WISE 3.x - 5.x Configurations

This is a gallery WISE 3.x - 5.x configurations to browse. Learn how to contribute one here.

<h3 class="search-title subsection" id="google-cloud-ips4>Google Cloud IPs4</h3>

Download the GCloud IP CIDRs from Amazon and add cloud.region and cloud.service fields to the sessions that match.

google cloud gcloud ip 
{
 "url:gcloud-ips4": {
   "type": "ip",
   "format": "json",
   "url": "https://www.gstatic.com/ipranges/cloud.json",
   "arrayPath": "prefixes",
   "keyPath": "ipv4Prefix",
   "fields": "field:cloud.service;db:cloud.service;kind:lotermfield;friendly:Service;shortcut:service\\nfield:cloud.region;db:cloud.region;kind:lotermfield;friendly:Region;shortcut:scope",
   "view": "require:cloud;title:Public Cloud;section:cloud;fields:cloud.service,cloud.region",
   "reload": 120
  },
  "url:gcloud-ips6": {
    "type": "ip",
    "format": "json",
    "url": "https://www.gstatic.com/ipranges/cloud.json",
    "arrayPath": "prefixes",
    "keyPath": "ipv6Prefix",
    "fields": "field:cloud.service;db:cloud.service;kind:lotermfield;friendly:Service;shortcut:service\\nfield:cloud.region;db:cloud.region;kind:lotermfield;friendly:Region;shortcut:scope",
  "reload": 120
 }
}
<h3 class="search-title subsection" id="azure-ips>Azure IPs</h3>

Download the Azure IP CIDRs from Amazon and add cloud.region and cloud.service fields to the sessions that match.

azure ip cloud 
{
  "url:azure-ips": {
    "type": "ip",
    "format": "json",
    "url": "https://www.microsoft.com/en-us/download/details.aspx?id=56519",
    "urlScrapeRedirect": "https[^\"]*71D86715-5596-4529-9B13-DA13A5DE5B63[^\"]*json",
    "headers": "user-agent:curl",
    "arrayPath": "values",
    "keyPath": "properties.addressPrefixes",
    "fields": "field:cloud.service;db:cloud.service;kind:lotermfield;friendly:Service;shortcut:name\\nfield:cloud.region;db:cloud.region;kind:lotermfield;friendly:Region;shortcut:properties.region",
    "view": "require:cloud;title:Public Cloud;section:cloud;fields:cloud.service,cloud.region",
    "reload": 120
  }
}
<h3 class="search-title subsection" id="aws-ips>AWS IPs</h3>

Download the AWS IP CIDRs from Amazon and add cloud.region and cloud.service fields to the sessions that match.

aws amazon ip cloud 
{
  "url:aws-ips": {
   "type": "ip",
   "format": "json",
   "url": "https://ip-ranges.amazonaws.com/ip-ranges.json",
   "arrayPath": "prefixes",
   "keyPath": "ip_prefix",
   "fields": "field:cloud.service;db:cloud.service;kind:lotermfield;friendly:Service;shortcut:service\\nfield:cloud.region;db:cloud.region;kind:lotermfield;friendly:Region;shortcut:region",
   "view": "require:cloud;title:Public Cloud;section:cloud;fields:cloud.service,cloud.region",
   "reload": 120
  }
}

Want to contribute a WISE Configuration?

Check out our contributing file for more information.

Arkime Logo