Solved
Searching for logs using subnet filter in UDM
Best answer by cmorris
Please ty the net.ip_in_range_cidr function - https://docs.cloud.google.com/chronicle/docs/detection/yara-l-2-0-functions/net-ip_in_range_cidr
+11Please ty the net.ip_in_range_cidr function - https://docs.cloud.google.com/chronicle/docs/detection/yara-l-2-0-functions/net-ip_in_range_cidr
Here is the exact syntax I had to use.
net.ip_in_range_cidr($e.principal.ip, "192.0.2.0/24")
But I could not combine it using AND
I had to apply and run the search and then filter on other fields.
Does anyone know how I can combine in
+11Can you try something like this? Please adjust event_type, port, and CIDR as needed.
metadata.event_type = "NETWORK_CONNECTION"
target.port = 80
net.ip_in_range_cidr(principal.ip, "192.168.0.0/16")The query above works on my tenant and returns results here:
Login to the community
Login with SSO
Enter your E-mail address. We'll send you an e-mail with instructions to reset your password.