Subnet groups

Overview

A subnet group collects IP address ranges that serve the same purpose so you can manage them together. Under Policies > Subnet Groups, organize networks of a similar nature — the internal network, the headquarters network, or data center server ranges — into a single group.

A subnet group consists of a name, a description, and the list of subnets registered in it. You register each subnet in one of three formats — an IP address range, a single IP address, or CIDR — and one group can mix all three. This feature supports IPv4 addresses only.

At installation, the subnet group 내부망 대역 (internal network ranges) is created with the three private IPv4 ranges (10.0.0.0-10.255.255.255, 172.16.0.0-172.31.255.255, and 192.168.0.0-192.168.255.255). Among the built-in detection scenarios, the stream rule 미허가 파일공유 포트 접속 (unauthorized file-sharing port access) and the batch rule 내부망 호스트 스캔 (internal network host scan) use this group to tell internal IP addresses from external ones. The product installs these names in Korean regardless of the console language, so the English console shows them in Korean as well; the English in parentheses is an explanation added by this document. The MITRE ATT&CK page also uses this group by its fixed GUID: it counts as hosts the addresses among host_ip, src_ip, and dst_ip of detection events that fall inside 내부망 대역, and events with none of those addresses inside the group are not counted on that page.

Subnet groups are used by the scenario builder of stream rules, the subnet filter of pivots, the matchnet command, and the matchnet() function. Batch rules have no scenario builder, so you write the matchnet command or function directly in the query of a batch rule. See Use subnet groups for the details.

The Policies > Subnet Groups menu appears for the Cluster Administrator, Administrator, and User roles, and all three can view subnet groups and the subnets inside them. Only the Cluster Administrator and Administrator roles can add, edit, and delete subnet groups or register, edit, and delete the subnets in a group; accounts with the User role do not see Add, Save, Subnet Add, or the delete tools. See Account permissions for the permissions of each role.

View and search subnet groups

You can view or search the subnet group list under Policies > Subnet Groups. The list has no defined sort order, and you cannot sort it by clicking a column header. One page shows 15 groups by default, and you can change the page size with the selector below the list.

• Name: Name of the subnet group
• Description: Description of the subnet group
• Owner: Name of the account that created the subnet group. Regardless of the owner, every account in the same company sees all subnet groups.
• Modified At: Date and time the name or description was last changed

To find a subnet group, type a keyword in the search box in the toolbar and press Enter. The search works as follows.

• If you enter several words separated by spaces, each word must appear in either Name or Description. The search ignores case and matches partial strings.
• If one of the words is an IPv4 address, the search also finds subnet groups that contain a subnet covering that address. The remaining words must then all appear in Name or Description. When a registered subnet is an IP address range or CIDR, any address inside it matches.
• Even when you enter an IPv4 address, subnet groups whose Name or Description contains that string also appear.

The following example searches for 198.51.100.51. The address falls inside the range 198.51.100.50 ~ 198.51.100.51 registered in Corporate asset ranges, so that group appears even though its name and description do not contain the address.

Download the list

To download the subnet group list as a file, click in the toolbar. The Download Subnet Groups dialog opens.

• File Name (required): Name of the downloaded file (default: Subnet Groups, up to 200 characters)
• Columns (required): Columns to include. The four columns of the list plus Created At are all selected; clear a checkbox to leave a column out, or drag the handle on the right to reorder the columns.
• File Format (required): Format of the downloaded file: CSV (default), XML, Microsoft Word, HTML, JSON, or PDF.
• Encoding (required): Encoding of the file. It appears only when the file format is CSV or JSON, and the available values depend on the console language. The English console offers UTF8 (default), UTF16, and Latin 1.
• Range (required): First and last row numbers to download (default: from the first row of the current page to the total count)

Click Download when you are done. If you have narrowed the list with a search keyword, the filtered list is downloaded. When the list is empty, the download icon is disabled.

Refresh the list

To reload the subnet group list with the latest data, click in the toolbar.

Add a subnet group

To create a new subnet group to match against in detection scenarios or queries, follow these steps.

1. Under Policies > Subnet Groups, click Add in the toolbar.

2. In the New Subnet Group panel, enter the group information.

   

   • Name (required): Name of the subnet group, up to 50 characters.
   • Description: Description of the subnet group, up to 50 characters.

3. Click Save in the upper-right corner of the panel. The panel closes and the new subnet group appears in the list.

Edit a subnet group

To change the name or description of a subnet group, follow these steps.

1. In the subnet group list, click the row of the subnet group you want to edit. The Edit Subnet Group panel opens.

   

2. Change Name or Description, then click Save in the upper-right corner of the panel. The panel closes and the list is refreshed.

The lower part of the panel is the list of subnets registered in the group. Registering, editing, and deleting subnets take effect immediately, so Save only confirms the name and description.

View and search subnets

The subnet list of the Edit a subnet group panel shows the subnets registered in the group. One page shows 15 subnets by default, and you can change the page size with the selector below the list. The list has no defined sort order, and the display order can vary; to check a specific subnet, use the search box instead of paging through the list.

• Subnet: The registered subnet, displayed according to its format:
  • IP address range: The first and last addresses joined by a tilde (for example, 198.51.100.50 ~ 198.51.100.51).
  • Single IP address: The address only (for example, 198.51.100.52).
  • CIDR: The network address and the number of bits joined by a slash (for example, 192.0.2.0 / 24).
• Description: Description entered when the subnet was registered

To find a subnet, type a keyword in the search box of the subnet list and press Enter. Words are matched only against Description as partial strings, and when you enter several words separated by spaces, all of them must appear in Description. If one of the words is an IPv4 address, the search also finds subnets that cover that address; the remaining words must then all appear in Description. For example, entering 192.0.2.77 leaves the 192.0.2.0 / 24 subnet.

