:
not ftp
The valid symbols for NOT are:
Note
Only ! can be used as a prefix for the : and = comparison operators.
NOT
Not
! (exclamation point with no space before next search term)
For example:
rawmsg!:&[/192.168/,tcp,ERROR*]
Result: will return only those results that do not include the regular expression /192.168/, the term tcp, or the prefix ERROR.
&[srcipv4,dstipv4]!:&["192.168.100/24","192.168.101/24"]
Result: will return only those results for srcipv4 and dstipv4 that do not lie within either specified CIDR range.