IP addresses Content Blade
3 years ago
Originally Published: 2010-01-05
Article Number
000045670
Applies To
RSA DLP 8.X, 9.X

Issue
Goal detect IP address using IP Addresses Content Blade
Not able to detect single IP without descriptive term

Resolution

The IP address content blade will match IP numbers, such as 10.0.0.1 but it requires 2 or more IP addresses (with no descriptive terms) to create an event. It will match on 1 IP address only if there are terms present such as IP, TCP or subnet. The logic behind the blade:

  • one IP address and a descriptive term
    or
  • two or more IP addresses (with no descriptive terms required).