NQE Discussions

This article explores NQE's robust pattern matching for extracting and parsing data, simplifying complex tasks with high-level, well-defined types for reporting and evaluation.Table of ContentsApproach 1: Leveraging the “or” pattern as described here Approach 1 Test  Approach 2 : Unifying multiple patterns Approach 2 Test Approach 3: Evaluation via token count Approach 3 Test Approach 1: Leveraging the “or” pattern as described here Using the following pattern`ntp server {"vrf" vrf:string server:string | server:string}`; We can accommodate various patterns for this command syntax by which the literal “vrf” and the VRF name maybe elided from the command. Instead of needing to create two separate patterns we can combine them into one expression.Looking closer at how we then extract the properties out of the data for vrf and server. The expression will append all properties to the left of the ‘|’ pipe operator to the data.left property and will append all properties to the right of the 

Is there a way to get the pair of switches for the VRRP protocol using NQE?

I am trying to get the output from commandType NHRP_STATE so I can then pull out the tunnel peer IPs with a patternmatch. When the NHRP table was a custom command the command.commandText was able to get this information, now how to do so that NHRP is part of the data model?

foreach device in network.devicesselect {  deviceName: device.name}For the above NQE, if I get the device names in the format “aaa_bbb_ccc”, is there a way to split the output based on the string “_” and have three different fields?

OverviewIn my recent work with Palo Alto firewalls, I noticed that keeping configurations compliant can get complex, especially when administrators need to modify default settings for certain applications. Small changes to session handling or TCP timeouts, while necessary for specific use cases, can introduce inconsistencies and potential compliance issues. I developed straightforward NQEs to create compliance checks that help us monitor and manage these configurations effectively. Key Benefits:Improved Visibility: The compliance checks I set up give us a clear view into any configuration deviations across firewalls, making it easy to spot unauthorized changes. Targeted Control: By creating separate compliance checks for different parameters, like session setup and timeouts, we can focus on what matters most in our environment. Unified Compliance Management: Even though Panorama handles many configurations, Forward Networks fills in the gaps by providing custom compliance checks, givin

how can i merger 2 or 3 NQE Query into 1 , so that i can get output in single file.

Hi Team, Can you help to get all the details verifying NTP/DNS and Fortiguard configuratioins ?

I am trying to get an NQE scheduled to run every 5 mins. and fetch if an interface has any errors and/or if the interface utilization is high ( >90%).With the below NQE i get an error as below - Any fields with bytes is not recognized..ERROR: Record does not have field: "bytesOut". interfaceUtilization(iface) = 100 * (sum(iface.bytesOut) - sum(iface.bytesIn)) / (sum(iface.bytesOut) + sum(iface.bytesIn));foreach device in network.devicesforeach interface in device.interfaceswhere interface.adminStatus == AdminStatus.UPselect { deviceName: device.name, interfaceName: interface.name, utilization: interfaceUtilization(interface)} Not sure why “bytes” is not recognized by the NQE How to have this scheduled to run every 5 mins ?

The below are two lines that we are trying to pull data out of, but it appears utilizing device.file.config  from the data model wont return the information because they are comments?  Thoughts?   !! Last configuration change at 13:58:30 ZULU Fri Oct 25 2024 by personx! NVRAM config last updated at 14:01:13 ZULU Thu Aug 22 2024 by persony!

Team, i am using below query to get the virtual server name and dst ip from below query , but somehow i am getting 0 result , can anyone please help . -=-------------------- pattern01 = ```Ltm::Virtual Server: {VirtualServer: string}    |   Availability   : {Availability: string}              |   State          : {State: string}                |   IP Address     : {Destination: ipv4Address}    |   Reason         : {Reason: string}```; foreach device in network.deviceswhere device.platform.vendor == Vendor.F5where device.snapshotInfo.result == DeviceSnapshotResult.completedforeach command in device.outputs.commandswhere command.commandType == CommandType.F5_VIRTUAL_SERVER_STATElet text = command.responselet text = replaceMatches(text, "\n", "\n    ")let text = replaceMatches(text, "    Ltm::Virtual Server: ", "Ltm::VirtualServer: ")let parsedCommand = parseConfigBlocks(OS.F5, text)foreach match in blockMatches(parsedCommand, pattern01)select {  device: device.name, VirtualServer: match.

