How to filter a network of IPs

[RSAAdmin]

Hi, I have created a correlation rule where I would like to create alerts when usernames from outside a specific network login to a F5 Firepass device. I am performing multithreading based on the username. The problem that I am facing is that I cannot add a network of IPs in the filter section of the correlation statement. I have tried with one IP and it works but I tried putting 10.24.12.20/24 but this didn;t work. How can I add a whole network to be excluded from the correlation rule? Thanks, Eleni

[RSAAdmin]

I used regular expression in a watchlist and it seems that is working now. I will perform more tests on that. Is that a valid approach?? Thanks, Eleni

[RSAAdmin]

You will need to do it as a regular expression (or set of regular expressions) as you already indicated. That is a perfectly valid way to approach the problem!

[RSAAdmin]

A neat trick is that you can use the "Between" operator. So this can be used to filter out a range of IP addresses, i.e. DeviceAddress Between '10.24.12.20' AND '10.24.12.250'

[RSAAdmin]

I am not aware of the BETWEEN operator being supported.  Do you have an example of where this operator will work, i.e. a report or query that uses this operator?

Paul

[RSAAdmin]

I haven't come across any "Between" operator. I do know though that 1) one can list all the ip address in watchlist and use "Not in Watchlist" 2) Configure a regex pattern and use the same. 3) Configure a "Not in" operator and mention each IP address as a new value (using in the UI) for the same operator.

[RSAAdmin]

Hi Paul,

There are two operators I have found that work within enVision that are not listed nor in any pre-made reports. The BETWEEN and !=

These could be used for example to search a specific range of IP Addresses or exclude an IP address:

1) DeviceAddress BETWEEN '192.168.0.0' AND '192.168.255.255'

2) DeviceAddress !='x.x.x.x'

I also believe that the XOR operator works as well - ^

[RSAAdmin]

I have done this with regex. Here is a handy site that will build the regex for you! http://www.analyticsmarket.com/freetools/ipregex

[ScottPause]

Yes.  This site.  We discovered it a few weeks ago for a project.  Handy indeed.  Now to make a local copy of it