topic Re: Filtering Azure IP ranges based on a subset of regions? in General Topics

Filtering Azure IP ranges based on a subset of regions?

mpetzold — Thu, 28 Dec 2017 22:01:54 GMT

I'm attempting to filter the azure.cloudIPs miner based on a subset of specific regions. I've customized IPv4 aggregators to specify individual regions (as shown below), and this works correctly. However what would the syntax be to filter on multiple regions?

ie, effectively something like azure_region == ['useast' or 'useast2']? I've tried a number of variations, but can't quite seem to make it work.

This is the syntax I have for a single region, and this does work:

accept withdraws	__method == 'withdraw'	accept
accept IPv4	type == 'IPv4' azure_region == 'usnorth'	accept
drop all		drop

Re: Filtering Azure IP ranges based on a subset of regions?

xhoms — Thu, 04 Jan 2018 08:59:58 GMT

Hi @mpetzold,

just add as many action lines as regions you want to capture before the "drop all" action line. Example of filter configuration to capture IPv4 indicators in regions useast and useast2

Re: Filtering Azure IP ranges based on a subset of regions?

mpetzold — Thu, 11 Jan 2018 17:02:00 GMT

Ha, sure enough it's just that simple; I was over-complicating it.

Thanks @xhoms!