CIDR modifier for sigma detection rules works only for IPv4 addresses, not for IPv6 resulting in sigma detection error

Plugins Security Analytics
1

I was getting a Sigma Detection Error when trying to import a rule from Sigma repository to opensearch. Upon further inspection in the source code, i found out that only IPv4 addresses are validated. IPv6 addresses fail the validation and hence I’m not able to create the rule. Would be great if opensearch adds support for IPv6

For reference, this was the file I checked: src/main/java/org/opensearch/securityanalytics/rules/types/SigmaCIDRExpression.java.

2

Hi,
is it what you need Add IPv6 CIDR support and remove obsolete Sigma classes by mkhludnev · Pull Request #1757 · opensearch-project/security-analytics · GitHub ?

3

Yes this is exactly what I need. Thank you!

4

please chase devs at github to make it merged.

1 Like
5

Good catch tracing it to SigmaCIDRExpression.java. Since you’ve already found the root cause, this is worth filing as a GitHub issue on the security-analytics repo with that file reference and a sample IPv6 CIDR rule that fails. That gives maintainers a clear repro. Even better if you can open a PR swapping the IPv4-only validation for something that handles both families, that’d likely get merged faster than a feature request sitting in the queue.

1 Like
6

Thank you, a PR was already opened by @mkhl. However code review is pending. It’s been in that state for 3 weeks, can a maintainer look into it?