Splunk Search

Subnet collection

splunkinmcsplun
New Member

I want to be able to find the most vulnerable subnet. I know how to verify if an ip is in a subnet by using the cirdmatch function, but I want to collect subnets into a transaction (or just a collection) and then be able to do a search on these subnets to find which one contains the most number of vulnerabilities.

Any help would be appreciated!

Tags (2)
0 Karma

Lowell
Super Champion

If you have a small number of subnets, you could use a technique like this:

<Vulnerability search> ... | eval subnet=case(cidrmatch("10.0.0.0/24", ip), "Subnet 10.0.0.x",  cidrmatch("10.0.0.1/24", ip), "Subnet 10.0.1.x",  0==0, "Unknown subnet") | stats count by subnet

As long as <Vulnerability search> returns events with an ip field, this simple technique should work. As far as I know, there's no simple way to automatically group IPs into subnets without actually defining what size of each individual network.

If all of your networks are "/24"s, then you could do something trivial like:

<Vulnerability search> ... | eval subnet=replace(ip, "^(\d+\.\d+\.\d+\).\d+$", "\1.x") | stats count by subnet

But that's about as far as regex tricks will take you. 😞

BTW, if you have a large range of subnets, or want an approach that more generally reusable, then I'd recommend using lookups. See the answer Using CIDR in a lookup table for the specifics on how to set this up in a lookup file.

0 Karma

Ayn
Legend

First of all you need to be able to define what a subnet is...

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In January, the Splunk Threat Research Team had one release of new security content via the Splunk ES Content ...

Expert Tips from Splunk Professional Services, Ensuring Compliance, and More New ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Observability Release Update: AI Assistant, AppD + Observability Cloud Integrations & ...

This month’s releases across the Splunk Observability portfolio deliver earlier detection and faster ...