LinkedIn
Twitter
The documentation referenced here, shows examples only for Detection Rules. Although the top of the section states that "You can use data tables in conjunction with YARA-L queries in both Search and rules.", I'm finding this not the case. Additionally the function "net.ip_in_range_cidr" is not an option in Search. I am getting errors using the following examples.
events:
//$e.metadata.log_type = "winevtlog" nocase
//$e.principal.ip = /10.128.0.*/
//$e.principal.ip in cidr %Bad_CIDR_Blocks.CIDR
metadata.log_type = "winevtlog" nocase
//principal.ip = /10.128.0.*/ //testing a range I know is in the data set, this is my control value
principal.ip in cidr %Bad_CIDR_Blocks.CIDRExample Error
My suggestion is to submit a case to Support, requesting clarification of the capabilities of Yara-L in Search vs Detection Rules. I'd also note in the case, that the examples for Search in the mentioned document page utilizes variables "$e.xyz.123" and as far as I can tell this format only works in Detection Rules. In search you do not use the "$e" variable.
@Rached1996 I don't have any S1 data to perform a 1:1 comparison test on. I can confirm that data tables should work in search, the example below with two column matches in the same data table. The commented out lines are used for row matching.
The case sensitivity does need to be set to On when doing the cidr (and I presume regex) data table search, but as you can see here I do get results with that. The keyword cidr is optional if the data table column has been declared cidr in the data table.
Is there anything more in the search beyond the ip and logtype? Is the data table using a declared datatype of cidr or is it set to string? Does our time window have events in it that match the criteria in the query and the list? Just trying to narrow down stuff. Since you aren't getting an error, this feels more like the data isn't there which I realize sounds weird in that you have rules output...
