We use an asset file correctly configured on ES but we noticed that the enrichment based on "asset_lookup_by_cidr" is not working correctly because the lookup is not sorted by CIDR class. For example in the following sample the sorting is base on "lexicographic" order instead of the real CIDR classes logic:
1.2.30.0/26
1.2.30.128/25
1.2.31.0/24
1.2.32.0/24
1.2.33.0/25
1.2.33.128/25
We tried to solve the problem creating a saved search that automatically performs the right sort but soon after the execution the lookup "asset_lookup_by_cidr" is replaced with "lexicographic" order.
My saved search:
| inputlookup asset_lookup_by_cidr
| eval ip=replace(ip,"\s+","")
| eval sorted=case(match(ip,"\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\/\d{2}"),substr(ip,-2),match(ip,"\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\/\d{1}"),substr(ip,-1),1=1,"0")
| sort limit=0 - sorted
| fields - sorted
| outputlookup asset_lookup_by_cidr
Is there a quick solution to this problem? Because it is a big trouble for notable based on IP addresses.
After trying many possibilities, I eventually ran the reset collections in asset and identity management section. It’s the first time I ever run this task, and it seems it solved the problem completely.
Is reset collections something that I have to plan to execute periodically or according to some change that I make on the asset lookups?
Are there any side effects in performing this task that I should be aware of?