How do I remove an IP Range from a Search?

[AidanMarkSmith]

We currently have the user case  - High Number of Login Failures from a single source turned on

We would like to exclude some IP ranges from the search that we failover our staff to.

Our Search terms at the moment is -

index=appext_o365 `o365_management_activity` Operation=UserLoginFailed record_type=AzureActiveDirectoryStsLogon app=AzureActiveDirectory | stats count dc(user) as accounts_locked values(user) as user values(LogonError) as LogonError values(authentication_method) as authentication_method values(signature) as signature values(UserAgent) as UserAgent by src_ip record_type Operation app | search accounts_locked >= 10| `high_number_of_login_failures_from_a_single_source_filter`

I added | search src_ip!="###.##.##.17" |  which does remove that one IP, from the search but obviously I dont want to manually put in 1 to 128.

Any assistance would be very much appreciated

[gcusello]

Hi @AidanMarkSmith,

as @diogofgm hinted, please try:

index=appext_o365 `o365_management_activity` Operation=UserLoginFailed record_type=AzureActiveDirectoryStsLogon app=AzureActiveDirectory NOT src_ip="192.168.1.0/24"
| stats 
   count dc(user) as accounts_locked 
   values(user) as user 
   values(LogonError) as LogonError 
   values(authentication_method) as authentication_method 
   values(signature) as signature 
   values(UserAgent) as UserAgent 
   by src_ip record_type Operation app 
| where accounts_locked > 9
| `high_number_of_login_failures_from_a_single_source_filter`

Ciao.

Giuseppe

[AidanMarkSmith]

Hi @gcusello 

index=appext_o365 `o365_management_activity` Operation=UserLoginFailed record_type=AzureActiveDirectoryStsLogon app=AzureActiveDirectory NOT src_ip="192.168.1.0/24" | stats count dc(user) as accounts_locked values(user) as user values(LogonError) as LogonError values(authentication_method) as authentication_method values(signature) as signature values(UserAgent) as UserAgent by src_ip record_type Operation app | where accounts_locked > 9 | `high_number_of_login_failures_from_a_single_source_filter`

This is still showing my IP range in the search unfortuantely.

[diogofgm]

Are you using the correct range? Also try to change the last octet from 0 t0 1

Check your network range CIDR notation in here:
https://www.ipaddressguide.com/cidr

[diogofgm]

You can use CIDR notations in search.

src_ip="192.168.1.0/24"

[AidanMarkSmith]

Thanks for the quick reply, I've tried that and they still appear in the search.