LEQL question and CIDR

Hi here,

Searching for some help with a LEQL query, as the following does not seem to be working?:

where(source_addresses IN ["",""])

Hi @sgroeneveld

In order to use cidr notation it’s required to include the IP search keyword

Your query should work if you run

where(source_addresses IN [IP(,IP(])

See here for an example Components for Building a Query | InsightIDR Documentation


Thank you1