Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?

 

User and Network Monitoring Query Examples

 

Use query examples to help you create your user and network monitoring query AQL queries.

Use the following examples to monitor your users and network, or you can edit the queries to suit your requirements.

Find Users Who Used the VPN to Access the Network from Three or More IP Addresses in a 24-hour Period

This query outputs the username and Source IP count columns.

The username column returns the names of users who used the VPN to access the network from three or more IP addresses in the last 24 hours.

Find Users Who Used the VPN from More That One Geographic Location in 24 Hours

This query outputs the username and Count of locations columns.

The username column returns the names of users who used the VPN from more than one location that is not called 'other location' in the last 24 hours.

Monitoring Local to Remote Flow Traffic by Network

This query outputs the sourceip and TotalBytes columns.

The TotalBytes column returns the sum of the source and destination bytes that crosses from local to remote.

Monitoring Remote to Local Flow Traffic by Network

This query outputs the sourceip and TotalBytes columns.

The TotalBytes column returns the sum of the source and destination bytes from remote to local.

Application Usage by Application Name, Users, and Flows Traffic

This query outputs data about your asset users, application names, and flow data. Use this query to report specific user activity or application usage, or to build a variation of this query to achieve your desired results.

Location Of Assets

This query outputs the asset_location and count columns.

The asset location column returns the location of the assets.

Copying Query Examples from the AQL Guide

If you copy and paste a query example that contains single or double quotation marks from the AQL Guide, you must retype the quotation marks to be sure that the query parses.