Need stdlib.aggregatorIPv4Generic to provide single IPs instead of IP ranges

[GabrielNBJJ]

Hello all,

I am trying to use Minemeld in a setup with Microsoft Sentinel (Microsoft Graph). 

I am encountering an issue with entities of type IP, as they are getting  in my log analytics space as IP ranges, mentioned in the "ExternalIndicatorID" along with the word IPv4. I cannot process that and I need single IP alone in another column, like NetworkIP.

Is there any way to change the processor to provide single IPs instead of ranges?

Thank you.

[GabrielNBJJ]

I found some info about modifying the FEED URL, however I have no such URL in my Microsoft output node.

Any workarounds to that?

Thanks.

[papham]

Hi, just curious if you found any resolution of that issue ? 

Get the same issue in Log analytics. All my Ipv4 indicators are in CIDR too in Azure Log Anytic

I found a workaround with KQL ipv4_is_match() function but didn't try it.

https://docs.microsoft.com/en-us/azure/data-explorer/kusto/query/ipv4-is-matchfunction