DAG - all IPs matching xxx.xxx.xxx.15 or 16

InsightVM
1

I’m trying to craft a query to populate a DAG with all IPs matching xxx.xxx.xxx.15 or 16, but cannot seem to get it right.

any tips or examples?

2

@ssmith1
try this

^\\d+\.\\d+\.\\d+\.1[56]\$

image

Tips:

  • The key is the tail anchor it needs to be escaped, whereas the anchor in the front does not. /shrug
  • If you want to build out your own regex start with something like ^10.0.0.15\$. hit search, see it work. Start simple and make small changes.
  • The period is a wildcard in regex. So \. for . If not you will get weird results, the period will match a lot.
  • Escape anything that needs a slash except the tail anchor like \\d for \d
  • Tail anchor is \$ for \$

I may have spent more hours on this when regex was first released in the filters like 5 years ago than I cared to admit to. After that, I have been able to make whatever crazy regex comes up.

Hope this saves you some time and gets the DAG logic you are looking for.

4 Likes
3

oh man, you are a life saver! I spent so many hours trying to detangle this - you are a gentlemen and a scholar. Thank you so very much!