Limitation in IP Enrichment via Entity Context

Question

Hi All,i was trying to ASN enrichment via Entity Context I tried both GLOBAL and ENTITY context but unable to trigger rule Code Snippet $ipcti.graph.entity.artifact.ip = $source_ip  //  e.g. 8.8.8.8(             $ipcti.graph.metadata.source_type = "GLOBAL_CONTEXT"              or              $ipcti.graph.metadata.source_type = "ENTITY_CONTEXT"        )        $ipcti.graph.metadata.entity_type = "IP_ADDRESS"        $ipcti.graph.entity.artifact.network.asn = /google|xyz/ nocaseany suggestion to enrich asn ?

jstoner · Answer

The geo enrichment occurs directly in the UDM event so there should be any linkage to the graph needed. Here is an example query looking at network connection events where the IP address is part of the ASN associated with Microsoft.

metadata.event_type = "NETWORK_CONNECTION"
target.ip_geo_artifact.network.asn = "8068"

Here is a view of the schema:

ip:(1)

->0:"52.113.194.132"

ip_geo_artifact:(1)

->0:(3)

-- ip:"52.113.194.132"

--location:(4)

---country_or_region:"United States"

---region_coordinates:(2)

----region_latitude:38.794594

----region_longitude:-106.534836

--network:(3)

---asn:"8068"

---carrier_name:"microsoft corporation"

---organization_name:"microsoft corporation"

Sign up

Login with SSO

Login to the community

Login with SSO