CIDR Lookup or Join for IP Enrichment

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements

CIDR Lookup or Join for IP Enrichment

L0 Member

I would like to use some custom datasets to enrich some of our XQL searches.  It could be our subnets from our IPAM or in this example the ASN information.  I have used lookups and joins in the past to accomplish this in others tools and would like to do the same with Cortex XQL.  I did look at incidr and incidrlist but it seems to be the opposite of what I'm looking for.

 

Results would look like below with the ASN org field

_timeactor_process_image_nameaction_remote_ipautonomous_system_organization
Jun 1st 2022curl100.20.0.15AMAZON-02

 

 

Base XQL Search

preset = network_story
| filter actor_process_image_name contains "curl" and action_total_upload > 1048576
| fields actor_process_image_name, action_remote_ip

 

Custom Dataset

dataset = geo_asn_ip4

 

networkautonomous_system_numberautonomous_system_organization
100.20.0.0/1416509AMAZON-02
100.24.0.0/1314618AMAZON-AES
103.119.213.0/2416509AMAZON-02

 

Bonus Question

I know that XDR already has the ASN information as they have some alerts based off of it.  Is there a way a customer could leverage this data instead of building our own dataset?

 

Thanks in advance

JustSomeGuy
2 REPLIES 2

L3 Networker

Hi @GolfHacker ,

 

Thanks for posting to our Live Community Forum. Currently the ASN information is not present in the XQL so we recommend leveraging custom datasets just like the one you've created for mapping.

 

Thanks,

Silviu

Silviu-Mihail Dascalu

L0 Member

That is good to know that a custom dataset is the only option today.

Do you know of an XQL command that will work with a custom CIDR dataset like I have listed above?

JustSomeGuy
  • 1787 Views
  • 2 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!