How to filter CIDR in XQL search

John_Easton — Sat, 07 Aug 2021 12:18:34 GMT

Hi, I'm trying to build XQL queries that target internal vs external IP ranges.

This is easy in the normal query builder with 10.0.0.0/8|172.16.0.0/12|192.168.0.0/16 but I'm not able to re-create this in XQL.

dataset = xdr_data | filter event_type = NETWORK | filter action_remote_ip not in ("10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16")

I tried this to look for external connections but I still get results in those ranges so I think it's string matching instead of using the CIDR. I could do this by string matching but this doesn't scale well for some IP ranges.

I also looked at the 2 CIDR functions incidr and incidrlist however these have a different use case.

Does anyone know if this is possible? If so can you show me the syntax?

Thanks,

John.

Re: How to filter CIDR in XQL search

JRzepka — Wed, 11 Aug 2021 16:50:49 GMT

I think your search can be accomplished by using this filter setup:

dataset = xdr_data | filter event_type = NETWORK | alter remote_10 = incidr(action_remote_ip,"10.0.0.0/8") | alter remote_172 = incidr(action_remote_ip,"172.16.0.0/12") | alter remote_192 = incidr(action_remote_ip,"192.168.0.0/16") | filter remote_10 = false and remote_172 = false and remote_192 = false

topic How to filter CIDR in XQL search in Cortex XDR Discussions

How to filter CIDR in XQL search

Re: How to filter CIDR in XQL search