Hi, I am a beginner. I have a correlation rule that : - searches for IP addresses that are port scans - search in the lookup table, if each IP address is not listed - if an IP address is not in the lookup table: make an alert in ES - add this IP in the lookup table (to avoid duplicates)
I have two lookup tables : - scan_port.csv - network_provider.csv
Now I would like to filter the IP addresses by a lookup table (a list of cidr ranges : "network_provider.csv"). If possible, this filter would be first in this correlation rule, to avoid adding a filtered IP in the lookup table "scan_port.csv".
The priority is to: - Find the port scan of the IPs - Filter IPs (by the lookup table "network_provider") - Check for duplicates (by the lookup table "scan_port") - Make an alert - Add the IP in the search table (port scan)
As I said, I have a correlation rule for port scans that has been working for years. I would like to add the filter by cidr range. I have the command (cidrmatch) that works for the filter. But I can't get it to work, between the port scan lookup and the two lookup tables, I can't find a solution.
Any ideas? Thanks in advance
... View more