topic Re: Need stdlib.aggregatorIPv4Generic to provide single IPs instead of IP r in General Topics

Need stdlib.aggregatorIPv4Generic to provide single IPs instead of IP ranges

GabrielNBJJ — Fri, 10 Apr 2020 12:20:26 GMT

Hello all,

I am trying to use Minemeld in a setup with Microsoft Sentinel (Microsoft Graph).

I am encountering an issue with entities of type IP, as they are getting in my log analytics space as IP ranges, mentioned in the "ExternalIndicatorID" along with the word IPv4. I cannot process that and I need single IP alone in another column, like NetworkIP.

Is there any way to change the processor to provide single IPs instead of ranges?

Thank you.

Re: Need stdlib.aggregatorIPv4Generic to provide single IPs instead of IP ranges

GabrielNBJJ — Fri, 10 Apr 2020 13:10:53 GMT

I found some info about modifying the FEED URL, however I have no such URL in my Microsoft output node.

Any workarounds to that?

Thanks.

Re: Need stdlib.aggregatorIPv4Generic to provide single IPs instead of IP r

papham — Mon, 20 Jul 2020 18:23:38 GMT

Hi, just curious if you found any resolution of that issue ?

Get the same issue in Log analytics. All my Ipv4 indicators are in CIDR too in Azure Log Anytic

I found a workaround with KQL ipv4_is_match() function but didn't try it.

https://docs.microsoft.com/en-us/azure/data-explorer/kusto/query/ipv4-is-matchfunction