Add srcipaddr filter

hunngu-ms · hunngu-ms · commit bc369a742bd9 · 2026-04-08T15:30:44.000-07:00
diff --git a/Parsers/ASimAuthentication/Parsers/vimAuthenticationPaloAltoGlobalProtect.yaml b/Parsers/ASimAuthentication/Parsers/vimAuthenticationPaloAltoGlobalProtect.yaml
@@ -196,6 +196,7 @@ ParserQuery: |
               dynamic([])
           )
       | where (array_length(targetappname_has_any) == 0 or TargetAppName has_any(targetappname_has_any))
+      | where (array_length(srcipaddr_has_any_prefix) == 0 or has_any_ipv4_prefix(SrcIpAddr, srcipaddr_has_any_prefix))
       | project-rename
           DvcIpAddr = Computer,
           DvcId = DeviceExternalID,

Original file line number	Diff line number	Diff line change
`@@ -196,6 +196,7 @@ ParserQuery: \|`
`196`	`196`	`dynamic([])`
`197`	`197`	`)`
`198`	`198`	`\| where (array_length(targetappname_has_any) == 0 or TargetAppName has_any(targetappname_has_any))`
	`199`	`+ \| where (array_length(srcipaddr_has_any_prefix) == 0 or has_any_ipv4_prefix(SrcIpAddr, srcipaddr_has_any_prefix))`
`199`	`200`	`\| project-rename`
`200`	`201`	`DvcIpAddr = Computer,`
`201`	`202`	`DvcId = DeviceExternalID,`