filter on subnet in event handler

[dieter]

Something like

srcip==192.168.0.0/16

doesn't seem to be working in a generic text filter.

Is it at all possible any way ?

[kylezhang_FTNT · Accepted solution]

For generic text filter, please try this: 

srcip ~ 192\.168\.[0-9]+\.[0-9]+

[dieter]

Thanks

Didn't realize this uses regexp syntax. Manuals really don't mention anything...

[chall_FTNT]

Good point.  We have just made a note to update the section on Generic Text Filter to mention that it uses regex syntax.

[rwpatterson]

kylezhang wrote:

For generic text filter, please try this: 

srcip ~ 192\.168\.[0-9]+\.[0-9]+

I would actually use

srcip ~ 192\.168\.[0-9]{1-3}\.[0-9]{1-3}

The difference is the original would accept one or more characters in the last two octets where the latter will accept between one and three in each. Just a bit more control but less chance for false positives.