Filtering CIDR in Netwitness Informer
I am working on an Informer Report and the for the query, I am trying to filter based on IP Range in Informer.
I wanted to confirm if CIDR based filtering is possible?
ip.src!='$WEBTIER' (in WHERE query)
filter_out('$WEBTIER', 'ip.src'); (in THEN Field)
I know != is expensive and hence i prefer the second option to filter_out() however none of them are working
$WEBTIER is a list of CIDRs
Currently in either of the options above, result is not filtering the IPs that fall in that cidr.
Any help is greatly appreciated.
- Community Thread
- Forum Thread
- RSA NetWitness
- RSA NetWitness Platform
The syntax appears to be valid, however the query will also likely be quite taxing on the system. If this is a one-time needed search, you are at the mercy of the system resources to complete the query - which comprises of a myriad of factors specific to your system architecture and size of your data set. If you intend to run a query like this in the future, a more efficient approach would be to have the Decoder tag those known CIDR nets before the sessions are filed away in the database by leveraging a custom feed. Then you would have significantly quicker responses from your query/report when searching on whatever meta you define that corresponds to that feed.