Using cidrmatch with a CSV file throws error.

[ImanIself]

I am trying to match a list of CIDR ranges in a csv file to hosts that are going outbound on our network...basically trying to see if there are any naughty hosts trying to go to Russia. The search command is as follows:

sourcetype="cisco_syslog" | eval Fhost=cidrmatch([inputcsv rrcidrlist], cisco_dsthost)

When i run this the following error is returned: Error in 'eval' command: The number 46.19.104.0 is invalid.

The 46.19.104.0 just so happens to be the first IP in the list, however its doesn't appear to be reading the /21 at the end. Again, it doesn't appear to be reading the 46.19.104.0/21 CIDR range. There are no spaces in the CSV file. The documentation indicates that the double quotes should be used around the CIDR range however i have tried them everywhere and nothing seems to work. Any help would be greatly appreciated. Noobly appreciated 🙂

[hammon0u]

You can use the MAXMIND application to lookup IP against the MAXMIND db and report on anything that returns a lookup to Russia or China etc. You can even find the City in Russia where the packet went.

[gkanapathy]

The arguments to cidrmatch must be passed as strings, and therefore must be quoted. The results from your subsearch probably looks like:

( ( 46.19.104.0/21 ) )

or

( ( 46.19.104.0/21 ) OR ( 1.2.3.4/21 ) OR ... )

Anyway, the point is subsearch doesn't expand the way you think it does, and if you have multiple values, it is even less likely to work the way you think.

What you really need is:

sourcetype=ciso_syslog [ inputcsv rrcidrlist | fields iprange | rename iprange as cisco_dsthost ]

Which assumes that the fieldname in the CSV file that contains the CIDR ranges is iprange. If it isn't substitute appropriately.

[gkanapathy]

Yeah, so my example should do what you want.

[ImanIself]

I appreciate the quick response. It appears i was going in the wrong direction. Basically I want to compare a CSV list of CIDR ranges to a field which contains hosts attempting to connect externally and return any matches. We want to see if any hosts are attempting to connect to Russia/Romania.