# CIDR modifier for sigma detection rules works only for IPv4 addresses, not for IPv6 resulting in sigma detection error **URL:** \ **Category:** Security Analytics\ **Tags:** feature-request\ **Created:** [August 3, 2026, 4:30am UTC](https://forum.opensearch.org/t/cidr-modifier-for-sigma-detection-rules-works-only-for-ipv4-addresses-not-for-ipv6-resulting-in-sigma-detection-error/28232 "2026-08-03T04:30:37Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![mutant](https://avatars.discourse-cdn.com/v4/letter/m/f4b2a3/32.png) [@mutant](https://forum.opensearch.org/u/mutant)\ **Post date:** [August 3, 2026, 4:30am UTC](https://forum.opensearch.org/t/cidr-modifier-for-sigma-detection-rules-works-only-for-ipv4-addresses-not-for-ipv6-resulting-in-sigma-detection-error/28232/1 "2026-08-03T04:30:37Z")
I was getting a Sigma Detection Error when trying to import a rule from Sigma repository to opensearch. Upon further inspection in the source code, i found out that only IPv4 addresses are validated. IPv6 addresses fail the validation and hence I’m not able to create the rule. Would be great if opensearch adds support for IPv6 For reference, this was the file I checked: src/main/java/org/opensearch/securityanalytics/rules/types/SigmaCIDRExpression.java. ---
**Author:** ![mkhl](https://avatars.discourse-cdn.com/v4/letter/m/e68b1a/32.png) [@mkhl](https://forum.opensearch.org/u/mkhl)\ **Post date:** [August 3, 2026, 1:12pm UTC](https://forum.opensearch.org/t/cidr-modifier-for-sigma-detection-rules-works-only-for-ipv4-addresses-not-for-ipv6-resulting-in-sigma-detection-error/28232/2 "2026-08-03T13:12:26Z")
Hi, is it what you need [Add IPv6 CIDR support and remove obsolete Sigma classes by mkhludnev · Pull Request #1757 · opensearch-project/security-analytics · GitHub](https://github.com/opensearch-project/security-analytics/pull/1757) ? ---
**Author:** ![mutant](https://avatars.discourse-cdn.com/v4/letter/m/f4b2a3/32.png) [@mutant](https://forum.opensearch.org/u/mutant)\ **Post date:** [August 3, 2026, 6:14pm UTC](https://forum.opensearch.org/t/cidr-modifier-for-sigma-detection-rules-works-only-for-ipv4-addresses-not-for-ipv6-resulting-in-sigma-detection-error/28232/3 "2026-08-03T18:14:05Z")
Yes this is exactly what I need. Thank you! ---
**Author:** ![mkhl](https://avatars.discourse-cdn.com/v4/letter/m/e68b1a/32.png) [@mkhl](https://forum.opensearch.org/u/mkhl)\ **Post date:** [August 6, 2026, 10:25am UTC](https://forum.opensearch.org/t/cidr-modifier-for-sigma-detection-rules-works-only-for-ipv4-addresses-not-for-ipv6-resulting-in-sigma-detection-error/28232/4 "2026-08-06T10:25:32Z")
please chase devs at github to make it merged. ---
**Author:** ![viktoriyanavrotskaya](https://avatars.discourse-cdn.com/v4/letter/v/59ef9b/32.png) [@viktoriyanavrotskaya](https://forum.opensearch.org/u/viktoriyanavrotskaya)\ **Post date:** [August 12, 2026, 3:47pm UTC](https://forum.opensearch.org/t/cidr-modifier-for-sigma-detection-rules-works-only-for-ipv4-addresses-not-for-ipv6-resulting-in-sigma-detection-error/28232/5 "2026-08-12T15:47:19Z")
> [@mutant](#): > > I was getting a Sigma Detection Error when trying to import a rule from Sigma repository to opensearch. Upon further inspection in the source code, i found out that only IPv4 addresses are validated. IPv6 addresses fail the validation and hence I’m not able to create the rule. Would be great if opensearch adds support for IPv6 > > For reference, this was the file I checked: src/main/java/org/opensearch/securityanalytics/rules/types/SigmaCIDRExpression.java. Good catch tracing it to SigmaCIDRExpression.java. Since you’ve already found the root cause, this is worth filing as a GitHub issue on the security-analytics repo with that file reference and a sample IPv6 CIDR rule that fails. That gives maintainers a clear repro. Even better if you can open a PR swapping the IPv4-only validation for something that handles both families, that’d likely get merged faster than a feature request sitting in the queue. ---
**Author:** ![mutant](https://avatars.discourse-cdn.com/v4/letter/m/f4b2a3/32.png) [@mutant](https://forum.opensearch.org/u/mutant)\ **Post date:** [August 25, 2026, 9:22am UTC](https://forum.opensearch.org/t/cidr-modifier-for-sigma-detection-rules-works-only-for-ipv4-addresses-not-for-ipv6-resulting-in-sigma-detection-error/28232/6 "2026-08-25T09:22:12Z")
Thank you, a PR was already opened by @mkhl. However code review is pending. It’s been in that state for 3 weeks, can a maintainer look into it? ---
**Author:** ![system](https://us1.discourse-cdn.com/flex019/uploads/mauve_hedgehog/original/2X/3/33547ea01a5b12dcca2958411d3edd97ae2ea8c1.png) [@system](https://forum.opensearch.org/u/system)\ **Post date:** [October 24, 2026, 9:22am UTC](https://forum.opensearch.org/t/cidr-modifier-for-sigma-detection-rules-works-only-for-ipv4-addresses-not-for-ipv6-resulting-in-sigma-detection-error/28232/7 "2026-10-24T09:22:31Z")
Closed on October 24, 2026, 9:22am UTC This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.