AnsweredAssumed Answered

IP feeds

Question asked by Sean Koniarz on Feb 4, 2014
Latest reply on Mar 30, 2014 by Rui Ataide

Like • Show 0 Likes0
Comment • 3

Hey,

I am looking to create a more exact feed but I am not sure if it is possible. Is it possible for the feed to label based on ip.src/ip.dst differently?

The main feed we are trying to create is getting each of our IP ranges and label them, we use the whole 10.0.0.0/8 range for us and our clients. What I want it to do is be able to say that if 10.1.1.1 is a source IP label it x_x_src or if it is a dest x_x_dst. Does anyone know if this is possible? I am not sure if using a custom xml would work?

I currently have it working using app rules but I would much rather have it done using a feed so the network team can keep it updated.

Any help is appreciated.

Rui Ataide

Mar 30, 2014 8:32 AM

Correct Answer

I've found the same issue with the SA wizard but the backend still supports it as it used to. So using XML you can easily address this issue. I'm sure it will be fixed soon but until then, here's the examples I normally use/modify.

<FDF>
  <FlatFileFeed name="Network Feed" path="net-feed-cidr.csv" separator="," comment="#">
    <LanguageKeys>
                <LanguageKey name="org" valuetype="Text" srcname="org.src" destname="org.dst" />
                <LanguageKey name="domain" valuetype="Text" srcname="domain.src" destname="domain.dst" />
                <LanguageKey name="city" valuetype="Text" srcname="city.src" destname="city.dst" />
    </LanguageKeys>
    <Fields>
      <Field index="1" type="index" range="cidr"/>
      <Field index="2" type="value" key="org"/>
      <Field index="3" type="value" key="domain"/>
      <Field index="4" type="value" key="city"/>
    </Fields>
  </FlatFileFeed>
</FDF>

I hope this helps! I believe the CSV name is slightly irrelevant by I try to have it match my CSV filename. As mentioned range should also work just use:

   <Fields>
      <Field index="1" type="index" range="low"/>
      <Field index="2" type="index" range="high"/>
      <Field index="3" type="value" key="org"/>
      <Field index="4" type="value" key="domain"/>
    </Fields>

Regards,

Rui

See the reply in context

No one else had this question

Outcomes

RSA Admin

Feb 4, 2014 4:20 PM

One option would be to have two different XML files that reference the same CSV.

Create the csv file with your ip.src and ip.dst return values in different columns:

#ip,if_src,if_dst

1.2.3.4,proxy_server,,

4.3.2.1,,malicious_address

XML file for ip.src returns column 2, XML file for ip.dst returns column 3.

It's been a while since I've set up a new feed so my memory is a bit rusty, but it may be possible to have the two different functions as separate stanzas in the same XML file. But worst case, you need two separate XML files and two copies of the CSV file.

I'll also throw out for your additional research that you can do both VLSM/CIDR block comparisons in your feeds (i.e. the feed has 10.42.42.0/24 and any matching host address will return the meta), as well as address ranges (low IP to high IP).

Actions

huan zhou @ RSA Admin on Mar 24, 2014 10:23 AM

yah, i think two feends would be fine. one ip.src, one for ip.dst

Actions

Rui Ataide

Mar 30, 2014 8:32 AM

<FDF>
  <FlatFileFeed name="Network Feed" path="net-feed-cidr.csv" separator="," comment="#">
    <LanguageKeys>
                <LanguageKey name="org" valuetype="Text" srcname="org.src" destname="org.dst" />
                <LanguageKey name="domain" valuetype="Text" srcname="domain.src" destname="domain.dst" />
                <LanguageKey name="city" valuetype="Text" srcname="city.src" destname="city.dst" />
    </LanguageKeys>
    <Fields>
      <Field index="1" type="index" range="cidr"/>
      <Field index="2" type="value" key="org"/>
      <Field index="3" type="value" key="domain"/>
      <Field index="4" type="value" key="city"/>
    </Fields>
  </FlatFileFeed>
</FDF>

I hope this helps! I believe the CSV name is slightly irrelevant by I try to have it match my CSV filename. As mentioned range should also work just use:

   <Fields>
      <Field index="1" type="index" range="low"/>
      <Field index="2" type="index" range="high"/>
      <Field index="3" type="value" key="org"/>
      <Field index="4" type="value" key="domain"/>
    </Fields>

Regards,

Rui

Actions

IP feeds

Outcomes

Related Content

Recommended Content