Exclude IP range based on dynamic file list on the web

[pir8radio]

Question, the list returned in the link posted below updates now and then. I would like a way to filter my firewall results with a dropdown to "filter cloudflare IP's" using field3. anyway i just need an example on how I could use this dynamic list link below in my search to filter out those IP ranges? any easy way? I dont want to download the file and massage it, i would rather pull it live from their server, either on a schedule or whatever, then write a search to reference that list. otherwise i have to NOT, NOT, NOT and update my search whenever the new list comes out.

Link to dynamic IP Range list:
https://www.cloudflare.com/ips-v4

Current search:
sourcetype=Firewall Dst_Port!="-" Action=ALLOW Path=RECEIVE Src_IP=$field3$ Src_IP!="127.0.0.1" Src_IP!="::1" NOT (Src_IP="10.0.0.0/8" OR Src_IP="172.16.0.0/12" OR Src_IP="192.168.0.0/16")
| stats count by Src_IP Dst_Port Protocol Action
| sort -count
| rename Src_IP as "Source IP" Dst_Port as "Destination Port"

[to4kawa · Accepted solution]

sourcetype=Firewall Dst_Port!="-" Action=ALLOW Path=RECEIVE [|inputlookup ips_v4.csv |rename _raw as Src_IP | format] Src_IP!="127.0.0.1" Src_IP!="::1" NOT (Src_IP="10.0.0.0/8" OR Src_IP="172.16.0.0/12" OR Src_IP="192.168.0.0/16")
| stats count by Src_IP Dst_Port Protocol Action
| sort -count
| rename Src_IP as "Source IP" Dst_Port as "Destination Port"

[pir8radio]

see I thought of that but didn't try it, I didn't think the format would have worked. I'll give it a go, thanks.

[pir8radio]

but how do I add a web link as the lookup without manually downloading/uploading the file? I want this to happen automatically.

[to4kawa]

you should make add_on or script.

[pir8radio]

ok thats what i thought... Thanks, ill just grab the results in a powershell script and write to a file on schedule. Thanks.

[to4kawa]

If you make apps, mkdir lookups and put on your Csv.