CIDR matching

%3CLINGO-SUB%20id%3D%22lingo-sub-1202037%22%20slang%3D%22en-US%22%3ECIDR%20matching%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1202037%22%20slang%3D%22en-US%22%3E%3CP%3EHi%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EIs%20there%20any%20operator%20to%20search%20for%20IP%20address%20matches%20using%20CIDR%20notation%20rather%20than%20just%20patterns%3F%20Patterns%20work%20when%20the%20subnets%20break%20on%20octets%20but%20if%20you're%20like%20me%20that's%20often%20not%20the%20case.%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3Ee.g.%20IPAddress%20inCidr%2010.1.0.0%2F23%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThanks!%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1204347%22%20slang%3D%22en-US%22%3ERe%3A%20CIDR%20matching%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1204347%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F559958%22%20target%3D%22_blank%22%3E%40mrboxx%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI%20believe%20you%20can%20use%20a%20regex%20for%20this%20search%20as%20I%20cannot%20see%20any%20queries%20related%20to%20CIDR%20matching.%20Something%20along%20the%20lines%20of%20the%20following%20which%20worked%20for%20a%20query%20for%20me%3A%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CDIV%3E%3CDIV%3E%3CSPAN%3E%7C%20%3C%2FSPAN%3E%3CSPAN%3Ewhere%3C%2FSPAN%3E%3CSPAN%3E%20IpAddress%20%3C%2FSPAN%3E%3CSPAN%3Ematches%3C%2FSPAN%3E%20%3CSPAN%3Eregex%3C%2FSPAN%3E%20%3CSPAN%3E%22136.142.*%22%3C%2FSPAN%3E%3C%2FDIV%3E%3C%2FDIV%3E%3C%2FLINGO-BODY%3E
Occasional Contributor

Hi

 

Is there any operator to search for IP address matches using CIDR notation rather than just patterns? Patterns work when the subnets break on octets but if you're like me that's often not the case. 

 

e.g. IPAddress inCidr 10.1.0.0/23

 

Thanks!

1 Reply

@mrboxx 

 

I believe you can use a regex for this search as I cannot see any queries related to CIDR matching. Something along the lines of the following which worked for a query for me:

 

| where IpAddress matches regex "136.142.*"