We use an asset file correctly configured on ES but we noticed that the enrichment based on "asset_lookup_by_cidr" is not working correctly because the lookup is not sorted by CIDR class. For example in the following sample the sorting is base on "lexicographic" order instead of the real CIDR classes logic: 1.2.30.0/26 1.2.30.128/25 1.2.31.0/24 1.2.32.0/24 1.2.33.0/25 1.2.33.128/25 We tried to solve the problem creating a saved search that automatically performs the right sort but soon after the execution the lookup "asset_lookup_by_cidr" is replaced with "lexicographic" order. My saved search: | inputlookup asset_lookup_by_cidr | eval ip=replace(ip,"\s+","") | eval sorted=case(match(ip,"\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\/\d{2}"),substr(ip,-2),match(ip,"\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\/\d{1}"),substr(ip,-1),1=1,"0") | sort limit=0 - sorted | fields - sorted | outputlookup asset_lookup_by_cidr Is there a quick solution to this problem? Because it is a big trouble for notable based on IP addresses.
... View more