Suppose you are using NQE queries to validate that your networking devices follow certain configuration benchmarks. You have an individual query for each benchmark, but you would also like a summary query that shows how each device in the network performs against every check. Here is how you can combine them.Below are two separate NQE queries that validate that the password policies on Cisco ASA devices require a minimum number of numbers and a minimum number of special characters, respectively.In each query, we define a function using the export command that takes in a Device as a parameter. export minNumber(device: Device) Then we call that function later in the same query with minNumber(device). This allows the query to be run on its own or part of another query.We save each file as min-numeric and min-special.pattern = ```password-policy minimum-numeric {minNum:number}```;checkPattern(config) = (max(blockMatches(config, pattern)))?.data?.minNum >= 1;export minNumber(device: Devi

how can i get the F5 POOL Member name ip and state and availability ?

I recently have done alot of work on building Golden Config and using NQE queries to find Actual Config on devices and compare to Golden Config and then building the remediation config so actual config will match Golden Config. I did this so Operations engineers can utilize the remediation config to implement on device either manually or through an Ansible playbook that utilizes the NQE Query and then build a workspace on devices being worked on to verify that Golden Config was implemented correctly on device(s). Below is a sample Query for a small section of config to ensure NTP configuration is correct on a Juniper device: goldenConfig_ntp_list =  ["set system ntp server 10.10.10.10",   "set system time-zone UTC"  ];foreach device in network.deviceswhere device.platform.os == OS.JUNOSlet outputs = device.outputsforeach command in outputs.commands  where command.commandText == "show configuration | display set"  let text = parseConfigBlocks(OS.JUNOS, command.response)let configList =

i am using below query to get the F5 Partition details.======================== foreach device in network.deviceswhere device.platform.vendor == Vendor.F5let outputs = device.outputsforeach c in outputs.commandswhere c.commandType == CommandType.PARTITION_CONFIGselect {  Device: device.name,  Location: device.locationName,  "Partition Name": c.response}=====================================  but the output is not looks good , i am also getting the Partition description in Output , i just need only Partition name only , Please help   

extractJson obtains a signatureId value that is a 9 digit Number. When viewing the results in the FN Results window the number appears with commas every three digits.  *When exporting the results to Excel the command is not included in the output.

For any users that may be looking to leverage a query to gather information on devices to compare with an existing CMDB inventory, or looking to import data into their existing CMDB to update inventory. Please checkout this NQE: /** * @intent Basic information about Network Devices for CMDB import/compare */formatStatus(deviceSnapshotResult) = when deviceSnapshotResult is collectionFailed(collectionError) -> "Collecting - " + replace(toString(collectionError), "DeviceCollectionError.", ""); completed -> "Completed"; processingFailed(processingError) -> "Processing - " + replace(toString(processingError), "DeviceProcessingError.", "");foreach device in network.deviceslet platform = device.platformlet snapshotInfo = device.snapshotInfoforeach component in platform.componentsselect { Name: device.name, Location: device.locationName, Tags: device.tagNames, Vendor: platform.vendor, Model: platform.model, "Part Serial Number": component.serialNumb

I have several questions around the NQE api endpoint for running a queries. This endpoint has parameters for limit and offset for the number of records to skip and how many records to request.(example from the documentation){  "query": "foreach d in network.devices select { Name: d.name }",  "queryId": "FQ_ac651cb2901b067fe7dbfb511613ab44776d8029",  "commitId": "84f84b0c0a0a1805ddff0ca5451c2c55c58605e5",  "queryOptions": {    "offset": 20,    "limit": 100,    "sortBy": {      "columnName": "Name",      "order": "ASC"    },    "columnFilters": [      {        "columnName": "Name",        "value": "MyDeviceName"      }    ]  },  "parameters": {    "mtuThreshold": 123,    "ntpServers": [      "10.22.2.3",      "192.33.4.1"    ]  }} I have a few questions, and would appreciate any guidance the community can providehow do i know the total number of records that is available ? do i just ask for the next number of records and if none are returned then i have the full set ? if i run the api fo

