IBM QRadar SOAR

IBM QRadar

Join this online user group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only
  • 1.  Script to check ip address

    Posted Tue July 23, 2019 09:15 AM
    Hi,
    As part of my workflow, i want to determine if an ip address(from an existing field) is public or private via python script, and than update another field with the response.
    I know there is a built in function for that in python.
    For example:
    >>> import ipaddress
    >>> ipaddress.ip_address('192.168.0.1').is_private
    True
    The problem is that i am not sure how to implement it in resilient.
    Any help would be appreciated.


    ------------------------------
    Itzik Shviro
    ------------------------------


  • 2.  RE: Script to check ip address

    Posted Tue July 23, 2019 09:36 AM
    Edited by Paul Curran Tue July 23, 2019 09:36 AM
    Hi Itzik,

    You won't be able to import the ipaddress module in a Resilient script, but you do have access to the re (regular expression) module. So, perhaps something like this could work for you: https://stackoverflow.com/a/28532296/4227444

    Regards,

    ------------------------------
    PAUL CURRAN
    ------------------------------



  • 3.  RE: Script to check ip address

    Posted Tue July 23, 2019 11:33 AM
    Hi paul,
    I have already tried the exact same script and got  an error.
    Also, how can i add the result to a field value?

    ------------------------------
    Itzik Shviro
    ------------------------------



  • 4.  RE: Script to check ip address

    Posted Tue July 23, 2019 11:41 AM
    Edited by Paul Curran Tue July 23, 2019 12:10 PM
    Hi Itzik,

    So what error did you get? Can you provide the output?
    To assign the result to a field you would simply do something like:

    incident.<field> = is_ip_private("<ip address>")

    or in the case of a custom field

    incident.properties.<custom_field> = is_ip_private("<ip address>")

    (did I interpret that last part of the question correctly?)

    ------------------------------
    PAUL CURRAN
    ------------------------------



  • 5.  RE: Script to check ip address

    Posted Tue July 23, 2019 12:39 PM
    Hi paul,
    Thanks a lot. 
    You did interpret it correctly. exactly what i was looking for.
    As for the first part, the error i get - "No viable alternative at input"  (line 1)


    ------------------------------
    Itzik Shviro
    ------------------------------



  • 6.  RE: Script to check ip address

    Posted Tue July 23, 2019 01:05 PM
    Edited by Paul Curran Tue July 23, 2019 01:05 PM
    Hi Itzik,

    Good stuff! :)
    Hmm... I see, it might might be best to post your script here then in that case?
    Did you import the re module at the top of your script?

    ------------------------------
    PAUL CURRAN
    ------------------------------



  • 7.  RE: Script to check ip address

    Posted Tue July 23, 2019 01:50 PM
    Oppps... no i didnt. i will try to add "import re" tomorrow.
    Also, lets say the script answer is "not none"(private ip), how can i push the answer to a new custom field in the same resilient incident?
    Sorry for being such a noob :)



    ------------------------------
    Itzik Shviro
    ------------------------------



  • 8.  RE: Script to check ip address

    Posted Wed July 24, 2019 05:52 AM
    Edited by Paul Curran Wed July 24, 2019 05:52 AM
    Hi Itzik,

    Not at all - that's what this forum if for! :D
    Hopefully the missing import statement is all that it was, but let's wait and see.

    So you can't create custom fields "on-the-fly" in a script in the way I think you're describing, but you can define them via the UI as described by [this link] ahead of time before you run the script.

    So let's say you create a new custom field called is_private_ip, you could populate that from the script like so:

    incident.properties.is_private_ip = is_ip_private("<ip address>")


    ------------------------------
    PAUL CURRAN
    ------------------------------



  • 9.  RE: Script to check ip address

    Posted Wed July 24, 2019 11:19 AM
    We have a similar in-product script to do what you are looking for, but it's based on artifact values.  Hope this helps, it can be expanded to meet the need for Class A and C as well as field values. 
    import re
    
    if re.match("^10", artifact.value):
      pass
    else: 
      if not re.match("^172\.(1[6-9]|2[0-9]|3[0-1])\.([0-9]|[1-9][0-9]|1([0-9][0-9])|2([0-4][0-9]|5[0-5]))\.([0-9]|[1-9][0-9]|1([0-9][0-9])|2([0-4][0-9]|5[0-5]))$", artifact.value):
        helper.fail("Not a valid Internal IP Address")


    ------------------------------
    DeWarren Stallworth
    ------------------------------