CIDR Lookup or Join for IP Enrichment

[GolfHacker]

I would like to use some custom datasets to enrich some of our XQL searches.  It could be our subnets from our IPAM or in this example the ASN information.  I have used lookups and joins in the past to accomplish this in others tools and would like to do the same with Cortex XQL.  I did look at incidr and incidrlist but it seems to be the opposite of what I'm looking for.

Results would look like below with the ASN org field

_time	actor_process_image_name	action_remote_ip	autonomous_system_organization
Jun 1st 2022	curl	100.20.0.15	AMAZON-02

Base XQL Search

preset = network_story
| filter actor_process_image_name contains "curl" and action_total_upload > 1048576
| fields actor_process_image_name, action_remote_ip

Custom Dataset

dataset = geo_asn_ip4

network	autonomous_system_number	autonomous_system_organization
100.20.0.0/14	16509	AMAZON-02
100.24.0.0/13	14618	AMAZON-AES
103.119.213.0/24	16509	AMAZON-02

Bonus Question

I know that XDR already has the ASN information as they have some alerts based off of it.  Is there a way a customer could leverage this data instead of building our own dataset?

Thanks in advance

[SilviuMihailDascalu]

Hi @GolfHacker ,

Thanks for posting to our Live Community Forum. Currently the ASN information is not present in the XQL so we recommend leveraging custom datasets just like the one you've created for mapping.

Thanks,

Silviu

[GolfHacker]

That is good to know that a custom dataset is the only option today.

Do you know of an XQL command that will work with a custom CIDR dataset like I have listed above?