Question

A SecOps detection engineer needs to enrich and correlate events against a large, frequently-changing set of ~50,000 corporate egress IP ranges expressed in CIDR notation. Detection rules must efficiently match source IPs against these ranges to distinguish internal from external traffic. The list is updated hourly by an automated pipeline. Which approach best supports efficient CIDR-based matching within YARA-L rules?

Accepted Answer

Store the CIDR ranges in a reference list configured with the CIDR syntax type and reference it in rule conditions using the net.ip_in_range_cidr function

Answer

Store the ranges in a STRING-type reference list and use exact string equality comparisons against the event's principal.ip field

Answer

Hardcode the 50,000 ranges directly into each detection rule's condition block as a large OR expression

Answer

Convert the CIDR ranges into a data table with one row per individual IP address and join against it at rule evaluation time