Cisco appz for all addresses

[cmeo]

I'm in the process of figuring out the cisco-related apps and add-ons, and one notable point is that by default 10.* and 192.* RFC 1918 private IPs are excluded. Our customer specifically wants to know what his internal users are doing. What changes do I make to include all internal as well as external addresses?

Incidentally by not filtering out 172.* addresses as well, this doesn't work properly anyway.

Will probably knows this one 🙂

[Will_Hayes]

Hi, Can you elaborate a bit on what you mean by excluded. The only exclusion that I'm aware of is the flash maps will omit internal IPs by default since they will fail a geo lookup. You can have this function work on internal IPs we just need to provide the geo translation through another means. is there exclusion taking place anywhere else in the add-ons?

[cmeo]

Here is the search:
search = eventtype=cisco_* src_ip=* src_ip!=10.* src_ip!=192.* src_ip!=0.0.* | stats count by src_ip | eval count_label="Cisco Security Event" | eval iterator="src_ip" | eval iterator_label="IP" | eval movie_color="#FF0000" | eval output_file="home_threat_data.xml" | eval app="SplunkforCiscoSecurity" | lookup geoip clientip as src_ip | mapit

If I understand the filtering correctly, this will exclude any internal addresses (except for 172.*) from the results altogether, not just for mapping purposes. So, how do you set up internal mapping?