CIDR modifier for sigma detection rules works only for IPv4 addresses, not for IPv6 resulting in sigma detection error

Plugins Security Analytics
1

I was getting a Sigma Detection Error when trying to import a rule from Sigma repository to opensearch. Upon further inspection in the source code, i found out that only IPv4 addresses are validated. IPv6 addresses fail the validation and hence I’m not able to create the rule. Would be great if opensearch adds support for IPv6

For reference, this was the file I checked: src/main/java/org/opensearch/securityanalytics/rules/types/SigmaCIDRExpression.java.

2

Hi,
is it what you need Add IPv6 CIDR support and remove obsolete Sigma classes by mkhludnev · Pull Request #1757 · opensearch-project/security-analytics · GitHub ?

3

Yes this is exactly what I need. Thank you!

4

please chase devs at github to make it merged.