WISE 3.x - 5.x Configurations

This is a gallery WISE 3.x - 5.x configurations to browse. Learn how to contribute one here.

<h3 class="search-title subsection" id="icloud-private-relay-ips>iCloud Private Relay IPs</h3>

Download the iCloud Private Relay egress IP CIDRs from Apple and add mask.country, mask.region and mask.city fields to the sessions that match, providing geolocation of masked Apple devices.

apple icloud ip cloud vpn proxy relay 
{
  "url:icloud-private-relay-ips": {
    "type": "ip",
    "format": "csv",
    "column": "0",
    "url": "https://mask-api.icloud.com/egress-ip-ranges.csv",
    "reload": "120",
    "fields": "field:mask.country;db:mask.country;kind:termfield;friendly:Country;shortcut:1\\nfield:mask.region;db:mask.region;kind:termfield;friendly:Region;shortcut:2\\nfield:mask.city;db:mask.city;kind:termfield;friendly:City;shortcut:3",
    "view": "require:mask;title:Apple Private Relay;section:mask;fields:mask.country,mask.region,mask.city"
  }
}
<h3 class="search-title subsection" id="google-cloud-ips4>Google Cloud IPs4</h3>

Download the GCloud IP CIDRs from Google and add cloud.region and cloud.service fields to the sessions that match.

google cloud gcloud ip 
{
 "url:gcloud-ips4": {
   "type": "ip",
   "format": "json",
   "url": "https://www.gstatic.com/ipranges/cloud.json",
   "arrayPath": "prefixes",
   "keyPath": "ipv4Prefix",
   "fields": "field:cloud.service;db:cloud.service;kind:lotermfield;friendly:Service;shortcut:service\\nfield:cloud.region;db:cloud.region;kind:lotermfield;friendly:Region;shortcut:scope",
   "view": "require:cloud;title:Public Cloud;section:cloud;fields:cloud.service,cloud.region",
   "reload": 120
  },
  "url:gcloud-ips6": {
    "type": "ip",
    "format": "json",
    "url": "https://www.gstatic.com/ipranges/cloud.json",
    "arrayPath": "prefixes",
    "keyPath": "ipv6Prefix",
    "fields": "field:cloud.service;db:cloud.service;kind:lotermfield;friendly:Service;shortcut:service\\nfield:cloud.region;db:cloud.region;kind:lotermfield;friendly:Region;shortcut:scope",
  "reload": 120
 }
}
<h3 class="search-title subsection" id="azure-ips>Azure IPs</h3>

Download the Azure IP CIDRs from Microsoft and add cloud.region and cloud.service fields to the sessions that match.

azure ip cloud 
{
  "url:azure-ips": {
    "type": "ip",
    "format": "json",
    "url": "https://www.microsoft.com/en-us/download/details.aspx?id=56519",
    "urlScrapeRedirect": "https[^\"]*71D86715-5596-4529-9B13-DA13A5DE5B63[^\"]*json",
    "headers": "user-agent:curl",
    "arrayPath": "values",
    "keyPath": "properties.addressPrefixes",
    "fields": "field:cloud.service;db:cloud.service;kind:lotermfield;friendly:Service;shortcut:name\\nfield:cloud.region;db:cloud.region;kind:lotermfield;friendly:Region;shortcut:properties.region",
    "view": "require:cloud;title:Public Cloud;section:cloud;fields:cloud.service,cloud.region",
    "reload": 120
  }
}
<h3 class="search-title subsection" id="aws-ips>AWS IPs</h3>

Download the AWS IP CIDRs from Amazon and add cloud.region and cloud.service fields to the sessions that match.

aws amazon ip cloud 
{
  "url:aws-ips": {
   "type": "ip",
   "format": "json",
   "url": "https://ip-ranges.amazonaws.com/ip-ranges.json",
   "arrayPath": "prefixes",
   "keyPath": "ip_prefix",
   "fields": "field:cloud.service;db:cloud.service;kind:lotermfield;friendly:Service;shortcut:service\\nfield:cloud.region;db:cloud.region;kind:lotermfield;friendly:Region;shortcut:region",
   "view": "require:cloud;title:Public Cloud;section:cloud;fields:cloud.service,cloud.region",
   "reload": 120
  }
}

Want to contribute a WISE Configuration?

Check out our contributing file for more information.

Arkime Logo