SIQL (Security Intelligence Query Language)

What Is SIQL?

SIQL (Security Intelligence Query Language) is FireMon's native query language, built into FireMon Security Manager, for searching firewall policies, rules, and objects. It supports flexible, granular searches, such as finding every rule that references a specific IP address or object, and returns results across millions of rules in under 10 seconds.

Key takeaways

• SIQL is FireMon's proprietary query language, not a general industry search standard.
• It searches across rules, objects, devices, vendor tags, and historical policy changes from a single console.
• Advanced users can enter SIQL queries directly in the filter bar; basic users can build the same searches with filter bricks.
• It's available throughout FireMon Security Manager, including Policy sub-menu list pages, Vendor Tags, and Security Rules exports.

Why SIQL Matters

Firewall teams managing a multi-vendor environment run into the same wall constantly: every console has its own search box, and none of them talk to each other. Finding every rule that touches a decommissioned server, references a specific IP, or carries a particular tag means logging into each device or manager one at a time and running a separate lookup. In an environment with millions of rules spread across on-premises firewalls, cloud security groups, and segmentation platforms, that process can eat an entire afternoon for a question that should take seconds to answer.

SIQL exists to close that gap. It's FireMon's own query language, built into the Security Manager platform, so a team can ask one question and get an answer that spans the entire normalized policy set, not just one device.

How It Works

SIQL runs against the policy, rule, and object data that FireMon Security Manager normalizes from more than 120 firewall and cloud platforms. Because that data is translated into one common structure, a SIQL query doesn't care whether the underlying rule lives on a Check Point firewall, a Palo Alto Networks firewall, or an AWS security group; the search logic is the same everywhere.

In the product, users have two ways in. The default filter bar is set to Basic, which lets a team build a query visually using filter bricks, no syntax required. Switching to Advanced opens the filter bar to manual SIQL entry, for users who want to write more precise or complex queries directly. Both paths run against the same underlying index, which is why FireMon's documentation describes SIQL queries as searchable using specific fields, such as policytagname and policytagvalue for rule tags, along with source, destination, service, and scope qualifiers. The Vendor Tags page, for example, supports SIQL search for filtering by display name, type, and key/value pairs, and clicking a tag on a Security Rule, Network Object, Service, or Application Object links back to the Vendor Tags page with the matching SIQL query already applied.

A Realistic Example

A security team needs to confirm that a legacy application server, scheduled for decommissioning, no longer has any active rules pointing to its IP address before they pull it from the network. Instead of checking each firewall console individually, they open the Security Rules list in FireMon Security Manager, switch to Advanced, and run a SIQL query for that IP across every device. The search returns every matching rule, on every platform, in one pass, confirming in seconds whether it's safe to proceed.

The Operational Consequence

When rule lookups depend on manual, device-by-device searching, investigations slow down and small questions turn into multi-hour tasks. That delay has a real cost during an audit, when an incident response team needs to trace a rule's history fast, or when a cleanup project needs to confirm an object is truly unused before removing it. SIQL replaces that manual process with a single, indexed search across the full environment, which shortens investigation time and gives teams more confidence that their decisions are based on a complete picture, not a partial one.

Key Components and Best Practices

• Basic filter bricks for teams that want guided, point-and-click query building without learning syntax.
• Advanced manual entry for teams that want to write precise SIQL queries directly in the filter bar.
• Field-level search on elements like policy tag name and value, source, destination, service, and scope.
• Export integration, since filtered SIQL results in the Policy and Security Rules list pages can be exported directly to CSV or PDF.

Common Challenges

Teams new to SIQL sometimes default to Basic filter bricks for every search, even when a more precise Advanced query would return a cleaner result set faster. Getting comfortable with the Advanced syntax, and knowing which fields are searchable for a given object type, takes some initial ramp-up, though the filter bricks give new users a working alternative while they learn.

How SIQL Connects to Network Security Policy Management and FireMon

SIQL is one part of a larger discipline called network security policy management (NSPM): the practice of managing firewall and cloud security policy across its full lifecycle, from visibility through change control and audit. FireMon, the founder of NSPM, built SIQL into Security Manager as the search layer that sits on top of its normalized, multi-vendor rule repository. Policy is the control plane for network security, and a fast, accurate way to query that policy is part of what makes governing it possible at scale.