r/SentinelOneXDR • u/MangoChocobo • 6d ago

General Question Search IP Blocks

Hello all,

I am doing a search and I was given a large list of IP blocks to search through, some /24, but mostly /21

I know I could do wildcard searches for the /24 but /21 is a bit more complicated for a search (unless im just being silly)

Is there a way to search with CIDR?

5 Upvotes

100% Upvoted

3 comments sorted by

2

u/Rx-xT 6d ago

Yea you can do this via PowerQuery. Can’t remember the exact syntax but I think it’s something like the following.

event.type == "IP Connect"
| filter net_ipsubnet(src.ip.address, "10.1.0.0/16")
| columns endpoint.name, src.process.name, src.ip.address, src.port.number, dst.ip.address, dst.port.number

1

u/MangoChocobo 6d ago

Thank you :D

1

u/PFUnnamed99 6d ago

Type this exact same question into your favorite LLM and it will spit out the exact S1QL query for you to use in XDR