LEQL question and CIDR

InsightIDR
1

Hi here,

Searching for some help with a LEQL query, as the following does not seem to be working?:

where(source_addresses IN ["10.268.50.0/24","10.267.240.0/23"])

2

Hi @sgroeneveld

In order to use cidr notation it’s required to include the IP search keyword

Your query should work if you run

where(source_addresses IN [IP(10.268.50.0/24),IP(10.267.240.0/23)])

See here for an example Components for Building a Query | InsightIDR Documentation

David

3

Thank you1