sonar-set-ip-address

Batch-inserts or updates IP addresses and specified field values from input records in the asset IP database. Existing IP addresses are updated with values from input records; IP addresses that are not yet registered are created.

Command properties

Syntax

Options

fields=FIELDS

List of fields to be synchronized, separated by a comma with a following space. See the Input Fields below for a detailed description.

Input Fields

• category_name: The device type is labeled as 'Uncategorized' if the device type value from the input record does not match the device type value in the database.
• emp_key, emp_key2: The input is ignored if the employee key value in the input record does not match the employee key value in the database.
• priority and confidentiality, integrity, availability (CIA) fields are mutually exclusive:

  • When using priority, CIA fields cannot be used.

  • When using CIA fields, all three must be specified. Specifying only one or two will result in an error.

  • When CIA fields are used, priority is automatically calculated based on the following criteria:

    • Sum > 7 → High (3)
    • Sum > 4 → Medium (2)
    • Sum ≤ 4 → Low (1)
    Tip

    You can customize the IP asset database by applying global setting on sonar as follows:
    logpresso> sonar.setGlobalOption ip_custom_fields "0=Manufacturer,1=Model name"
    

batchsize=INT

Batch unit size for inserting IP addresses. Specify a value in the range 1–5,000. For large-scale IP synchronization, increasing the batch size reduces the number of transactions and improves performance. However, if an error occurs, the entire batch fails to synchronize. (Default: 1)

company=STR

GUID of the target company to insert asset IPs into. If not specified, the current session's company is used.

Input fields

Output fields

All fields from the input record are output unchanged. The _error field is added only for records where an error occurred.

Error codes

Parse errors

Runtime errors

N/A

Description

The sonar-set-ip-address command looks up the asset IP database using the ip field value in each input record. If the IP address is already registered, it updates the field values specified in the fields option. If the IP address is not yet registered, it creates a new entry.

The ip field is always required and is automatically included even if not specified separately in the fields option. If the ip field value is null or not a valid IP address, the synchronization for that record is skipped and the error detail is recorded in the _error field.

If a field specified in the fields option does not exist in the input record, that field's value is updated to null. Conversely, fields that exist in the input record but are not specified in the fields option are not synchronized.

When the batchsize option is used, records are collected in batches of the specified size and processed together. If an error occurs during batch processing, the _error field of all records in the same batch is populated with the error detail.

Examples

1. Synchronize asset IPs

   json "[{'ip': '192.0.2.1', 'hostname': 'web-01', 'os_name': 'Linux', 'priority': 2}, {'ip': '192.0.2.2', 'hostname': 'db-01', 'os_name': 'Linux', 'priority': 3}]"
   | sonar-set-ip-address fields="hostname, os_name, priority"
   

   Synchronizes the values of hostname, os_name, and priority fields to the asset IP database.

   genian-nac-nodes
   | rename nt_domain as workgroup, first_seen as installed, platform as os_name, nic_vendor as ext0, type as category_name
   | eval priority = if(category_name != "PC", 2, 1)
   | sonar-set-ip-address batchsize=10 fields="priority, category_name, hostname, workgroup, emp_key, emp_key2, description, os_name, os_ver, mac, location, installed, ext0"
   

2. Sync IP assets using CIA fields

   The following example synchronizes IP asset information by specifying confidentiality, integrity, and availability (CIA) levels. When CIA fields are used, priority is automatically calculated.

   json "[{\"ip\": \"10.0.0.1\", \"confidentiality\": \"high\", \"integrity\": \"medium\", \"availability\": \"high\"}]"
   | sonar-set-ip-address fields="confidentiality, integrity, availability"