Introduction Hello Community!  I wanted to share something I’ve been working on that may be helpful to you. It's a query designed to manipulate list arrays by transforming list elements into fixed-length strings, which then lets us easily join, split, or pop elements.  NQE built-in functions provide list iteration and for the most part, this satisfies data model iteration for our queries. The approach presented here extends NQE list operation abilities to manipulate lists or extract specific values when required.To accomplish this  we can apply a well known process called fixed-length string encoding which involves standardizing the length of each item in a list. By transforming variable-length strings into uniform sizes, we can “index” each item making if possible  to perform operations like joining, splitting, and extracting elements. It opens up new possibilities for customizing functions beyond the basics of list iteration and hopefully, it will serve as a helpful tool when you nee

[Resolved]Hi team,when I am trying to use one NQE query for public IPs from Forward Network NQE Library to use it further more on my query, I am getting error while using this. Its showing me module error. 

I was asked by a customer to write an NQE check that would trigger a violation if there was not an explicit deny rule at the end of an ACL list. This query breaks down the acl list by acl name leveraging the group-by qualifier. We are also leveraging the `maxBy` function to find the last entry by leveraging the lineNumber property. // /**// * @intent Find acls by name, count and last entry// * @description test if there is an explicity deny rule at end of acl list// */acl_pattern_1 = `access-list {aclName:string} {!"remark"} {action:string} {rest:(string*)}`;maxLine(l) = l.line.lineNumber;foreach device in network.deviceswhere device.platform.vendor == Vendor.CISCOlet acls = patternMatches(device.files.config, acl_pattern_1)let acl_groups = (foreach acl in acls group acl as group_acls_by_name by { deviceName: device.name, aclName: acl.data.aclName } as v select { device

Hi Team , How can i get F5 VIP Ip and Pool address details by NQE. ThanksRohit

OverviewThis solution for renumbering line number defaults in NQEs addresses the issue of zero-based indexing by adding one to the line number output, aligning it with user expectations and conventional numbering in configuration files. This adjustment enhances usability and accuracy in network management by ensuring that outputs from NQEs are more intuitive and consistent with other data sources. Additionally, the logic can be applied to child line numbers, further improving the flexibility of the solution. Benefits Improved Usability: The adjustment aligns line numbers with user expectations, making outputs more intuitive and reducing confusion during configuration management and troubleshooting. Enhanced Accuracy: By providing one-indexed line numbers, the solution minimizes errors that could arise from mismatches between displayed and expected line numbers in configurations. Flexible Application: The logic used for renumbering can be extended to child line numbers, allowing for

Under the command type F5_LTM_POOL_STATE for F5 devices, the pool and pool members are in the following format:---------------------------------------------------------------------------------------Ltm::Pool: XXX ---------------------------------------------------------------------------------------Status Availability : XXX State : XXX ... -------------------------------------------------------------- | Ltm::Pool Member: XXX -------------------------------------------------------------- | Status | Availability : XXX | State : XXX ... -------------------------------------------------------------- | Ltm::Pool Member: XXX -------------------------------------------------------------- | Status

Hi Team,Can you please help me with a NQE Query to get SNMP configured IPs on Fortinet Devices. 

I have a custom source that is appending zeros to the end of the microseconds which may be the cause of FN seeing it as a Float. Would it be possible in future versions to force a string data type so it might be manipulated or is there any other way I can manage this from the FN side?   Excited to begin using the date and timestamp functions.  Do you think they will become data types that could be used in the extractJson strings eventually? Custom source value:  extractJson code: If i change the value to Number or String the query errors because it sees that value as a Floatselect code:  Result: