Public IP filter

[baauji1]

Can anyone please suggest a way to create a filter for denied connections from public IP only. I have created a filter but sometimes, private IP are also coming in the dashboard. See the snapshot for the filter I have created

[tkachouba]

What if you did:

Attacker Zone URI IN GROUP Public Address Space Zones

Or you could use the inverse:

NOT

Attacker Zone URI IN GROUP Private Address Space Zones

[baauji1]

Nope, this doesn't seem to be working. After applying it, the dashboard is not showing anything

[renjithrjames]

Dear Rahul,

Try this. delete your NOT condition and keep whole in under AND by writing as below screen shot.

Regards

Renjith

[baauji1]

Tried this as well..And other possibilities similar to this.. Now working

[acicz1 · Accepted solution]

Hello Rahul,

The reason your original filter does not result as you expect it is the way your filter is evaluated concerning the expressions connected with a NOT (this is, I believe, buggy in ArcSight), you cannot group expressions with NOT, very likely only the first expression is evaluated, the rest is ignored...

So, do not use a construct like:

NOT

  (expr1

   expr2

   expr3)

Instead, (as Renjith James suggested) try it with

AND

(

NOT expr1

NOT expr2

NOT expr3

)

Hope it helps.

Regards,

Adam

[baauji1]

I have tried the other way round as well. But yes, that can be a reason for the filter to not work because the private IPs coming in the dashboard were not from the subnet 10.0.0.0/8 but were from the other two. Do you think it will work if I give 3 different NOT conditions ??

[acicz1]

Yes, it should work if you group the 3, individually negated conditions with an AND, like:

AND

(

NOT Attacker Address InSubnet 10.0.0.0/8

NOT Attacker Address InSubnet 192.168.0.0/16

NOT Attacker Address InSubnet 172.16.0.0/12

)

Regards,

A.

[baauji1]

Well, if I edit the filter which is being used in the dashboard and reload the dashboard, will the private IP which was coming in the dashboard disappear automatically??

private IP still showing in dashboard

[acicz1]

Well, it depends on what sort of content you have on the given dashboard... if you got a datamonitor put on your dashboard, there might be some data collected/cashed before you changed the filter. If you disable/re-enable the datamonitor it will flush its cache, and it will start to populate the data based on the new filter.

Anyway, I suggest you to validate your new filter with an active channel first, to make sure the filter brings you the events you really want to process.

Regards,

A.

[baauji1]

Thanks for the suggestions. Will disable and re-enable the data monitor and will confirm if it is working

[baauji1]

Thanks for the above suggestions. They are working perfectly