The toolbar of the subnet list consists of the search box on the left and Subnet Add, the delete icon, and the refresh icon on the right. Unlike the subnet group list, it has no download tool.

Add a subnet

To register a subnet in a subnet group, follow these steps.

1. In the subnet group list, click the row of the subnet group to register the subnet in.

2. Click Subnet Add in the toolbar of the subnet list.

3. In the Add Subnet dialog, choose a Type. The default is Start/End Addr., and the fields below change with the type you choose.

   

4. Enter the values for the type.

   

   • When you choose Start/End Addr.:
     • From (required): First IPv4 address of the range
     • To (required): Last IPv4 address of the range. You cannot save an address lower than From; an address equal to From can be saved.
   • When you choose Single IP Addr.:
     • IP Address (required): IPv4 address to register
   • When you choose CIDR:
     • Network Address (required): First IPv4 address of the range (for example, 192.0.2.0). A value that is not the first address of the block is saved as entered, and the range then covers only the addresses from that value to the end of the block. For example, entering 192.0.2.77 in Network Address and 24 in Bits matches only 192.0.2.77-192.0.2.255.
     • Bits (required): Length of the network prefix, an integer from 1 to 32.
   • Description: Information you will need later, such as why you registered the subnet. You can enter up to 255 characters.

5. Click Save.

Edit a subnet

To change the value or description of a registered subnet, follow these steps.

1. In the subnet group list, click the row of the subnet group that contains the subnet.

2. In the subnet list, click the row of the subnet you want to edit. The Edit Subnet dialog opens.

   

3. Change the values, then click Save.

The Edit Subnet dialog has the same fields as the Add a subnet dialog. Type opens set to match the registered value, and you can also save the subnet with a different type.

Delete subnets

To remove subnets you no longer manage in the group, follow these steps.

1. In the subnet group list, click the row of the subnet group that contains the subnets.

2. In the subnet list, select the checkboxes of the subnets to delete.

3. Click in the toolbar. The icon is disabled when no subnet is selected.

4. In the Delete Subnet dialog, review the subnets to delete, then click Delete.

   

Delete subnet groups

To clean up subnet groups you no longer use, follow these steps.

1. In the subnet group list, select the checkboxes of the subnet groups to delete. When at least one is selected, the left side of the toolbar changes to ask what to do with the selected items.

   

2. Click Delete. To undo the selection, click Deselect.

3. In the Delete Subnet Group dialog, review the subnet groups to delete, then click Delete.

   

Use subnet groups

You can use registered subnet groups in the following ways.

Match subnet groups in the scenario builder

The scenario builder of a stream rule can test whether the IP address of an event belongs to a subnet group. Use it to pick out only connections from the internal network to the outside, or to look separately at connections to a data center server range.

Select an IP field in Field, select the rule IP 주소가 네트워크 대역에 포함 (in subnet group) in Rule, and a selector for the subnet group to compare against appears below. Choose the group and click to add the rule. The selector defaults to the first subnet group in the list.

Rule names and parameter labels in the scenario builder are shown as the product displays them. The English console currently shows the rule name in Korean and the parameter label as its internal name, subnet. The English in parentheses after the rule name is an explanation added by this document and does not appear on screen.

To use IP addresses outside a subnet group as the condition instead, change the condition in front of the rule to NOT. The query that the scenario builder generates carries the GUID of the group, not the name shown on screen. For the rules and parameters available for each field type, see Rules and parameters by field type.

Match subnet groups in pivots and queries

In a pivot, right-click the header of an IP column and select Subnet filter to keep only the IP addresses in particular subnet groups, or to exclude them.

• Output field: Name of the column the filter applies to
• Select Subnet (required): Subnet groups to match against. Select at least one; you can narrow the list with the search box at the top or select every group at once with Select All.
• Coverage: Included keeps only the rows that belong to at least one of the selected subnet groups, and Not included removes those rows from the result.

Click Apply to add the subnet group condition to the pivot query.

In queries, the matchnet command and the matchnet() function determine whether the IP address in a field belongs to a subnet group. The matchnet() function takes the subnet group by GUID; for the options that specify the target of the matchnet command, see the matchnet command reference. The GUID of a subnet group is the value after /subnet-group/ in the address bar of your web browser when you open the edit panel of that subnet group.

The following example keeps only the firewall log records whose destination IP belongs to Corporate asset ranges.

table duration=1d *:FW_FLOW | matchnet guid="3f7c58e1-9a24-4b6d-8e05-c1d7420b9a63" field=dst_ip

To see only the records outside the subnet group instead, specify invert=t.

Internal hosts in MITRE ATT&CK

The MITRE ATT&CK page uses 내부망 대역 to decide which hosts are internal. For each detection event it checks host_ip, src_ip, and dst_ip in that order and counts the first address that falls inside 내부망 대역 as the host of the event; events whose three addresses are all outside the group are not counted. Host names come from Assets, and registering an asset alone does not make it counted.

If the assets you protect are outside the private IP ranges, add their ranges to 내부망 대역 as subnets. The MITRE ATT&CK page refers only to 내부망 대역, so adding them to a subnet group you created separately has no effect on its counts.