Graylog2 / Graylog2/graylog2-server

cidr_match on keys of a lookup table

Open
#18,100 0 comments 0 reactions 0 assignees View on GitHub
feature triaged
Dominant language
Java
Stars
8.1k
Forks
1.1k
Avg merge
1d 20h
Merged PRs (30d)
217

Description

It would be useful to be able to perform a cidr_match on the keys of a lookup table. @brucegivens opened a request on the now archived graylog-plugin-pipeline-processor repository here:

https://github.com/Graylog2/graylog-plugin-pipeline-processor/issues/246

The goal would be to look up a specific ip and have it do a cidr_match on a lookup table.

For example:

CSV lookup table containing Amazon AWS IP ranges:
"100.20.0.0/14","amazon-ip-range"
"100.24.0.0/13","amazon-ip-range"
"103.246.148.0/22","amazon-ip-range"
"103.4.8.0/21","amazon-ip-range"

Then have the pipeline rule peform a cidr_match for an ip such as 100.20.0.1 against the lookup_table and return the value amazon-ip-range.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.