Can Processor nodes put IPv4 addresses in order and in new ranges?

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

Can Processor nodes put IPv4 addresses in order and in new ranges?

L1 Bithead

I find myself wanting processor or output nodes to aggregate IPv4 addresses into new ranges and in order. Since some Palo boxes have a limitation of 50K addresses in a Dynamic List Object, it would help a lot to make my outputs fit in there. Especially since I find myself in front of an output that looks like this in some parts:

 

108.62.56.100-108.62.56.100
108.62.56.101-108.62.56.101
108.62.56.102-108.62.56.102
108.62.56.103-108.62.56.103
108.62.56.104-108.62.56.104
108.62.56.105-108.62.56.105
108.62.56.106-108.62.56.106
108.62.56.107-108.62.56.107
108.62.56.108-108.62.56.108
108.62.56.109-108.62.56.109

 

It could easily read 108.62.56.100-108.62.56.109... Any way to do this?

1 accepted solution

Accepted Solutions

Hi @michael.gabriel,

 

this is what indicator attributes are for. The Alien Vault miner attaches the following valuable attributes to each indicator:

  • alienvault_reliability
  • alienvault_risk and
  • alienvault_type

 

You can create multiple output nodes attached to the same source selecting only the indicators that match a given input filter criteria. For instance, the following graph splits the current +65K indicator list provided by Alien Vault based on the alienvault_risk attribute value.

 

2018-01-29_15-18-59.png

 

As you can see, there are only around 500 indicators with risk 4. You might combine the indicators with risk 4 and 5 into a general availability "critical EDL" and only consume the rest in high-end devices.

 

Example of node prototype to filter Alien Vault indicators based on its risk value.2018-01-29_15-19-51.png

 

 

 

 

 

 

View solution in original post

6 REPLIES 6

L5 Sessionator

Hi @michael.gabriel,

 

current MineMeld implementation can't do that. And I have some concerns about such agrupation. For instance, what the confidence level should be for the agrupated range? The average of the confidence level of its individual contributors?

 

What about splitting the list based on attribute values? By confidence? By source? etc. This way you could feed the low end devices with a subset of indicators (the most important ones) and the big end devices with the full list.

 

Thanks for the insight @xhoms ! You make a very valid point, and ultimately I want to do exactly that, but what is a little bit dissapointing for me is that some miners have an average of up to 60K entries... Let's say I was aiming at one of those miners to be an important one? What do I do with the target PAN-OS (only PAN-OS within a PA-5000 series and 7000 series can accept more than 50K IP's, going up to 150K) ?

Can you share with me the config of the Miner that is producing 60K entries?

It's the default alienvault.reputation miner. I don't even know yet if I want to use it, rather than asking myself if it is useful for a miner to have as many entries.

Hi @michael.gabriel,

 

this is what indicator attributes are for. The Alien Vault miner attaches the following valuable attributes to each indicator:

  • alienvault_reliability
  • alienvault_risk and
  • alienvault_type

 

You can create multiple output nodes attached to the same source selecting only the indicators that match a given input filter criteria. For instance, the following graph splits the current +65K indicator list provided by Alien Vault based on the alienvault_risk attribute value.

 

2018-01-29_15-18-59.png

 

As you can see, there are only around 500 indicators with risk 4. You might combine the indicators with risk 4 and 5 into a general availability "critical EDL" and only consume the rest in high-end devices.

 

Example of node prototype to filter Alien Vault indicators based on its risk value.2018-01-29_15-19-51.png

 

 

 

 

 

 

Super interesting! I had completely overlooked this while reading documentation, thank you very much @xhoms ! 

  • 1 accepted solution
  • 5965 Views
  • 6 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!