Regex exclude multiple subnets

[eprovin]

I'm trying to filter out a couple subnets using regex. This works fine: | regex connection.ip != "^172.16.\d{1,3}.\d{1,3}$" but when I'm having troubles excluding another subnet.

This does not work for me: | regex connection.ip != "^172.16.\d{1,3}.\d{1,3}$|^10.10.\d{1,3}.\d{1,3}$"

Any suggestions?

Thanks!

[solarboyz1 · Accepted solution]

Based on the example of /16 or /24, you could just use wildcard:

| search connection.ip!=172.16.* AND connection.ip!=10.10.*

or you could use cidrmatch if you need more complex matching:

| where NOT cidrmatch(172.16.0.0/16,connection.ip)

Or you might just try loosening up your regex, by removing the startline (^) and endline ($) markers, in case the value is space padded:

| regex connection.ip != "172.16.\d{1,3}.\d{1,3}|10.10.\d{1,3}.\d{1,3}"

[eprovin]

Loosening the regex did seem to do the trick - thanks!

[eprovin]

Thanks for the suggestion, but it still will only remove whichever filter is first. Any other ideas?

[Sukisen1981]

can we see the sample events and what you are trying to extract?

[eprovin]

index="divit" sourcetype="pps_messagelog" final_module=spam final_rule="safe" | dedup msg.header.message-id{}
| transaction filter.qid
| regex connection.ip != "^172.16.\d{1,3}.\d{1,3}$"
| table _time,connection.sid,filter.qid,envelope.from,msg.header.to,subject,connection.ip,connection.host

[richgalloway]

We need to see sample data to know what regex string will match it.

[Sukisen1981]

i meant your event samples...we need to see the two subnets you refer to and why the second rex is failing

[eprovin]

Sorry - newbie here. Is this what you're looking for?

  connection:   {   [-] 
     country:    eu 
     helo:   omp.save.spirit-airlines.com   
     host:   omp.save.spirit-airlines.com   
     ip:     12.130.136.48  
     protocol:   smtp:smtp  
     resolveStatus:  ok 
     sid:    2ubf9su5eg 
     tls:   {   [+] 
    }   
}