Network

Network inspectors evaluate network data.

network.ip.global_unicast

Evaluates if an IP address string is a global unicast address.

Settings

Field	Type	Description	Required
object.source_key	string	Retrieves a value from an object for inspection.	No

Example

Config

sub.condition.network.ip.global_unicast(
  settings={object: {source_key: 'ip'}}
)

Abbv. Config

sub.cnd.net.ip.global_unicast({obj: {src: 'ip'}})

network.ip.link_local_multicast

Evaluates if an IP address string is a link local multicast address.

Settings

Field	Type	Description	Required
object.source_key	string	Retrieves a value from an object for inspection.	No

Example

Config

sub.condition.network.ip.link_local_multicast(
  settings={object: {source_key: 'ip'}}
)

Abbv. Config

sub.cnd.net.ip.link_local_multicast({obj: {src: 'ip'}})

network.ip.link_local_unicast

Evaluates if an IP address string is a link local unicast address.

Settings

Field	Type	Description	Required
object.source_key	string	Retrieves a value from an object for inspection.	No

Example

Config

sub.condition.network.ip.link_local_unicast(
  settings={object: {source_key: 'ip'}}
)

Abbv. Config

sub.cnd.net.ip.link_local_unicast({obj: {src: 'ip'}})

network.ip.loopback

Evaluates if an IP address string is a loopback address.

Settings

Field	Type	Description	Required
object.source_key	string	Retrieves a value from an object for inspection.	No

Example

Config

sub.condition.network.ip.loopback(
  settings={object: {source_key: 'ip'}}
)

Abbv. Config

sub.cnd.net.ip.loopback({obj: {src: 'ip'}})

network.ip.multicast

Evaluates if an IP address string is a multicast address.

Settings

Field	Type	Description	Required
object.source_key	string	Retrieves a value from an object for inspection.	No

Example

Config

sub.condition.network.ip.multicast(
  settings={object: {source_key: 'ip'}}
)

Abbv. Config

sub.cnd.net.ip.multicast({obj: {src: 'ip'}})

network.ip.private

Evaluates if an IP address string is a private address.

Settings

Field	Type	Description	Required
object.source_key	string	Retrieves a value from an object for inspection.	No

Example

Config

sub.condition.network.ip.private(
  settings={object: {source_key: 'ip'}}
)

Abbv. Config

sub.cnd.net.ip.private({obj: {src: 'ip'}})

network.ip.unicast

Evaluates if an IP address string is a unicast address.

Settings

Field	Type	Description	Required
object.source_key	string	Retrieves a value from an object for inspection.	No

Example

Config

sub.condition.network.ip.unicast(
  settings={object: {source_key: 'ip'}}
)

Abbv. Config

sub.cnd.net.ip.unicast({obj: {src: 'ip'}})

network.ip.unspecified

Evaluates if an IP address string is an unspecified address.

Settings

Field	Type	Description	Required
object.source_key	string	Retrieves a value from an object for inspection.	No

Example

Config

sub.condition.network.ip.unspecified(
  settings={object: {source_key: 'ip'}}
)

Abbv. Config

sub.cnd.net.ip.unspecified({obj: {src: 'ip'}})

network.ip.valid

Evaluates if an IP address string is a valid address.

Settings

Field	Type	Description	Required
object.source_key	string	Retrieves a value from an object for inspection.	No

Example

Config

sub.condition.network.ip.valid(
  settings={object: {source_key: 'ip'}}
)

Abbv. Config

sub.cnd.net.ip.valid({obj: {src: 'ip'}})

Use Cases

External IP Addresses

External IP addresses can be identified by wrapping several network inspectors with the meta_negate inspector:

• NOT network_ip_link_local_multicast
• NOT network_ip_link_local_unicast
• NOT network_ip_loopback
• NOT network_ip_multicast
• NOT network_ip_private
• NOT network_ip_unspecified