Splunk Search

Subnet collection

splunkinmcsplun
New Member

I want to be able to find the most vulnerable subnet. I know how to verify if an ip is in a subnet by using the cirdmatch function, but I want to collect subnets into a transaction (or just a collection) and then be able to do a search on these subnets to find which one contains the most number of vulnerabilities.

Any help would be appreciated!

Tags (2)
0 Karma

Lowell
Super Champion

If you have a small number of subnets, you could use a technique like this:

<Vulnerability search> ... | eval subnet=case(cidrmatch("10.0.0.0/24", ip), "Subnet 10.0.0.x",  cidrmatch("10.0.0.1/24", ip), "Subnet 10.0.1.x",  0==0, "Unknown subnet") | stats count by subnet

As long as <Vulnerability search> returns events with an ip field, this simple technique should work. As far as I know, there's no simple way to automatically group IPs into subnets without actually defining what size of each individual network.

If all of your networks are "/24"s, then you could do something trivial like:

<Vulnerability search> ... | eval subnet=replace(ip, "^(\d+\.\d+\.\d+\).\d+$", "\1.x") | stats count by subnet

But that's about as far as regex tricks will take you. 😞

BTW, if you have a large range of subnets, or want an approach that more generally reusable, then I'd recommend using lookups. See the answer Using CIDR in a lookup table for the specifics on how to set this up in a lookup file.

0 Karma

Ayn
Legend

First of all you need to be able to define what a subnet is...

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...