The Advanced Search update adds network filters, letting users query CIDR blocks in IP-related fields and constrain results by ASN or CIDR with the new WITH network option. The YARA interface now emphasizes newly observed indicators and total indicator counts, replacing the old total-matches-per-day chart to give analysts better visibility into rule impact. #CIDR #ASN #YARA
Keypoints
- Advanced Search now accepts CIDR blocks in compatible IP fields such as dns.a, dns.aaaa, and services.ip.
- The new global filter WITH network can take either a CIDR or an ASN and limits returned IPs to that network.
- ASN inputs like AS13335 are expanded to their announced prefixes automatically.
- The network filter works alongside other query components without affecting unrelated domain or IP results.
- YARA summary statistics have been redesigned to focus on newly observed indicators rather than total matches per day.
- A new “Total Indicators” column shows the total number of indicators in a YARA rule’s result set.
- These updates are currently in beta for enterprise customers, with community availability planned after beta ends.
MITRE Techniques
- [T1595.001 ] Active Scanning: Scanning IP Blocks – Uses CIDR-aware queries to search for domains and hosts across entire address ranges (‘dns.a = “10.0.0.0/8” returns every domain with an A record anywhere in that block’).
- [T1596 ] Search Open Technical Databases – Leverages advanced search and YARA result summaries to pivot through stored internet-facing data and indicators (‘Users can now input CIDRs into any compatible IP field’ and ‘newly observed indicators’).
Indicators of Compromise
- [IP ranges / CIDR ] examples of network ranges used in queries – 10.0.0.0/8, and other CIDR blocks
- [Autonomous System Numbers / ASN ] network filter examples for limiting results – AS13335, 13335
- [Domain / host context ] certificate and DNS search examples referenced in the interface – validin.com, dns.a
- [Service field values ] query fields used to locate exposed services – services.ip, services.http.title
Read more: https://www.validin.com/blog/advanced_search_yara_improvements/