IP feeds

[Anonymous]

Hey,

I am looking to create a more exact feed but I am not sure if it is possible.  Is it possible for the feed to label based on ip.src/ip.dst differently?

The main feed we are trying to create is getting each of our IP ranges and label them, we use the whole 10.0.0.0/8 range for us and our clients.  What I want it to do is be able to say that if 10.1.1.1 is a source IP label it x_x_src or if it is a dest x_x_dst.  Does anyone know if this is possible?  I am not sure if using a custom xml would work? 

I currently have it working using app rules but I would much rather have it done using a feed so the network team can keep it updated. 

Any help is appreciated.

[RSAAdmin]

One option would be to have two different XML files that reference the same CSV.

Create the csv file with your ip.src and ip.dst return values in different columns:

#ip,if_src,if_dst

1.2.3.4,proxy_server,,

4.3.2.1,,malicious_address

XML file for ip.src returns column 2, XML file for ip.dst returns column 3.

It's been a while since I've set up a new feed so my memory is a bit rusty, but it may be possible to have the two different functions as separate stanzas in the same XML file.  But worst case, you need two separate XML files and two copies of the CSV file.

I'll also throw out for your additional research that you can do both VLSM/CIDR block comparisons in your feeds (i.e. the feed has 10.42.42.0/24 and any matching host address will return the meta), as well as address ranges (low IP to high IP).

[huanzhou1]

yah, i think two feends would be fine. one ip.src, one for ip.dst

[Anonymous · Accepted solution]

I've found the same issue with the SA wizard but the backend still supports it as it used to. So using XML you can easily address this issue. I'm sure it will be fixed soon but until then, here's the examples I normally use/modify.

<FDF>
  <FlatFileFeed name="Network Feed" path="net-feed-cidr.csv" separator="," comment="#">
    <LanguageKeys>
                <LanguageKey name="org" valuetype="Text" srcname="org.src" destname="org.dst" />
                <LanguageKey name="domain" valuetype="Text" srcname="domain.src" destname="domain.dst" />
                <LanguageKey name="city" valuetype="Text" srcname="city.src" destname="city.dst" />
    </LanguageKeys>
    <Fields>
      <Field index="1" type="index" range="cidr"/>
      <Field index="2" type="value" key="org"/>
      <Field index="3" type="value" key="domain"/>
      <Field index="4" type="value" key="city"/>
    </Fields>
  </FlatFileFeed>
</FDF>

I hope this helps! I believe the CSV name is slightly irrelevant by I try to have it match my CSV filename. As mentioned range should also work just use:

   <Fields>
      <Field index="1" type="index" range="low"/>
      <Field index="2" type="index" range="high"/>
      <Field index="3" type="value" key="org"/>
      <Field index="4" type="value" key="domain"/>
    </Fields>

Regards,

Rui