Filtering Azure IP ranges based on a subset of regions?

[mpetzold]

I'm attempting to filter the azure.cloudIPs miner based on a subset of specific regions. I've customized IPv4 aggregators to specify individual regions (as shown below), and this works correctly. However what would the syntax be to filter on multiple regions?

ie, effectively something like azure_region == ['useast' or 'useast2']? I've tried a number of variations, but can't quite seem to make it work.

This is the syntax I have for a single region, and this does work:

accept withdraws	__method == 'withdraw'	accept
accept IPv4	type == 'IPv4' azure_region == 'usnorth'	accept
drop all		drop

[xhoms · Accepted solution]

Hi @mpetzold,

just add as many action lines as regions you want to capture before the "drop all" action line. Example of filter configuration to capture IPv4 indicators in regions useast and useast2

[mpetzold]

Ha, sure enough it's just that simple; I was over-complicating it.

Thanks @xhoms!